Meta tags:
description=Authenticate to Google Cloud using REST.;

Headings (most frequently used words):

with, credentials, curl, powershell, rest, and, gcloud, authenticate, stay, organized, collections, save, categorize, content, based, on, your, preferences, before, you, begin, types, of, set, the, quota, project, request, what, next, cli, application, default, impersonated, service, account, short, lived, token, metadata, server, api, keys, products, pricing, support, resources, engage,

Text of the page (most frequently used words):
the (171), you (47), for (41), request (38), #gcloud (38), project (35), your (35), cloud (32), and (32), #credentials (32), use (31), token (30), service (29), google (28), access (28), account (27), cli (26), with (24), api (24), following (23), rest (21), this (20), using (19), get (18), application (17), permission (15), authenticate (14), example (14), can (13), com (13), project_id (13), see (12), adc (12), command (12), user (12), googleapis (12), key (12), projects (12), metadata (12), roles (12), method (11), curl (11), more (10), auth (10), print (10), json (10), https (10), set (10), default (10), server (10), information (9), content (9), overview (9), headers (9), bearer (9), that (9), quota (9), must (9), iam (9), role (9), are (8), authentication (8), not (8), authorization (8), run (8), call (8), apis (8), environment (8), thumb (7), make (7), client (7), libraries (7), any (7), keys (7), cloudresourcemanager (7), provide (7), development (7), management (7), code (6), need (6), details (6), how (6), translation (6), goog (6), cred (6), execute (6), have (6), usage (6), services (6), returned (6), impersonation (6), browser (6), resourcemanager (6), enable (6), manage (5), about (5), resources (5), page (5), send (5), http (5), language (5), file (5), one (5), name (5), data (5), replacements (5), into (5), included (5), owner (5), serviceusage (5), insert (5), engine (5), compute (5), from (5), generate (5), short (5), lived (5), impersonate (5), privilege (5), bearing (5), same (5), want (5), resource (5), identity (5), sdk (5), português (4), español (4), samples (4), down (4), when (4), configuration (4), header (4), post (4), translate (4), body (4), these (4), before (4), specified (4), permissions (4), required (4), attached (4), local (4), tools (4), sign (3), products (3), understand (3), other (3), billing (3), invoke (3), webrequest (3), charset (3), utf (3), uri (3), select (3), object (3), expand (3), save (3), named (3), powershell (3), choose (3), options (3), needs (3), create (3), don (3), security (3), also (3), returns (3), explicitly (3), api_key (3), query (3), through (3), access_token (3), such (3), then (3), provided (3), variety (3), gets (3), pattern (3), approach (3), types (3), guides (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), terms (2), site (2), youtube (2), started (2), system (2), support (2), contact (2), pricing (2), sample (2), last (2), updated (2), 2026 (2), utc (2), otherwise (2), licensed (2), under (2), license (2), feedback (2), learn (2), what (2), type (2), hello (2), consumer (2), used (2), error (2), message (2), supported (2), include (2), documents (2), analyzeentities (2), parameter (2), however (2), url (2), step (2), app (2), has (2), priv_sa (2), impersonated (2), serviceaccounts (2), getaccesstoken (2), impersonating (2), way (2), being (2), running (2), only (2), works (2), requires (2), setup (2), another (2), preferred (2), skip (2), steps (2), initialize (2), provider (2), install (2), based (2), documentation (2), languages (2), frameworks (2), infrastructure (2), costs (2), storage (2), observability (2), monitoring (2), networking (2), migration (2), industry (2), solutions (2), distributed (2), hybrid (2), multicloud (2), databases (2), analytics (2), pipelines (2), hosting (2), managing (2), best (2), practices (2), configure (2), methods (2), console (2), cross (2), product (2), reference (2), technology (2), areas (2), close (2), subscribe, newsletter, our, third, decade, climate, action, join, cookies, privacy, tech, twitter, events, blog, engage, training, certification, architecture, center, getting, github, status, release, notes, community, forums, sales, marketplace, all, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, except, noted, java, registered, trademark, oracle, its, affiliates, developers, policies, apache, creative, commons, attribution, describes, next, succeeds, try, without, happens, specify, contenttype, infile, source, target, uses, word, spanish, able, designate, administrator, who, give, might, encounter, issue, working, some, billed, track, saying, shows, natural, replace, string, includes, exposing, theft, scans, shown, previous, making, token_type, 3599, expires_in, ya29, ahes6zrn3, hlhapya30gnw_bhsb_qtai85nhq39he3c2ltrcara, response, similar, flavor, internal, computemetadata, instance, accounts, line, tool, build, kubernetes, functions, flexible, standard, follow, instructions, email, address, gserviceaccount, flag, identify, will, prinicipal, perform, called, creator, add, even, setting, serviceaccounttokencreator, review, simplest, programmatically, end, shouldn, instead, principal, associated, require, generated, accepts, addition, restricted, prevent, environments, would, found, but, querying, does, rely, existing, obtain, testing, locally, requesting, temporary, elevated, privileges, option, authenticating, production, because, finds, where, virtual, machine, scenario, creates, contains, easiest, most, secure, necessary, created, likely, already, admin, grant, serviceusageadmin, manager, init, external, idp, first, federated, complete, begin, categorize, preferences, stay, organized, collections, home, uninstalling, components, packages, scripting, commands, cheat, sheet, develop, accessibility, features, properties, configurations, behind, proxy, firewall, cases, reauthentication, verification, requirement, tokens, troubleshoot, premises, containerized, ways, homebrew, installer, versioned, archives, snap, package, migrate, stable, image, docker, installation, explained, discover, start, free, main,

Text of the page (random words):
