google-cloud-recipe-auth

The saved excerpt is a snapshot from when this skill was listed. The external source remains the complete and most current version.

---
name: google-cloud-recipe-auth
metadata:
  category: GettingStarted
description: Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.
---

# Authenticating to Google Cloud

[Authentication](https://docs.cloud.google.com/docs/authentication.md.txt) is the
process of proving **who you are**. In Google Cloud, you represent a
**Principal** (an identity like a user or a service). This is the first step
before [Authorization](https://docs.cloud.google.com/iam/docs/overview.md.txt)
(determining **what you can do**).

## Authentication

### Clarifying Questions for the Agent

Before providing a specific solution, clarify the following with the user:

1.  **Who or what is authenticating?** (A human developer, a local script, or an
    application running in production?)
2.  **Where is the code running?** (Local laptop, [Compute
    Engine](https://docs.cloud.google.com/compute/docs.md.txt),
    [GKE](https://docs.cloud.google.com/kubernetes-engine/docs.md.txt), [Cloud
    Run](https://docs.cloud.google.com/run/docs.md.txt), or another cloud like
    AWS/Azure?)
3.  **What is the target?** (A Google Cloud API like Storage/BigQuery, or a
    custom application you built?)
4.  **Are you using a high-level client library?** (e.g., Python, Go, Node.js
    libraries usually handle ADC automatically.)

---

## Human Authentication

For users to access Google Cloud, they need an identity that Google Cloud can
recognize.

### Types of User Identities

Google Cloud supports several ways to configure identities for your internal
workforce (developers, administrators, employees):

*   **[Google-Managed
    Accounts](https://docs.cloud.google.com/iam/docs/user-identities.md.txt)**:
    You can use Cloud Identity or Google Workspace to create managed user
    accounts. These are called managed accounts because your organization
    controls their lifecycle and configuration.
*   **[Federation using Cloud Identity or Google
    Workspace](https://docs.cloud.google.com/iam/docs/user-identities.md.txt)**:
    You can federate identities to allow users to use their existing identity
    and credentials to sign in to Google services. Users authenticate against an
    external identity provider (IdP), but you must keep accounts synchronized
    into Google Cloud using tools like Google Cloud Directory Sync (GCDS) or an
    external authoritative source like Active Directory or Microsoft Entra ID.
*   **[Workforce Identity
    Federation](https://docs.cloud.google.com/iam/docs/user-identities.md.txt)**:
    This lets you use an external IdP to authenticate and authorize a workforce
    using IAM directly. Unlike standard federation, you do not need to
    synchronize user identities from your existing IdP to Google Cloud
    identities. It supports syncless, attribute-based single sign-on.

### Methods of Access for Developers and Administrators

Used for interacting with Google Cloud resources and APIs during development and
management.

*   **[Google Cloud Console](https://console.cloud.google.com/)**: The primary
    web interface. You authenticate using your Google Account (Gmail or [Google
    Workspace](https://workspace.google.com/)).
*   **[gcloud CLI](https://docs.cloud.google.com/sdk/docs/install-sdk.md.txt) (`gcloud
    auth login`)**: Used to authenticate the CLI itself so you can run
    management commands (e.g., `gcloud compute instances list`). It uses a
    **Credential** (like an OAuth 2.0 refresh token) stored locally.
*   **Local Development with [App Default Credentials
    (ADC)](https://docs.cloud.google.com/docs/authentication/application-default-credentials.md.txt)
    (`gcloud auth application-default login`)**: This is different from CLI
    auth. It creates a local JSON file that Google Cloud **Client Libraries**
    (Python, Java, etc.) use to act as "you" when you r