Manage API keys | Authentication

<!doctype html> <html lang="en" dir="ltr"> <head> <meta name="google-signin-client-id" content="721724668570-nbkv1cfusk7kk4eni4pjvepaus73b13t.apps.googleusercontent.com"> <meta name="google-signin-scope" content="profile email https://www.googleapis.com/auth/developerprofiles https://www.googleapis.com/auth/developerprofiles.award https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/webhistory"> <meta property="og:site_name" content="Google Cloud"> <meta property="og:type" content="website"><meta name="theme-color" content="#039be5"><meta charset="utf-8"> <meta content="IE=Edge" http-equiv="X-UA-Compatible"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="manifest" href="/_pwa/cloud/manifest.json" crossorigin="use-credentials"> <link rel="preconnect" href="//www.gstatic.com" crossorigin> <link rel="preconnect" href="//fonts.gstatic.com" crossorigin> <link rel="preconnect" href="//fonts.googleapis.com" crossorigin> <link rel="preconnect" href="//apis.google.com" crossorigin> <link rel="preconnect" href="//www.google-analytics.com" crossorigin><link rel="stylesheet" href="//fonts.googleapis.com/css?family=Google+Sans:400,500,700|Google+Sans+Text:400,400italic,500,500italic,700,700italic|Roboto:400,400italic,500,500italic,700,700italic|Roboto+Mono:400,500,700&display=swap"> <link rel="stylesheet" href="//fonts.googleapis.com/css2?family=Material+Icons&family=Material+Symbols+Outlined&display=block"><link rel="stylesheet" href="https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/css/app.css"> <link rel="shortcut icon" href="https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/favicons/onecloud/favicon.ico"> <link rel="apple-touch-icon" href="https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/favicons/onecloud/super_cloud.png"><link rel="canonical" href="https://cloud.google.com/docs/authentication/api-keys"><link rel="search" type="application/opensearchdescription+xml" title="Google Cloud" href="https://cloud.google.com/s/opensearch.xml"> <link rel="alternate" hreflang="en" href="https://cloud.google.com/docs/authentication/api-keys" /><link rel="alternate" hreflang="x-default" href="https://cloud.google.com/docs/authentication/api-keys" /><link rel="alternate" hreflang="zh-Hans" href="https://cloud.google.com/docs/authentication/api-keys?hl=zh-cn" /><link rel="alternate" hreflang="fr" href="https://cloud.google.com/docs/authentication/api-keys?hl=fr" /><link rel="alternate" hreflang="de" href="https://cloud.google.com/docs/authentication/api-keys?hl=de" /><link rel="alternate" hreflang="id" href="https://cloud.google.com/docs/authentication/api-keys?hl=id" /><link rel="alternate" hreflang="it" href="https://cloud.google.com/docs/authentication/api-keys?hl=it" /><link rel="alternate" hreflang="ja" href="https://cloud.google.com/docs/authentication/api-keys?hl=ja" /><link rel="alternate" hreflang="ko" href="https://cloud.google.com/docs/authentication/api-keys?hl=ko" /><link rel="alternate" hreflang="pt-BR" href="https://cloud.google.com/docs/authentication/api-keys?hl=pt-br" /><link rel="alternate" hreflang="es-419" href="https://cloud.google.com/docs/authentication/api-keys?hl=es-419" /><title>Manage API keys  |  Authentication  |  Google Cloud</title> <meta property="og:title" content="Manage API keys  |  Authentication  |  Google Cloud"><meta property="og:url" content="https://cloud.google.com/docs/authentication/api-keys"><meta property="og:image" content="https://cloud.google.com/_static/cloud/images/social-icon-google-cloud-1200-630.png"> <meta property="og:image:width" content="1200"> <meta property="og:image:height" content="630"><meta property="og:locale" content="en"><meta name="twitter:card" content="summary_large_image"><script type="application/ld+json"> { "@context": "https://schema.org", "@type": "Article", "headline": "Manage API keys" } </script><script type="application/ld+json"> { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [{ "@type": "ListItem", "position": 1, "name": "Documentation", "item": "https://cloud.google.com/docs" },{ "@type": "ListItem", "position": 2, "name": "Authentication", "item": "https://cloud.google.com/docs/authentication" },{ "@type": "ListItem", "position": 3, "name": "Manage API keys", "item": "https://cloud.google.com/docs/authentication/api-keys" }] } </script> <link rel="stylesheet" href="/extras.css"></head> <body class="" template="page" theme="cloud-theme" type="article" layout="docs" free-trial display-toc pending> <devsite-progress type="indeterminate" id="app-progress"></devsite-progress> <a href="#main-content" class="skip-link button"> Skip to main content </a> <section class="devsite-wrapper"> <devsite-cookie-notification-bar></devsite-cookie-notification-bar><cloudx-track userCountry="SG"></cloudx-track> <cloudx-utils-init></cloudx-utils-init> <devsite-header keep-tabs-visible> <div class="devsite-header--inner nocontent"> <div class="devsite-top-logo-row-wrapper-wrapper"> <div class="devsite-top-logo-row-wrapper"> <div class="devsite-top-logo-row"> <button type="button" id="devsite-hamburger-menu" class="devsite-header-icon-button button-flat material-icons gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Navigation menu button" visually-hidden aria-label="Open menu"> </button> <div class="devsite-product-name-wrapper"> <a href="/" class="devsite-site-logo-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Site logo" track-type="globalNav" track-name="googleCloud" track-metadata-position="nav" track-metadata-eventDetail="nav"> <picture> <img src="https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/cloud-logo.svg" class="devsite-site-logo" alt="Google Cloud"> </picture> </a> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item "> </li> </ul> </div> <div class="devsite-top-logo-row-middle"> <div class="devsite-header-upper-tabs"> <cloudx-tabs-nav class="upper-tabs"> <nav class="devsite-tabs-wrapper" aria-label="Upper tabs"> <tab class="devsite-active"> <a href="https://cloud.google.com/docs" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://cloud.google.com/docs" track-type="nav" track-metadata-position="nav - docs-home" track-metadata-module="primary nav" aria-label="Documentation, selected" data-category="Site-Wide Custom Events" data-label="Tab: Documentation" track-name="docs-home" track-link-column-type="single-column" > Documentation </a> </tab> <tab class="devsite-dropdown devsite-clickable "> <a href="https://cloud.google.com/docs/tech-area-overviews" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://cloud.google.com/docs/tech-area-overviews" track-type="nav" track-metadata-position="nav - technology-areas" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Technology areas" track-name="technology-areas" track-link-column-type="single-column" > Technology areas </a> <button aria-haspopup="menu" aria-expanded="false" aria-label="Dropdown menu for Technology areas" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/tech-area-overviews" track-metadata-position="nav - technology-areas" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Technology areas" track-name="technology-areas" track-link-column-type="single-column" class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button> <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden> <button class="devsite-tabs-close-button material-icons button-flat gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Close dropdown menu" aria-label="Close dropdown menu" track-type="nav" track-name="close" track-metadata-eventdetail="#" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav">close</button> <div class="devsite-tabs-dropdown-content"> <div class="devsite-tabs-dropdown-column "> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/ai-ml" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/ai-ml" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> AI and ML </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/application-development" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/application-development" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Application development </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/application-hosting" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/application-hosting" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Application hosting </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/compute-area" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/compute-area" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Compute </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/data" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/data" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Data analytics and pipelines </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/databases" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/databases" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Databases </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/dhm-cloud" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/dhm-cloud" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Distributed, hybrid, and multicloud </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/generative-ai" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/generative-ai" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Generative AI </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/industry" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/industry" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Industry solutions </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/networking" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/networking" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Networking </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/observability" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/observability" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Observability and monitoring </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/security" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/security" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Security </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/storage" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/storage" track-metadata-position="nav - technology-areas" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Storage </div> </a> </li> </ul> </div> </div> </div> </tab> <tab class="devsite-dropdown devsite-clickable "> <a href="https://cloud.google.com/docs/cross-product-overviews" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://cloud.google.com/docs/cross-product-overviews" track-type="nav" track-metadata-position="nav - crossproduct" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Cross-product tools" track-name="crossproduct" track-link-column-type="single-column" > Cross-product tools </a> <button aria-haspopup="menu" aria-expanded="false" aria-label="Dropdown menu for Cross-product tools" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/cross-product-overviews" track-metadata-position="nav - crossproduct" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Cross-product tools" track-name="crossproduct" track-link-column-type="single-column" class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button> <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden> <button class="devsite-tabs-close-button material-icons button-flat gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Close dropdown menu" aria-label="Close dropdown menu" track-type="nav" track-name="close" track-metadata-eventdetail="#" track-metadata-position="nav - crossproduct" track-metadata-module="tertiary nav">close</button> <div class="devsite-tabs-dropdown-content"> <div class="devsite-tabs-dropdown-column "> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/access-resources" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/access-resources" track-metadata-position="nav - crossproduct" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Access and resources management </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/costs-usage" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/costs-usage" track-metadata-position="nav - crossproduct" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Costs and usage management </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/devtools" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/devtools" track-metadata-position="nav - crossproduct" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud SDK, languages, frameworks, and tools </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/iac" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/iac" track-metadata-position="nav - crossproduct" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Infrastructure as code </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/docs/migration" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/docs/migration" track-metadata-position="nav - crossproduct" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Migration </div> </a> </li> </ul> </div> </div> </div> </tab> <tab class="devsite-dropdown devsite-clickable "> <a href="https://cloud.google.com/" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://cloud.google.com/" track-type="nav" track-metadata-position="nav - related-sites" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Related sites" track-name="related-sites" track-link-column-type="single-column" > Related sites </a> <button aria-haspopup="menu" aria-expanded="false" aria-label="Dropdown menu for Related sites" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/" track-metadata-position="nav - related-sites" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Related sites" track-name="related-sites" track-link-column-type="single-column" class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button> <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden> <button class="devsite-tabs-close-button material-icons button-flat gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Close dropdown menu" aria-label="Close dropdown menu" track-type="nav" track-name="close" track-metadata-eventdetail="#" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav">close</button> <div class="devsite-tabs-dropdown-content"> <div class="devsite-tabs-dropdown-column "> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-item"> <a href="https://cloud.google.com/" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud Home </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/free" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/free" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Free Trial and Free Tier </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/architecture" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/architecture" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Architecture Center </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/blog" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/blog" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Blog </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/contact" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/contact" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Contact Sales </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/developers" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/developers" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud Developer Center </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/" track-type="nav" track-metadata-eventdetail="https://developers.google.com/" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Developer Center </div> </a> </li> <li class="devsite-nav-item"> <a href="https://console.cloud.google.com/marketplace" track-type="nav" track-metadata-eventdetail="https://console.cloud.google.com/marketplace" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud Marketplace </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/marketplace/docs" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/marketplace/docs" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud Marketplace Documentation </div> </a> </li> <li class="devsite-nav-item"> <a href="https://www.cloudskillsboost.google/paths" track-type="nav" track-metadata-eventdetail="https://www.cloudskillsboost.google/paths" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud Skills Boost </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/solutions" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/solutions" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud Solution Center </div> </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/support-hub" track-type="nav" track-metadata-eventdetail="https://cloud.google.com/support-hub" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud Support </div> </a> </li> <li class="devsite-nav-item"> <a href="https://www.youtube.com/@googlecloudtech" track-type="nav" track-metadata-eventdetail="https://www.youtube.com/@googlecloudtech" track-metadata-position="nav - related-sites" track-metadata-module="tertiary nav" tooltip > <div class="devsite-nav-item-title"> Google Cloud Tech Youtube Channel </div> </a> </li> </ul> </div> </div> </div> </tab> </nav> </cloudx-tabs-nav> </div> <devsite-search enable-signin enable-search enable-suggestions project-name="Authentication" tenant-name="Google Cloud" project-scope="/docs/authentication" url-scoped="https://cloud.google.com/s/results/docs/authentication" > <form class="devsite-search-form" action="https://cloud.google.com/s/results" method="GET"> <div class="devsite-search-container"> <button type="button" search-open class="devsite-search-button devsite-header-icon-button button-flat material-icons" aria-label="Open search"></button> <div class="devsite-searchbox"> <input aria-activedescendant="" aria-autocomplete="list" aria-label="Search" aria-expanded="false" aria-haspopup="listbox" autocomplete="off" class="devsite-search-field devsite-search-query" name="q" placeholder="Search" role="combobox" type="text" value="" > <div class="devsite-search-image material-icons" aria-hidden="true"> </div> <div class="devsite-search-shortcut-icon-container" aria-hidden="true"> <kbd class="devsite-search-shortcut-icon">/</kbd> </div> </div> </div> </form> <button type="button" search-close class="devsite-search-button devsite-header-icon-button button-flat material-icons" aria-label="Close search"></button> </devsite-search> </div> <devsite-language-selector> <ul role="presentation"> <li role="presentation"> <a role="menuitem" lang="en" >English</a> </li> <li role="presentation"> <a role="menuitem" lang="de" >Deutsch</a> </li> <li role="presentation"> <a role="menuitem" lang="es_419" >Español – América Latina</a> </li> <li role="presentation"> <a role="menuitem" lang="fr" >Français</a> </li> <li role="presentation"> <a role="menuitem" lang="id" >Indonesia</a> </li> <li role="presentation"> <a role="menuitem" lang="it" >Italiano</a> </li> <li role="presentation"> <a role="menuitem" lang="pt_br" >Português – Brasil</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_cn" >中文 – 简体</a> </li> <li role="presentation"> <a role="menuitem" lang="ja" >日本語</a> </li> <li role="presentation"> <a role="menuitem" lang="ko" >한국어</a> </li> </ul> </devsite-language-selector> <devsite-user enable-profiles fp-auth id="devsite-user"> Sign in </devsite-user> </div> </div> </div> <div class="devsite-collapsible-section "> <div class="devsite-header-background"> <div class="devsite-product-id-row" hidden> <div class="devsite-product-description-row"> </div> </div> <div class="devsite-doc-set-nav-row"> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item "> <a href="https://cloud.google.com/docs/authentication" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Lower Header" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="Authentication" > Authentication </a> </li> </ul> <div class="devsite-product-button-row"> <a href="https://cloud.google.com/contact" class="cta-button-secondary button " data-overflow-container="left" data-overflow-wrapper="tab" track-name="sales" track-metadata-position="nav" data-overflow="devsite-tabs-wrapper" track-metadata-eventDetail="nav" track-type="contact" >Contact Us</a> <a href="//console.cloud.google.com/freetrial" class="cloud-free-trial-button cta-button-primary button-primary button cloud-button cloud-button--primary " track-metadata-position="nav" track-metadata-eventDetail="nav" data-overflow-class="devsite-header-link devsite-top-button button cloud-free-trial-button cloud-free-trial-enabled cloud-button cloud-button--primary" data-overflow-container="right" track-type="freeTrial" track-name="gcpCta" referrerpolicy="no-referrer-when-downgrade" data-overflow="devsite-top-logo-row" >Start free</a> </div> </div> </div> </div> </div> </devsite-header> <devsite-book-nav scrollbars > <div class="devsite-book-nav-filter" > <input type="text" placeholder="Filter" aria-label="Type to filter" role="searchbox"> </div> <nav class="devsite-book-nav devsite-nav nocontent" aria-label="Side menu"> <div class="devsite-mobile-header"> <button type="button" id="devsite-close-nav" class="devsite-header-icon-button button-flat material-icons gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Close navigation" aria-label="Close navigation"> </button> <div class="devsite-product-name-wrapper"> <a