Google Vision API detects labels for only public images on GCP - google-cloud-storage

Question

I am storing images on Google Cloud Storage and using Google Vision APIs to detect labels of those images. I use the same account and credentials for both purposes.
I am using the sample program given at:
'https://github.com/GoogleCloudPlatform/python-docs-samples/blob/master/vision/cloud-client/detect/detect.py'
I can successfully detect labels for the local images and images on internet which are publicly accessible.
When I use the following with a image stored in a bucket on my GCP storage, the program does not detect any labels unless I mark the data (image) as public.
e.g.
When it is private:
# ./detect.py labels-uri
'https://www.googleapis.com/download/storage/v1/b/mybucket/o/Penguins.jpg?
generation=1510548912343529&alt=media'
Labels:
When I mark it as 'public':
# ./detect.py labels-uri
'https://www.googleapis.com/download/storage/v1/b/mybucket/o/Penguins.jpg?
generation=1510548912343529&alt=media'
Labels:
penguin
bird
king penguin
flightless bird
beak
organism
I was expecting, since I am using the same credentials for the vision and storage API access, it should even work on my private images.
Can you help?

Answer 1

When referencing a Cloud Storage object, use the URI pattern gs://bucket_name/object_name.
Try ./detect.py labels-uri gs://mybucket/Penguins.jpg
Cloud Vision supports both Cloud Storage objects as well as any arbitrary URL. However, when you reference a URL, Cloud Vision does not forward your credentials there, unlike when you reference a Cloud Storage object directly. Here you're specifying a URL that would attempt to download a Cloud Storage object anonymously, which is not what you want. (Note however that Cloud Vision does not support specifying a specific version of a GCS object -- for more, see https://cloud.google.com/vision/docs/reference/rest/v1/images/annotate).

Answer 2

This worked for me with a non-public GS bucket:
export GOOGLE_APPLICATION_CREDENTIALS="path-to-your-creds.json"
Python3:
import json
import google.auth
import requests
from google.auth.transport import requests as grequests
from google.cloud import storage
URL = "https://vision.googleapis.com/v1p4beta1/files:asyncBatchAnnotate"
credentials, project_id = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])
credentials.refresh(grequests.Request())
headers = {'Authorization': 'Bearer ' + credentials.token, "Content-Type": "application/json; charset=utf-8"}
request_json = {
"requests": [
{
"inputConfig": {
"gcsSource": {
"uri": "gs://your-input-bucket/test.pdf"
},
"mimeType": "application/pdf"
},
"features": [
{
"type": "DOCUMENT_TEXT_DETECTION"
}
],
"outputConfig": {
"gcsDestination": {
"uri": "gs://your-output-bucket/json"
},
"batchSize": 1
}
}
]
}
response = requests.post(URL, json=request_json, headers=headers)
print(response.content)