The current recommended way to authenticate your applications hosted in prod environments is Workload Identity Pools

Also, you can deploy your app to App Engine, which has it's own service account whose permissions can be tailored. These credentials are automatically injected as application-default credentials.

Another way (not recommended) is to host a SA key in your deployment environment, which would likely point to a similar credentials file.