gement infrastructure as code sdk languages frameworks and tools console english deutsch español español américa latina français indonesia italiano português português brasil עברית 中文 简体 中文 繁體 日本語 한국어 sign in google cloud sdk authentication start free overview guides reference resources technology areas more overview guides reference resources cross product tools more console discover google cloud sdk overview gcloud cli overview cloud client libraries overview client libraries and cloud apis explained get started install the gcloud cli other installation methods using docker overview migrate to the stable image using a snap package using versioned archives using the installer using homebrew authenticate to google cloud authentication methods at google ways to authenticate authenticate for using client libraries authenticate for using rest authenticate by using service account impersonation application default credentials set up application default credentials overview local development environment resource with an attached service account containerized environment on premises or another cloud provider cloud based development environment how application default credentials works troubleshoot your adc setup api keys use api keys to access apis manage api keys best practices for managing api keys get an id token tokens overview token types 2 step verification requirement reauthentication authentication use cases identity management products configure the gcloud cli initialize the gcloud cli authenticate for the gcloud cli configure the gcloud cli for use behind a proxy or firewall manage gcloud cli configurations manage gcloud cli properties enable accessibility features develop gcloud cli cheat sheet scripting gcloud cli commands client libraries best practices manage packages in gcloud cli managing gcloud cli components uninstalling the gcloud cli ai and ml application development application hosting compute data analytics and pipelines databases distributed hybrid and multicloud industry solutions migration networking observability and monitoring security storage access and resources management costs and usage management infrastructure as code sdk languages frameworks and tools home documentation application development google cloud sdk authentication guides send feedback authenticate with rest stay organized with collections save and categorize content based on your preferences this page describes how to authenticate when you make a rest request to a google api for information about how to authenticate when you use google client libraries see authenticate using client libraries before you begin to run the samples on this page complete the following steps install the google cloud cli if you re using an external identity provider idp you must first sign in to the gcloud cli with your federated identity to initialize the gcloud cli run the following command gcloud init enable the cloud resource manager and identity and access management iam apis roles required to enable apis to enable apis you need the serviceusage services enable permission if you created the project then you likely already have this permission through the owner role roles owner otherwise you can get this permission through the service usage admin role roles serviceusage serviceusageadmin learn how to grant roles gcloud services enable cloudresourcemanager googleapis com iam googleapis com if you don t want to use the gcloud cli you can skip these steps and use service account impersonation or the metadata server to generate a token types of credentials you can use the following types of credentials to authenticate a rest call your gcloud cli credentials this approach is the easiest and most secure way to provide credentials to a rest method in a local development environment if your user account has the necessary identity and access management iam permissions for the method you want to call this is the preferred approach your gcloud credentials are not the same as the credentials you provide to adc using the gcloud cli for more information see gcloud cli authentication configuration and adc configuration the credentials provided to application default credentials adc this method is the preferred option for authenticating a rest call in a production environment because adc finds credentials from the resource where your code is running such as a compute engine virtual machine you can also use adc to authenticate in a local development environment in this scenario the gcloud cli creates a file that contains your credentials in your local file system the credentials provided by impersonating a service account this method requires more setup if you want to use your existing credentials to obtain short lived credentials for another service account such as testing with a service account locally or requesting temporary elevated privileges use this approach the credentials returned by the metadata server this method works only in environments with access to a metadata server the credentials returned by the metadata server are the same as the credentials that would be found by application default credentials using the attached service account but you explicitly request the access token from the metadata server and then provide it with the rest request querying the metadata server for credentials requires an http get request this method does not rely on the google cloud cli api keys you can use an api key with a rest request only for apis that accepts api keys in addition the api key must not be restricted to prevent it from being used with the api gcloud cli credentials to run the following example you need the resourcemanager projects get permission on the project the resourcemanager projects get permission is included in a variety of roles for example the browser role roles browser use the gcloud auth print access token command to insert an access token generated from your user credentials the following example gets details for the specified project you can use the same pattern for any rest request before using any of the request data make the following replacements project_id your google cloud project id or name to send your request choose one of these options curl execute the following command curl x get h authorization bearer gcloud auth print access token https cloudresourcemanager googleapis com v3 projects project_id powershell execute the following command cred gcloud auth print access token headers authorization bearer cred invoke webrequest method get headers headers uri https cloudresourcemanager googleapis com v3 projects project_id select object expand content the details for your project are returned for apis that require a quota project you must set one explicitly for the request for more information see set the quota project with a rest request on this page application default credentials to run the following example the principal associated with the credentials you provide to adc needs the resourcemanager projects get permission on the project the resourcemanager projects get permission is included in a variety of roles for example the browser role roles browser provide credentials to adc if you are running on a google cloud compute resource you shouldn t provide your user credentials to adc instead use the attached service account to provide credentials for more information see set up adc for a resource with an attached service account use the gcloud auth application default print access token command to insert the access token returned by adc into your rest request the following example gets details for the specified project you can use the same pattern for any rest request before using any of the request data make the following replacements project_id your google cloud project id or name to send your request choose one of these options curl execute the following command curl x get h authorization bearer