Better check for need scope.

dask_bigquery/core.py

@@ -15,9 +15,8 @@
 from google.api_core import client_info as rest_client_info
 from google.api_core.gapic_v1 import client_info as grpc_client_info
 from google.auth import default as google_auth_default
-from google.auth.credentials import Credentials
+from google.auth.credentials import Credentials, Scoped
 from google.cloud import bigquery, bigquery_storage
-from google.oauth2 import service_account
 
 import dask_bigquery
 
@@ -64,7 +63,7 @@ def gcs_fs(project_id, credentials=None):
         project_id = project_id or default_project_id
 
     # if it's a service account, update scope
-    if isinstance(credentials, service_account.Credentials):
+    if isinstance(credentials, Scoped) and credentials.requires_scopes:
         credentials = credentials.with_scopes(
             ["https://www.googleapis.com/auth/devstorage.read_write"]
         )

dask_bigquery/tests/test_core.py

@@ -16,8 +16,8 @@
 from distributed.utils_test import loop  # noqa: F401
 from distributed.utils_test import loop_in_thread  # noqa: F401
 from google.api_core.exceptions import InvalidArgument
+from google.auth.credentials import Scoped
 from google.cloud import bigquery
-from google.oauth2 import service_account
 
 from dask_bigquery import read_gbq, to_gbq
 
@@ -122,7 +122,7 @@ def bucket():
     bucket = f"dask-bigquery-tmp-{uuid.uuid4().hex}"
 
     # if it's a service account, update scope
-    if isinstance(credentials, service_account.Credentials):
+    if isinstance(credentials, Scoped) and credentials.requires_scopes:
         credentials = credentials.with_scopes(
             ["https://www.googleapis.com/auth/devstorage.read_write"]
         )