Inline Google service-account key JSON (recommended). Alternatively set GOOGLE_APPLICATION_CREDENTIALS to a key file path. Secret.
GOOGLE_APPLICATION_CREDENTIALS
No
Path to a Google service-account key file (alternative to PLAY_SERVICE_ACCOUNT_JSON).
PLAY_DEVELOPER_ACCOUNT_ID
No
Numeric Play developer account id. Required only for the `users` (permissions) toolset.
PLAY_REPORTS_BUCKET
No
Cloud Storage report-export bucket for the `play_reviews_export` and `play_stats_export` tools — the value from Play Console > Download reports > 'Copy Cloud Storage URI' (pubsite_prod_rev_...). Not the developer account id.
PLAY_STORAGE_CREDENTIALS
No
Path to a credentials JSON used only for the storage/reviews-export client. The report buckets usually can't be granted to a service account; locally `gcloud auth application-default login` is auto-detected instead.
PLAY_TOOLSETS
No
Comma-separated toolsets to enable, or 'all'. Toolsets: releases, store_listing, monetization, commerce, reviews, users, devices, advanced, vitals, reports, workflows.