gcloud auth application default print access token https cloudresourcemanager googleapis com v3 projects project_id powershell execute the following command cred gcloud auth application default print access token headers authorization bearer cred invoke webrequest method get headers headers uri https cloudresourcemanager googleapis com v3 projects project_id select object expand content the details for your project are returned if your request returns an error message about end user credentials not being supported by this api see set the quota project with a rest request on this page impersonated service account the simplest way to impersonate a service account to generate an access token is by using the gcloud cli however if you need to generate the token programmatically or you don t want to use the gcloud cli you can use impersonation to generate a short lived token for more information about impersonating a service account see use service account impersonation review the required permissions the prinicipal you want to use to perform the impersonation must have the iam serviceaccounts getaccesstoken permission on the impersonated service account also called the privilege bearing service account the iam serviceaccounts getaccesstoken permission is included in the service account token creator role roles iam serviceaccounttokencreator if you are using your user account you need to add this permission even if you have the owner role roles owner on the project for more information see setting required permissions identify or create the privilege bearing service account the service account you will impersonate the privilege bearing service account must have the permissions required to make the api method call gcloud use the gcloud auth print access token command with the impersonate service account flag to insert an access token for the privilege bearing service account into your rest request the following example gets details for the specified project you can use the same pattern for any rest request to run this example the service account you impersonate needs the resourcemanager projects get permission the resourcemanager projects get permission is included in a variety of roles for example the browser role roles browser make the following replacements priv_sa the email address of the privilege bearing service account for example my sa my project iam gserviceaccount com project_id your google cloud project id or name curl x get h authorization bearer gcloud auth print access token impersonate service account priv_sa https cloudresourcemanager googleapis com v3 projects project_id short lived token to generate a short lived token by using service account impersonation follow the instructions provided in create a short lived access token metadata server to get an access token from the metadata server you must make the rest call using one of the services that has access to a metadata server compute engine app engine standard environment app engine flexible environment cloud run functions cloud run google kubernetes engine cloud build you use a command line tool such as curl to get an access token and then insert it into your rest request query the metadata server for an access token curl http metadata google internal computemetadata v1 instance service accounts default token h metadata flavor google the request returns a response similar to the following example access_token ya29 ahes6zrn3 hlhapya30gnw_bhsb_qtai85nhq39he3c2ltrcara expires_in 3599 token_type bearer insert the access token into your rest request making the following replacements access_token the access token returned in the previous step project_id your google cloud project id or name curl x get h authorization bearer access_token https cloudresourcemanager googleapis com v3 projects project_id api keys to include an api key with a rest api call use the x goog api key http header as shown in the following example curl x post h x goog api key api_key h content type application json charset utf 8 d request json https translation googleapis com language translate v2 if you can t use the http header you can use the key query parameter however this method includes your api key in the url exposing your key to theft through url scans the following example shows how to use the key query parameter with a cloud natural language api request for documents analyzeentities replace api_key with the key string of your api key post https language googleapis com v1 documents analyzeentities key api_key set the quota project with a rest request to call some apis with user credentials you must also set the project that is billed for your usage and used to track quota if your api call returns an error message saying that user credentials are not supported or that the quota project is not set you must explicitly set the quota project for the request to set the quota project include the x goog user project header with your request for more information about when you might encounter this issue see user credentials not working you must have the serviceusage services use iam permission for a project to be able to designate it as your billing project the serviceusage services use permission is included in the service usage consumer iam role if you don t have the serviceusage services use permission for any project contact your security administrator or a project owner who can give you the service usage consumer role in the project the following example uses the cloud translation api to translate the word hello into spanish the cloud translation api is an api that needs a quota project to be specified to run the sample create a file named request json with the request body content before using any of the request data make the following replacements project_id the id or name of the google cloud project to use as a billing project request json body q hello source en target es to send your request choose one of these options curl save the request body in a file named request json and execute the following command curl x post h authorization bearer gcloud auth print access token h x goog user project project_id h content type application json charset utf 8 d request json https translation googleapis com language translate v2 powershell save the request body in a file named request json and execute the following command cred gcloud auth print access token headers authorization bearer cred x goog user project project_id invoke webrequest method post headers headers contenttype application json charset utf 8 infile request json uri https translation googleapis com language translate v2 select object expand content the translation request succeeds you can try the command without the x goog user project http header to see what happens when you do not specify the billing project what s next see an overview of authentication learn how to authenticate with client libraries understand gcloud cli authentication configuration and adc configuration send feedback except as otherwise noted the content of this page i...