googleapis
diff --git a/‎gcloud/credentials.py
Lines changed: 8 additions & 0 deletions b/‎gcloud/credentials.py
Lines changed: 8 additions & 0 deletions
diff --git a/‎gcloud/test_credentials.py
Lines changed: 14 additions & 4 deletions b/‎gcloud/test_credentials.py
Lines changed: 14 additions & 4 deletions
@@ -99,6 +99,14 @@ def _get_signed_query_params(credentials, expiration, string_to_sign):
     :returns: Query parameters matching the signing credentials with a
               signed payload.
     """
+    if not hasattr(credentials, 'sign_blob'):
+        raise AttributeError('you need a private key to sign credentials.'
+                             'the credentials you are currently using %s '
+                             'just contains a token. see https://googlecloud'
+                             'platform.github.io/gcloud-python/stable/gcloud-'
+                             'auth.html#setting-up-a-service-account for more '
+
     _, signature_bytes = credentials.sign_blob(string_to_sign)
     signature = base64.b64encode(signature_bytes)
     service_account_name = credentials.service_account_email
 
@@ -40,7 +40,7 @@ def _callFUT(self, *args, **kwargs):
         return generate_signed_url(*args, **kwargs)
 
     def _generate_helper(self, response_type=None, response_disposition=None,
-                         generation=None):
+                         generation=None, credentials=None):
         import base64
         from six.moves.urllib.parse import parse_qs
         from six.moves.urllib.parse import urlsplit
@@ -50,7 +50,7 @@ def _generate_helper(self, response_type=None, response_disposition=None,
         ENDPOINT = 'http://api.example.com'
         RESOURCE = '/name/path'
         SIGNED = base64.b64encode(b'DEADBEEF')
-        CREDENTIALS = _Credentials()
+        CREDENTIALS = credentials or _Credentials()
 
         def _get_signed_query_params(*args):
             credentials, expiration = args[:2]
@@ -90,15 +90,19 @@ def _get_signed_query_params(*args):
         self.assertEqual(frag, '')
 
     def test_w_expiration_int(self):
-        self._generate_helper()
+        self._generate_helper(credentials=_Credentials())
+
+    def test_w_google_credentials(self):
+        self._generate_helper(credentials=_GoogleCredentials())
 
     def test_w_custom_fields(self):
         response_type = 'text/plain'
         response_disposition = 'attachment; filename=blob.png'
         generation = '123'
         self._generate_helper(response_type=response_type,
                               response_disposition=response_disposition,
-                              generation=generation)
+                              generation=generation,
+                              credentials=_Credentials())
 
 
 class Test__get_signed_query_params(unittest2.TestCase):
@@ -226,6 +230,12 @@ def sign_blob(self, bytes_to_sign):
         return None, self._sign_result
 
 
+class _GoogleCredentials(object):
+
+    def __init__(self, service_account_email='testing@example.com'):
+        self.service_account_email = service_account_email
+
+
 class _Client(object):
 
     def __init__(self):