Should use GoogleCredentials.getApplicationDefault() to get the service account, pending fix for googleapis/google-auth-library-java#381 to support createScoped().
Both simplifies deployment and makes it more secure as service account private key is never exposed to anyone.