href="/" class="devsite-site-logo-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Site logo" track-type="globalNav" track-name="googleCloud" track-metadata-position="nav" track-metadata-eventDetail="nav"> <picture> <img src="https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/cloud-logo.svg" class="devsite-site-logo" alt="Google Cloud"> </picture> </a> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item "> </li> </ul> </div> </div> <div class="devsite-book-nav-wrapper"> <div class="devsite-mobile-nav-top"> <ul class="devsite-nav-list"> <li class="devsite-nav-item"> <a href="/docs" class="devsite-nav-title gc-analytics-event devsite-nav-has-children devsite-nav-active" data-category="Site-Wide Custom Events" data-label="Tab: Documentation" track-name="docs-home" track-link-column-type="single-column" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Documentation" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Documentation </a> </li> <li class="devsite-nav-item"> <a href="/docs/tech-area-overviews" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: Technology areas" track-name="technology-areas" track-link-column-type="single-column" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Technology areas" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Technology areas </a> <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu "> <li class="devsite-nav-item"> More </li> </ul> </li> <li class="devsite-nav-item"> <a href="/docs/cross-product-overviews" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: Cross-product tools" track-name="crossproduct" track-link-column-type="single-column" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Cross-product tools" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Cross-product tools </a> <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu "> <li class="devsite-nav-item"> More </li> </ul> </li> <li class="devsite-nav-item"> <a href="/" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: Related sites" track-name="related-sites" track-link-column-type="single-column" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Related sites" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Related sites </a> <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu "> <li class="devsite-nav-item"> More </li> </ul> </li> <li class="devsite-nav-item"> <a href="//console.cloud.google.com/" class="devsite-nav-title gc-analytics-event " track-type="globalNav" referrerpolicy="no-referrer-when-downgrade" track-metadata-eventDetail="nav" track-name="console" track-metadata-position="nav" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Console" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Console </a> </li> <li class="devsite-nav-item"> <a href="/contact" class="cta-button-secondary button" data-overflow-container="left" data-overflow-wrapper="tab" track-name="sales" track-metadata-position="nav" data-overflow="devsite-tabs-wrapper" track-metadata-eventDetail="nav" track-type="contact" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Contact Us" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Contact Us </a> </li> <li class="devsite-nav-item"> <a href="//console.cloud.google.com/freetrial" class="cloud-free-trial-button cta-button-primary button-primary button cloud-button cloud-button--primary" track-metadata-position="nav" track-metadata-eventDetail="nav" data-overflow-class="devsite-header-link devsite-top-button button cloud-free-trial-button cloud-free-trial-enabled cloud-button cloud-button--primary" data-overflow-container="right" track-type="freeTrial" track-name="gcpCta" referrerpolicy="no-referrer-when-downgrade" data-overflow="devsite-top-logo-row" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Start free" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Start free </a> </li> </ul> </div> <div class="devsite-mobile-nav-bottom"> <ul class="devsite-nav-list" menu="_book"> <li class="devsite-nav-item"><a href="/docs" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs" alt-paths=" /security/deletion /security/data-loss-prevention /security/data-safety /security/encryption/customer-supplied-encryption-keys /security/encryption/default-encryption /security/encryption-in-transit/application-layer-transport-security /security/encryption-in-transit /security/incident-response /security/infrastructure/design /security/overview /security/overview/whitepaper /security/shielded-cloud /security/resources/security-features-of-connect-for-anthos ">Documentation home</a></li> <li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> The basics </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/overview" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/overview" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/overview" >Google Cloud overview</a></li><li class="devsite-nav-item"><a href="/docs/cloud-approach-to-change" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/cloud-approach-to-change" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/cloud-approach-to-change" >Google Cloud's approach to change</a></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Plan resource creation </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/get-started/resource-planning-overview" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/resource-planning-overview" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/resource-planning-overview" >Resource planning overview</a></li><li class="devsite-nav-item"><a href="/docs/get-started/consider-geographic-distribution" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/consider-geographic-distribution" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/consider-geographic-distribution" >Consider geographic distribution</a></li><li class="devsite-nav-item"><a href="/docs/get-started/create-ownership-hierarchy" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/create-ownership-hierarchy" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/create-ownership-hierarchy" >Create an ownership hierarchy</a></li><li class="devsite-nav-item"><a href="/docs/get-started/consider-resource-maintenance" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/consider-resource-maintenance" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/consider-resource-maintenance" >Consider maintenance</a></li></ul></div></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Google Cloud regions </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/geography-and-regions" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/geography-and-regions" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/geography-and-regions" >Geography and regions</a></li><li class="devsite-nav-item"><a href="/docs/dammam-region-access" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/dammam-region-access" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/dammam-region-access" >Dammam region access</a></li></ul></div></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Interact with Google Cloud </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/get-started/interact-with-resources" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/interact-with-resources" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/interact-with-resources" >Interaction overview</a></li><li class="devsite-nav-item"><a href="/docs/get-started/required-domains" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/required-domains" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/required-domains" >Required domains</a></li><li class="devsite-nav-item"><a href="/docs/accessibility" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/accessibility" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/accessibility" >Accessibility</a></li><li class="devsite-nav-item"><a href="/docs/shortcuts" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/shortcuts" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/shortcuts" >Keyboard shortcuts</a></li></ul></div></li><li class="devsite-nav-item"><a href="/billing/docs/concepts" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /billing/docs/concepts" track-type="bookNav" track-name="click" track-metadata-eventdetail="/billing/docs/concepts" >Learn about Cloud Billing</a></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Committed use discounts </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/cuds" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/cuds" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/cuds" >Overview</a></li><li class="devsite-nav-item"><a href="/docs/cuds-attribution" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/cuds-attribution" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/cuds-attribution" >Attribution of commitments</a></li><li class="devsite-nav-item"><a href="/docs/cuds-recommender" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/cuds-recommender" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/cuds-recommender" >Recommendations</a></li><li class="devsite-nav-item"><a href="/docs/cuds-spend-based" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/cuds-spend-based" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/cuds-spend-based" >Spend-based CUDs</a></li></ul></div></li><li class="devsite-nav-item"><a href="/free/docs/gcp-free-tier" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /free/docs/gcp-free-tier" track-type="bookNav" track-name="click" track-metadata-eventdetail="/free/docs/gcp-free-tier" >Google Cloud Free Program</a></li></ul></div></li> <li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Get started with Google Cloud </div><ul class="devsite-nav-section"><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Google Cloud setup </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/enterprise/setup-checklist" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/enterprise/setup-checklist" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/enterprise/setup-checklist" >Checklist</a></li><li class="devsite-nav-item"><a href="/docs/enterprise/deploy-foundation-using-terraform-from-console" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/enterprise/deploy-foundation-using-terraform-from-console" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/enterprise/deploy-foundation-using-terraform-from-console" >Deploy using Terraform</a></li><li class="devsite-nav-item"><a href="/docs/enterprise/manage-foundation" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/enterprise/manage-foundation" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/enterprise/manage-foundation" >Extend your setup</a></li></ul></div></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Developer tools and APIs </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/get-started/access-apis" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/access-apis" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/access-apis" >Set up API access</a></li><li class="devsite-nav-item"><a href="/docs/get-started/developer-tools" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/developer-tools" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/developer-tools" >Use developer tools</a></li></ul></div></li><li class="devsite-nav-item"><a href="/docs/get-started/aws-azure-gcp-service-comparison" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/get-started/aws-azure-gcp-service-comparison" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/get-started/aws-azure-gcp-service-comparison" >Compare AWS and Azure services to Google Cloud</a></li><li class="devsite-nav-item"><a href="/architecture/framework" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /architecture/framework" track-type="bookNav" track-name="click" track-metadata-eventdetail="/architecture/framework" >Architecture Framework</a></li></ul></div></li> <li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> General security guides </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/security" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security" >All general security guides</a></li><li class="devsite-nav-item"><a href="/docs/security/overview/whitepaper" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/overview/whitepaper" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/overview/whitepaper" >Security overview</a></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Infrastructure security </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/security/infrastructure/design" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/infrastructure/design" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/infrastructure/design" >Infrastructure security design overview</a></li><li class="devsite-nav-item"><a href="/docs/security/beyondprod" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/beyondprod" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/beyondprod" >BeyondProd</a></li><li class="devsite-nav-item"><a href="/docs/security/binary-authorization-for-borg" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/binary-authorization-for-borg" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/binary-authorization-for-borg" >Binary Authorization for Borg</a></li><li class="devsite-nav-item"><a href="/docs/security/boot-integrity" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/boot-integrity" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/boot-integrity" >Boot integrity</a></li><li class="devsite-nav-item"><a href="/docs/security/physical-to-logical-space" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/physical-to-logical-space" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/physical-to-logical-space" >Data center physical-to-logical space</a></li><li class="devsite-nav-item"><a href="/docs/security/remote-attestation" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/remote-attestation" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/remote-attestation" >Remote attestation</a></li><li class="devsite-nav-item"><a href="/docs/security/production-services-protection" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/production-services-protection" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/production-services-protection" >Production service protections</a></li><li class="devsite-nav-item"><a href="/docs/security/titanium-hardware-security-architecture" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/titanium-hardware-security-architecture" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/titanium-hardware-security-architecture" >Titanium hardware security architecture</a></li><li class="devsite-nav-item"><a href="/docs/security/titan-hardware-chip" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/titan-hardware-chip" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/titan-hardware-chip" >Titan hardware chip</a></li></ul></div></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Encryption in transit </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/security/encryption-in-transit" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/encryption-in-transit" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/encryption-in-transit" >Encryption in transit</a></li><li class="devsite-nav-item"><a href="/docs/security/encryption-in-transit/application-layer-transport-security" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/encryption-in-transit/application-layer-transport-security" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/encryption-in-transit/application-layer-transport-security" >Application layer transport security</a></li></ul></div></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Encryption at rest </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/security/encryption/default-encryption" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/encryption/default-encryption" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/encryption/default-encryption" >Default encryption at rest</a></li><li class="devsite-nav-item"><a href="/docs/security/key-management-deep-dive" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/key-management-deep-dive" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/key-management-deep-dive" >Cloud Key Management Service encryption</a></li><li class="devsite-nav-item"><a href="/docs/security/cloud-hsm-architecture" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/cloud-hsm-architecture" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/cloud-hsm-architecture" >Cloud HSM architecture</a></li><li class="devsite-nav-item"><a href="/docs/security/encryption/customer-supplied-encryption-keys" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/encryption/customer-supplied-encryption-keys" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/encryption/customer-supplied-encryption-keys" >Customer-supplied encryption keys</a></li><li class="devsite-nav-item"><a href="/docs/security/encryption/gcp-encryption-granularity" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/encryption/gcp-encryption-granularity" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/encryption/gcp-encryption-granularity" >Granularity of default encryption for Google Cloud services</a></li></ul></div></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Product-specific </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/security/confidential-space" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/confidential-space" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/confidential-space" >Confidential Space</a></li><li class="devsite-nav-item"><a href="/docs/security/implement-cdmc-framework" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/implement-cdmc-framework" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/implement-cdmc-framework" >CDMC framework in BigQuery</a></li></ul></div></li><li class="devsite-nav-item"><a href="/docs/security/data-loss-prevention/revoking-user-access" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/data-loss-prevention/revoking-user-access" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/data-loss-prevention/revoking-user-access" >Revoke access to Google Cloud</a></li><li class="devsite-nav-item"><a href="/docs/security/compromised-credentials" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/compromised-credentials" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/compromised-credentials" >Handle compromised credentials</a></li><li class="devsite-nav-item"><a href="/docs/security/respond-to-abuse-misuse" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/respond-to-abuse-misuse" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/respond-to-abuse-misuse" >Respond to abuse notifications</a></li><li class="devsite-nav-item"><a href="/docs/security/deletion" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/deletion" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/deletion" >Data deletion on Google Cloud</a></li><li class="devsite-nav-item"><a href="/docs/security/incident-response" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/security/incident-response" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/security/incident-response" >Data incident response process</a></li></ul></div></li> <li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Authentication </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/authentication" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication" >Authentication methods at Google</a></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Ways to authenticate </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/authentication/client-libraries" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/client-libraries" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/client-libraries" >Authenticate for using client libraries</a></li><li class="devsite-nav-item"><a href="/docs/authentication/gcloud" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/gcloud" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/gcloud" >Authenticate for using the gcloud CLI</a></li><li class="devsite-nav-item"><a href="/docs/authentication/rest" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/rest" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/rest" >Authenticate for using REST</a></li><li class="devsite-nav-item"><a href="/docs/authentication/use-service-account-impersonation" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/use-service-account-impersonation" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/use-service-account-impersonation" >Authenticate by using service account impersonation</a></li></ul></div></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Application Default Credentials </div><ul class="devsite-nav-section"><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> Set up Application Default Credentials </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/authentication/provide-credentials-adc" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/provide-credentials-adc" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/provide-credentials-adc" >Overview</a></li><li class="devsite-nav-item"><a href="/docs/authentication/set-up-adc-local-dev-environment" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/set-up-adc-local-dev-environment" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/set-up-adc-local-dev-environment" >Local development environment</a></li><li class="devsite-nav-item"><a href="/docs/authentication/set-up-adc-attached-service-account" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/set-up-adc-attached-service-account" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/set-up-adc-attached-service-account" >Resource with an attached service account</a></li><li class="devsite-nav-item"><a href="/docs/authentication/set-up-adc-containerized-environment" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/set-up-adc-containerized-environment" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/set-up-adc-containerized-environment" >Containerized environment</a></li><li class="devsite-nav-item"><a href="/docs/authentication/set-up-adc-on-premises" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/set-up-adc-on-premises" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/set-up-adc-on-premises" >On-premises or another cloud provider</a></li><li class="devsite-nav-item"><a href="/docs/authentication/set-up-adc-cloud-dev-environment" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/set-up-adc-cloud-dev-environment" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/set-up-adc-cloud-dev-environment" >Cloud-based development environment</a></li></ul></div></li><li class="devsite-nav-item"><a href="/docs/authentication/application-default-credentials" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/application-default-credentials" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/application-default-credentials" >How Application Default Credentials works</a></li><li class="devsite-nav-item"><a href="/docs/authentication/troubleshoot-adc" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/troubleshoot-adc" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/troubleshoot-adc" >Troubleshoot your ADC setup</a></li></ul></div></li><li class="devsite-nav-item devsite-nav-expandable"><div class="devsite-expandable-nav"> <a class="devsite-nav-toggle" aria-hidden="true"></a><div class="devsite-nav-title devsite-nav-title-no-path" tabindex="0" role="button"> API keys </div><ul class="devsite-nav-section"><li class="devsite-nav-item"><a href="/docs/authentication/api-keys-use" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/api-keys-use" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/api-keys-use" >Use API keys to access APIs</a></li><li class="devsite-nav-item"><a href="/docs/authentication/api-keys" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/api-keys" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/api-keys" >Manage API keys</a></li><li class="devsite-nav-item"><a href="/docs/authentication/api-keys-best-practices" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/api-keys-best-practices" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/api-keys-best-practices" >Best practices for managing API keys</a></li></ul></div></li><li class="devsite-nav-item"><a href="/docs/authentication/get-id-token" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/get-id-token" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/get-id-token" >Get an ID token</a></li><li class="devsite-nav-item"><a href="/docs/authentication/token-types" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/token-types" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/token-types" >Token types</a></li><li class="devsite-nav-item"><a href="/docs/authentication/mfa-requirement" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/mfa-requirement" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/mfa-requirement" >Multi-factor authentication requirement</a></li><li class="devsite-nav-item"><a href="/docs/authentication/use-cases" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/use-cases" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/use-cases" >Authentication use cases</a></li><li class="devsite-nav-item"><a href="/docs/authentication/identity-products" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /docs/authentication/identity-products" track-type="bookNav" track-name="click" track-metadata-eventdetail="/docs/authentication/identity-products" >Identity management products</a></li></ul></div></li> <li class="devsite-nav-item"><a href="/support/docs" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /support/docs" track-type="bookNav" track-name="click" track-metadata-eventdetail="/support/docs" >Getting support</a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> Release notes </div></li> <li class="devsite-nav-item"><a href="/release-notes" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /release-notes" track-type="bookNav" track-name="click" track-metadata-eventdetail="/release-notes" >Recent product changes</a></li> <li class="devsite-nav-item"><a href="/release-notes/all" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /release-notes/all" track-type="bookNav" track-name="click" track-metadata-eventdetail="/release-notes/all" >Index of release notes</a></li> <li class="devsite-nav-item"><a href="https://console.cloud.google.com/bigquery?p=bigquery-public-data&d=google_cloud_release_notes&t=release_notes&page=table" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://console.cloud.google.com/bigquery?p=bigquery-public-data&d=google_cloud_release_notes&t=release_notes&page=table" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://console.cloud.google.com/bigquery?p=bigquery-public-data&d=google_cloud_release_notes&t=release_notes&page=table" >BigQuery dataset of release notes</a></li> </ul> <ul class="devsite-nav-list" menu="Technology areas" aria-label="Side menu" hidden> <li class="devsite-nav-item"> <a href="/docs/ai-ml" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: AI and ML" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> AI and ML </a> </li> <li class="devsite-nav-item"> <a href="/docs/application-development" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Application development" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Application development </a> </li> <li class="devsite-nav-item"> <a href="/docs/application-hosting" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Application hosting" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Application hosting </a> </li> <li class="devsite-nav-item"> <a href="/docs/compute-area" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Compute" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Compute </a> </li> <li class="devsite-nav-item"> <a href="/docs/data" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Data analytics and pipelines" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Data analytics and pipelines </a> </li> <li class="devsite-nav-item"> <a href="/docs/databases" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Databases" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Databases </a> </li> <li class="devsite-nav-item"> <a href="/docs/dhm-cloud" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Distributed, hybrid, and multicloud" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Distributed, hybrid, and multicloud </a> </li> <li class="devsite-nav-item"> <a href="/docs/generative-ai" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Generative AI" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Generative AI </a> </li> <li class="devsite-nav-item"> <a href="/docs/industry" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Industry solutions" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Industry solutions </a> </li> <li class="devsite-nav-item"> <a href="/docs/networking" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Networking" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Networking </a> </li> <li class="devsite-nav-item"> <a href="/docs/observability" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Observability and monitoring" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Observability and monitoring </a> </li> <li class="devsite-nav-item"> <a href="/docs/security" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Security" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Security </a> </li> <li class="devsite-nav-item"> <a href="/docs/storage" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Storage" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Storage </a> </li> </ul> <ul class="devsite-nav-list" menu="Cross-product tools" aria-label="Side menu" hidden> <li class="devsite-nav-item"> <a href="/docs/access-resources" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Access and resources management" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Access and resources management </a> </li> <li class="devsite-nav-item"> <a href="/docs/costs-usage" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Costs and usage management" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Costs and usage management </a> </li> <li class="devsite-nav-item"> <a href="/docs/devtools" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud SDK, languages, frameworks, and tools" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud SDK, languages, frameworks, and tools </a> </li> <li class="devsite-nav-item"> <a href="/docs/iac" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Infrastructure as code" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Infrastructure as code </a> </li> <li class="devsite-nav-item"> <a href="/docs/migration" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Migration" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Migration </a> </li> </ul> <ul class="devsite-nav-list" menu="Related sites" aria-label="Side menu" hidden> <li class="devsite-nav-item"> <a href="/" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud Home" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud Home </a> </li> <li class="devsite-nav-item"> <a href="/free" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Free Trial and Free Tier" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Free Trial and Free Tier </a> </li> <li class="devsite-nav-item"> <a href="/architecture" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Architecture Center" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Architecture Center </a> </li> <li class="devsite-nav-item"> <a href="https://cloud.google.com/blog" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Blog" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Blog </a> </li> <li class="devsite-nav-item"> <a href="/contact" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Contact Sales" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Contact Sales </a> </li> <li class="devsite-nav-item"> <a href="/developers" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud Developer Center" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud Developer Center </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Developer Center" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Developer Center </a> </li> <li class="devsite-nav-item"> <a href="https://console.cloud.google.com/marketplace" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud Marketplace" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud Marketplace </a> </li> <li class="devsite-nav-item"> <a href="/marketplace/docs" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud Marketplace Documentation" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud Marketplace Documentation </a> </li> <li class="devsite-nav-item"> <a href="https://www.cloudskillsboost.google/paths" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud Skills Boost" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud Skills Boost </a> </li> <li class="devsite-nav-item"> <a href="/solutions" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud Solution Center" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud Solution Center </a> </li> <li class="devsite-nav-item"> <a href="/support-hub" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud Support" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud Support </a> </li> <li class="devsite-nav-item"> <a href="https://www.youtube.com/@googlecloudtech" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Cloud Tech Youtube Channel" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Cloud Tech Youtube Channel </a> </li> </ul> </div> </div> </nav> </devsite-book-nav> <section id="gc-wrapper"> <main role="main" id="main-content" class="devsite-main-content" has-book-nav has-sidebar > <div class="devsite-sidebar"> <div class="devsite-sidebar-content"> <devsite-toc class="devsite-nav" role="navigation" aria-label="On this page" depth="2" scrollbars ></devsite-toc> <devsite-recommendations-sidebar class="nocontent devsite-nav"> </devsite-recommendations-sidebar> </div> </div> <devsite-content> <article class="devsite-article"> <div class="devsite-article-meta nocontent" role="navigation"> <ul class="devsite-breadcrumb-list" aria-label="Breadcrumb"> <li class="devsite-breadcrumb-item "> <a href="https://cloud.google.com/" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="" > Home </a> </li> <li class="devsite-breadcrumb-item "> <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div> <a href="https://cloud.google.com/docs" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="2" track-type="globalNav" track-name="breadcrumb" track-metadata-position="2" track-metadata-eventdetail="Documentation" > Documentation </a> </li> <li class="devsite-breadcrumb-item "> <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div> <a href="https://cloud.google.com/docs/authentication" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="3" track-type="globalNav" track-name="breadcrumb" track-metadata-position="3" track-metadata-eventdetail="Authentication" > Authentication </a> </li> </ul> <devsite-thumb-rating position="header"> </devsite-thumb-rating> </div> <devsite-feedback position="header" project-name="Authentication" product-id="5152837" bucket="Auth Docs" context="" version="t-devsite-webserver-20250220-r00-rc00.467186154483790716" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="header" class="nocontent" project-icon="https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/favicons/onecloud/super_cloud.png" > <button> Send feedback </button> </devsite-feedback> <h1 class="devsite-page-title" tabindex="-1"> Manage API keys </h1> <devsite-feature-tooltip ack-key="AckCollectionsBookmarkTooltipDismiss" analytics-category="Site-Wide Custom Events" analytics-action-show="Callout Profile displayed" analytics-action-close="Callout Profile dismissed" analytics-label="Create Collection Callout" class="devsite-page-bookmark-tooltip nocontent" dismiss-button="true" id="devsite-collections-dropdown" dismiss-button-text="Dismiss" close-button-text="Got it"> <devsite-bookmark></devsite-bookmark> Stay organized with collections Save and categorize content based on your preferences. </devsite-feature-tooltip> <div class="devsite-page-title-meta"><devsite-view-release-notes></devsite-view-release-notes></div> <devsite-toc class="devsite-nav" depth="2" devsite-toc-embedded > </devsite-toc> <div class="devsite-article-body clearfix "> This page describes how to create, edit, and restrict API keys. For information about how to use API keys to access Google APIs, see <a href="/docs/authentication/api-keys-use">Use API keys to access APIs</a>. <h2 id="introduction" data-text="Introduction to API keys" tabindex="-1">Introduction to API keys</h2> There are two types of API keys: standard API keys and API keys that are bound to a service account. This document describes standard API keys. For information about API keys that are bound to a service account, see the <a href="https://cloud.google.com/resources/cloud-express-faqs">Google Cloud express mode FAQ</a>. <h3 id="standard-api-keys" data-text="API keys" tabindex="-1">API keys</h3> Standard API keys provide a way to associate a request with a project for billing and quota purposes. When you use a standard API key to access an API, the API key doesn't identify a <a href="/docs/authentication#principal">principal</a>. Without a principal, the request can't use Identity and Access Management (IAM) to check whether the caller is authorized to perform the requested operation. Standard API keys can be used with any API that accepts API keys, unless API restrictions have been added to the key. Standard API keys can't be used with services that don't accept API keys. <h3 id="components" data-text="API key components" tabindex="-1">API key components</h3> An API key has the following components, which let you manage and use the key: <dl> <dt>String</dt> <dd>The API key string is an encrypted string, for example, <code translate="no" dir="ltr">AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe</code>. When you use an API key to access an API, you always use the key's string. API keys don't have an associated JSON file.</dd> <dt>ID</dt> <dd>The API key ID is used by Google Cloud administrative tools to uniquely identify the key. The key ID can't be used to access APIs. The key ID can be found in the URL of the key's edit page in the Google Cloud console. You can also get the key ID by using the Google Cloud CLI to list the keys in your project.</dd> <dt>Display name</dt> <dd>The display name is an optional, descriptive name for the key, which you can set when you create or update the key.</dd> <dt>Bound service account</dt> <dd>API keys that are bound to a service account include the service account's email address. For more information, see the <a href="https://cloud.google.com/resources/cloud-express-faqs">Google Cloud express mode FAQ</a>.</dd> </dl> <h2 id="before_you_begin" data-text="Before you begin" tabindex="-1">Before you begin</h2> Complete the following tasks to use the samples on this page. <h3 id="set_up_authentication" data-text="Set up authentication" tabindex="-1">Set up authentication</h3> Select the tab for how you plan to use the samples on this page: <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section> <h3 id="console" data-text="Console" tabindex="-1">Console</h3> When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication. </section> <section> <h3 id="gcloud" data-text="gcloud" tabindex="-1">gcloud</h3> In the Google Cloud console, activate Cloud Shell. <a href="https://console.cloud.google.com/?cloudshell=true" target="console" track-type="commonIncludes" track-name="consoleLink" track-metadata-end-goal="launchCloudShell" class="button button-primary">Activate Cloud Shell</a> At the bottom of the Google Cloud console, a <a href="/shell/docs/how-cloud-shell-works">Cloud Shell</a> session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize. </section> <section> <h3 id="c++" data-text="C++" tabindex="-1">C++</h3> To use the C++ samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. <ol> <li> <a href="/sdk/docs/install" track-type="commonIncludes" track-name="sdkLink" target="_blank">Install</a> the Google Cloud CLI. </li> <li> To <a href="/sdk/docs/initializing" track-type="commonIncludes" track-name="sdkLink" target="_blank">initialize</a> the gcloud CLI, run the following command: <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud init</pre></devsite-code> </li> <li> If you're using a local shell, then create local authentication credentials for your user account: <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud auth application-default login</pre></devsite-code> You don't need to do this if you're using Cloud Shell. </li> </ol> For more information, see <a href="/docs/authentication/set-up-adc-local-dev-environment"> Set up ADC for a local development environment</a> in the Google Cloud authentication documentation. </section> <section> <h3 id="java" data-text="Java" tabindex="-1">Java</h3> To use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. <ol> <li> <a href="/sdk/docs/install" track-type="commonIncludes" track-name="sdkLink" target="_blank">Install</a> the Google Cloud CLI. </li> <li> To <a href="/sdk/docs/initializing" track-type="commonIncludes" track-name="sdkLink" target="_blank">initialize</a> the gcloud CLI, run the following command: <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud init</pre></devsite-code> </li> <li> If you're using a local shell, then create local authentication credentials for your user account: <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud auth application-default login</pre></devsite-code> You don't need to do this if you're using Cloud Shell. </li> </ol> For more information, see <a href="/docs/authentication/set-up-adc-local-dev-environment"> Set up ADC for a local development environment</a> in the Google Cloud authentication documentation. </section> <section> <h3 id="python" data-text="Python" tabindex="-1">Python</h3> To use the Python samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. <ol> <li> <a href="/sdk/docs/install" track-type="commonIncludes" track-name="sdkLink" target="_blank">Install</a> the Google Cloud CLI. </li> <li> To <a href="/sdk/docs/initializing" track-type="commonIncludes" track-name="sdkLink" target="_blank">initialize</a> the gcloud CLI, run the following command: <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud init</pre></devsite-code> </li> <li> If you're using a local shell, then create local authentication credentials for your user account: <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud auth application-default login</pre></devsite-code> You don't need to do this if you're using Cloud Shell. </li> </ol> For more information, see <a href="/docs/authentication/set-up-adc-local-dev-environment"> Set up ADC for a local development environment</a> in the Google Cloud authentication documentation. </section> <section> <h3 id="rest" data-text="REST" tabindex="-1">REST</h3> To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI. <ol> <a href="/sdk/docs/install" track-type="commonIncludes" track-name="sdkLink" target="_blank">Install</a> the Google Cloud CLI, then <a href="/sdk/docs/initializing" track-type="commonIncludes" track-name="sdkLink" target="_blank">initialize</a> it by running the following command: <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud init</pre></devsite-code> </ol> For more information, see <a href="/docs/authentication/rest">Authenticate for using REST</a> in the Google Cloud authentication documentation. </section> </div> <h3 id="required_roles" data-text="Required roles" tabindex="-1">Required roles</h3> To get the permissions that you need to manage API keys, ask your administrator to grant you the following IAM roles on your project: <ul> <li> <a href="https://cloud.google.com/iam/docs/understanding-roles#serviceusage.apiKeysAdmin">API Keys Admin </a> (<code translate="no" dir="ltr">roles/serviceusage.apiKeysAdmin</code>)</li> <li> Restrict an API key to specific APIs by using the Google Cloud console: <a href="https://cloud.google.com/iam/docs/understanding-roles#serviceusage.serviceUsageViewer">Service Usage Viewer </a> (<code translate="no" dir="ltr">roles/serviceusage.serviceUsageViewer</code>) </li> </ul> For more information about granting roles, see <a href="/iam/docs/granting-changing-revoking-access">Manage access to projects, folders, and organizations</a>. You might also be able to get the required permissions through <a href="/iam/docs/creating-custom-roles">custom roles</a> or other <a href="/iam/docs/understanding-roles">predefined roles</a>. <a id="creating_an_api_key"></a> <h2 id="create" data-text="Create an API key" tabindex="-1">Create an API key</h2> To create an API key, use one of the following options: <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section><h3 id="console" data-text=" Console " tabindex="-1"> Console </h3><ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click Create credentials, then select API key from the menu. The API key created dialog displays the string for your newly created key.</li> </ol></section> <section><h3 id="gcloud" data-text=" gcloud " tabindex="-1"> gcloud </h3>You use the <a href="/sdk/gcloud/reference/services/api-keys/create"><code translate="no" dir="ltr">gcloud services api-keys create</code> command</a> to create an API key. Replace <code translate="no" dir="ltr"><var translate="no">DISPLAY_NAME</var></code> with a descriptive name for your key. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash"> gcloud services api-keys create --display-name=<var translate="no">DISPLAY_NAME</var> </pre></devsite-code></section> <section><h3 id="c++" data-text=" C++ " tabindex="-1"> C++ </h3>To run this sample, you must install the <a href="/cpp/docs/reference/apikeys/latest">API Keys client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="googleapis/google-cloud-cpp/examples/api_key.cc/HEAD/apikeys_create_api_key" data-code-snippet="true" data-github-includecode-link="https://github.com/googleapis/google-cloud-cpp/blob/HEAD/examples/api_key.cc" feedback-context="{"language": "cpp", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/googleapis/google-cloud-cpp/blob/HEAD/examples/api_key.cc"}" feedback-product="1634365" feedback-bucket="security" language="cpp" data-github-path="googleapis/google-cloud-cpp/examples/api_key.cc" data-git-revision="HEAD" data-region-tag="apikeys_create_api_key" dir="ltr" is-upgraded syntax="C++"><code translate="no" dir="ltr">#include "google/cloud/apikeys/v2/api_keys_client.h" #include "google/cloud/location.h" google::api::apikeys::v2::Key CreateApiKey( google::cloud::apikeys_v2::ApiKeysClient client, google::cloud::Location location, std::string display_name) { google::api::apikeys::v2::CreateKeyRequest request; request.set_parent(location.FullName()); request.mutable_key()->set_display_name(std::move(display_name)); // As an example, restrict the API key's scope to the Natural Language API. request.mutable_key()->mutable_restrictions()->add_api_targets()->set_service( "language.googleapis.com"); // Create the key, blocking on the result. auto key = client.CreateKey(request).get(); if (!key) throw std::move(key.status()); std::cout << "Successfully created an API key: " << key->name() << "\n"; // For authenticating with the API key, use the value in `key->key_string()`. // The API key's resource name is the value in `key->name()`. Use this to // refer to the specific key in a `GetKey()` or `DeleteKey()` RPC. return *key; }</code></pre></devsite-code> </div> </section> <section><h3 id="java" data-text=" Java " tabindex="-1"> Java </h3>To run this sample, you must install the <a href="/java/docs/reference/google-cloud-apikeys/latest/overview"><code translate="no" dir="ltr">google-cloud-apikeys</code> client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/CreateApiKey.java/HEAD/apikeys_create_api_key" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/CreateApiKey.java" feedback-context="{"language": "java", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/CreateApiKey.java"}" feedback-product="1634365" feedback-bucket="security" language="java" data-github-path="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/CreateApiKey.java" data-git-revision="HEAD" data-region-tag="apikeys_create_api_key" dir="ltr" is-upgraded syntax="Java"><code translate="no" dir="ltr"> import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.ApiTarget; import com.google.api.apikeys.v2.CreateKeyRequest; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.LocationName; import com.google.api.apikeys.v2.Restrictions; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class CreateApiKey { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. // 2. Set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc // 3. Make sure you have the necessary permission to create API keys. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; createApiKey(projectId); } // Creates an API key. public static void createApiKey(String projectId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { Key key = Key.newBuilder() .setDisplayName("My first API key") // Set the API key restriction. // You can also set browser/ server/ android/ ios based restrictions. // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions .setRestrictions(Restrictions.newBuilder() // Restrict the API key usage by specifying the target service and methods. // The API key can only be used to authenticate the specified methods in the service. .addApiTargets(ApiTarget.newBuilder() .setService("translate.googleapis.com") .addMethods("translate.googleapis.com.TranslateText") .build()) .build()) .build(); // Initialize request and set arguments. CreateKeyRequest createKeyRequest = CreateKeyRequest.newBuilder() // API keys can only be global. .setParent(LocationName.of(projectId, "global").toString()) .setKey(key) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.createKeyAsync(createKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". // To restrict the usage of this API key, use the value in "result.getName()". System.out.printf("Successfully created an API key: %s", result.getName()); } } }</code></pre></devsite-code> </div> </section> <section><h3 id="python" data-text=" Python " tabindex="-1"> Python </h3>To run this sample, you must install the <a href="/python/docs/reference/apikeys/latest">API Keys client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/python-docs-samples/auth/api-client/create_api_key.py/HEAD/apikeys_create_api_key" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/create_api_key.py" feedback-context="{"language": "python", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/create_api_key.py"}" feedback-product="1634365" feedback-bucket="security" language="python" data-github-path="GoogleCloudPlatform/python-docs-samples/auth/api-client/create_api_key.py" data-git-revision="HEAD" data-region-tag="apikeys_create_api_key" dir="ltr" is-upgraded syntax="Python"><code translate="no" dir="ltr"> from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def create_api_key(project_id: str, suffix: str) -> Key: """ Creates and restrict an API key. Add the suffix for uniqueness. TODO(Developer): 1. Before running this sample, set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc 2. Make sure you have the necessary permission to create API keys. Args: project_id: Google Cloud project id. Returns: response: Returns the created API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() key = api_keys_v2.Key() key.display_name = f"My first API key - {suffix}" # Initialize request and set arguments. request = api_keys_v2.CreateKeyRequest() request.parent = f"projects/{project_id}/locations/global" request.key = key # Make the request and wait for the operation to complete. response = client.create_key(request=request).result() print(f"Successfully created an API key: {response.name}") # For authenticating with the API key, use the value in "response.key_string". # To restrict the usage of this API key, use the value in "response.name". return response </code></pre></devsite-code> </div> </section> <section><h3 id="rest" data-text=" REST " tabindex="-1"> REST </h3>You use the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/create"><code translate="no" dir="ltr">keys.create</code> method</a> to create an API key. This request returns a <a href="#lro">long-running operation</a>; you must poll the operation to get the information for the new key. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">DISPLAY_NAME</var></code>: Optional. A descriptive name for your key.</li> <li><code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code>: Your Google Cloud project ID or name.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "<var translate="no">DISPLAY_NAME</var>"'} \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT</var>/locations/global/keys"</pre></devsite-code> For more information about creating API keys using the REST API, see <a href="/api-keys/docs/create-manage-api-keys#create">Creating an API key</a> in the API Keys API documentation.</section> </div><aside class="special">Important: Copy your key string and keep it secure. Use API key restrictions to limit how the key can be used.</aside> <a id="securing"></a> <h2 id="api_key_restrictions" data-text="Apply API key restrictions" tabindex="-1">Apply API key restrictions</h2> API keys are unrestricted by default. Unrestricted keys are insecure because they can be used by anyone from anywhere. For production applications, you should set both <a href="#adding-application-restrictions">application restrictions</a> and <a href="#adding-api-restrictions">API restrictions</a>. <a id="adding_application_restrictions"></a> <h3 id="adding-application-restrictions" data-text="Add application restrictions" tabindex="-1">Add application restrictions</h3> Application restrictions specify which websites, IP addresses, or apps can use an API key. You can apply only one application restriction type at a time. Choose the restriction type based on your application type: <table> <thead> <tr> <th>Option</th> <th>Application type</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td><a href="#http">HTTP referrers</a></td> <td>Web applications</td> <td>Specifies the websites that can use the key.</td> </tr> <tr> <td><a href="#ip">IP Addresses</a></td> <td>Applications called by specific servers</td> <td>Specifies the servers or cron jobs that can use the key.</td> </tr> <tr> <td><a href="#android">Android apps</a></td> <td>Android applications</td> <td>Specifies the Android application that can use the key.</td> </tr> <tr> <td><a href="#ios">iOS apps</a></td> <td>iOS applications</td> <td>Specifies the iOS bundles that can use the key.</td> </tr> </tbody> </table> <a id="adding_http_restrictions"></a> <h4 id="http" data-text="HTTP referrers" tabindex="-1">HTTP referrers</h4> To restrict the websites that can use your API key, you add one or more HTTP referrer restrictions. You can substitute a wildcard character (<code translate="no" dir="ltr">*</code>) for the subdomain or the path, but you can't insert a wildcard character into the middle of the URL. For example, <code translate="no" dir="ltr">*.example.com</code> is valid, and accepts all sites ending in <code translate="no" dir="ltr">.example.com</code>. However, <code translate="no" dir="ltr">mysubdomain*.example.com</code> is not a valid restriction. Port numbers can be included in HTTP referrer restrictions. If you include a port number, then only requests using that port are matched. If you don't specify a port number, then requests from any port number are matched. The following table shows some example scenarios and browser restrictions: <table> <thead> <tr> <th>Scenario</th> <th>Restrictions</th> </tr> </thead> <tbody> <tr> <td>Allow a specific URL</td> <td>Add a URL with an exact path. For example: <code translate="no" dir="ltr">www.example.com/path</code> <code translate="no" dir="ltr">www.example.com/path/path</code> Some browsers implement a <a href="https://developer.chrome.com/blog/referrer-policy-new-chrome-default/"> referrer policy</a> that sends only the origin URL for cross-origin requests. Users of these browsers can't use keys with page-specific URL restrictions. </td> </tr> <tr> <td>Allow any URL in your site</td> <td>You must set two URLs in the <code translate="no" dir="ltr">allowedReferers</code> list. <ol> <li> URL for the domain, without a subdomain, and with a wildcard for the path. For example: <code translate="no" dir="ltr">example.com/*</code> </li> <li> A second URL that includes a wildcard for the subdomain and a wildcard for the path. For example: <code translate="no" dir="ltr">*.example.com/*</code> </li> </ol> </td> </tr> <tr> <td>Allow any URL in a single subdomain or naked domain</td> <td> You must set two URLs in the <code translate="no" dir="ltr">allowedReferers</code> list to allow an entire domain: <ol> <li> URL for the domain, without a trailing slash. For example: <code translate="no" dir="ltr">www.example.com</code> <code translate="no" dir="ltr">sub.example.com</code> <code translate="no" dir="ltr">example.com</code> </li> <li> A second URL for the domain that includes a wildcard for the path. For example: <code translate="no" dir="ltr">www.example.com/*</code> <code translate="no" dir="ltr">sub.example.com/*</code> <code translate="no" dir="ltr">example.com/*</code> </li> </ol> </td> </tr> </tbody> </table> To restrict your API key to specific websites, use one of the following options: <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section><h3 id="console_1" data-text=" Console " tabindex="-1"> Console </h3><ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click the name of the API key that you want to restrict.</li> <li>In the Application restrictions section, select HTTP referrers.</li> <li>For each restriction that you want to add, click Add an item, enter the restriction, and click Done.</li> <li>Click Save to save your changes and return to the API key list.</li> </ol></section> <section><h3 id="gcloud_1" data-text=" gcloud " tabindex="-1"> gcloud </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/sdk/gcloud/reference/services/api-keys/list"><code translate="no" dir="ltr">gcloud services api-keys list</code> command</a> to list the keys in your project.</li> <li>Use the <a href="/sdk/gcloud/reference/services/api-keys/update"><code translate="no" dir="ltr">gcloud services api-keys update</code> command</a> to add HTTP referrer restrictions to an API key. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> <li><code translate="no" dir="ltr"><var translate="no">ALLOWED_REFERRER_1</var></code>: Your HTTP referrer restriction. You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the update command; the referrer restrictions provided replace any existing referrer restrictions on the key.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud services api-keys update <var translate="no">KEY_ID</var> \ --allowed-referrers="<var translate="no">ALLOWED_REFERRER_1</var>"</pre></devsite-code></li> </ol></section> <section><h3 id="java_1" data-text=" Java " tabindex="-1"> Java </h3>To run this sample, you must install the <a href="/java/docs/reference/google-cloud-apikeys/latest/overview"><code translate="no" dir="ltr">google-cloud-apikeys</code> client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyHttp.java/HEAD/apikeys_restrict_api_key_http" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyHttp.java" feedback-context="{"language": "java", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyHttp.java"}" feedback-product="1634365" feedback-bucket="security" language="java" data-github-path="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyHttp.java" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_http" dir="ltr" is-upgraded syntax="Java"><code translate="no" dir="ltr"> import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.BrowserKeyRestrictions; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyHttp { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyHttp(projectId, keyId); } // Restricts an API key. To restrict the websites that can use your API key, // you add one or more HTTP referrer restrictions. public static void restrictApiKeyHttp(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage to specific websites by adding them // to the list of allowed_referrers. Restrictions restrictions = Restrictions.newBuilder() .setBrowserKeyRestrictions(BrowserKeyRestrictions.newBuilder() .addAllowedReferrers("www.example.com/*") .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } }</code></pre></devsite-code> </div> </section> <section><h3 id="python_1" data-text=" Python " tabindex="-1"> Python </h3>To run this sample, you must install the <a href="/python/docs/reference/apikeys/latest">API Keys client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_http.py/HEAD/apikeys_restrict_api_key_http" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_http.py" feedback-context="{"language": "python", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_http.py"}" feedback-product="1634365" feedback-bucket="security" language="python" data-github-path="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_http.py" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_http" dir="ltr" is-upgraded syntax="Python"><code translate="no" dir="ltr"> from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_http(project_id: str, key_id: str) -> Key: """ Restricts an API key. To restrict the websites that can use your API key, you add one or more HTTP referrer restrictions. TODO(Developer): Replace the variables before running this sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Restrict the API key usage to specific websites by adding them to the list of allowed_referrers. browser_key_restrictions = api_keys_v2.BrowserKeyRestrictions() browser_key_restrictions.allowed_referrers = ["www.example.com/*"] # Set the API restriction. # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.browser_key_restrictions = browser_key_restrictions key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response </code></pre></devsite-code> </div> </section> <section><h3 id="rest_1" data-text=" REST " tabindex="-1"> REST </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/list">keys.list</a> method. The ID is listed in the <code translate="no" dir="ltr">uid</code> field of the response. Replace <code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code> with your Google Cloud project ID or name. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/"</pre></devsite-code></li> <li>Use the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/patch">keys.patch</a> method to add HTTP referrer restrictions to the API key. This request returns a <a href="#lro">long-running operation</a>; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">ALLOWED_REFERRER_1</var></code>: Your HTTP referrer restriction. You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the request; the referrer restrictions provided replace any existing referrer restrictions on the key.</li> <li><code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code>: Your Google Cloud project ID or name.</li> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "browserKeyRestrictions": { "allowedReferrers": ["<var translate="no">ALLOWED_REFERRER_1</var>"] } } }' \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/<var translate="no">KEY_ID</var>?updateMask=restrictions"</pre></devsite-code></li> </ol> For more information about adding HTTP referrer restrictions to a key using the REST API, see <a href="/api-keys/docs/add-restrictions-api-keys#adding_browser_restrictions">Adding browser restrictions</a> in the API Keys API documentation.</section> </div> <h4 id="ip" data-text="IP Addresses" tabindex="-1">IP Addresses</h4> You can specify one or more IP addresses of the callers, such as a web server or cron job, that are allowed to use your API key. You can specify the IP addresses in any of the following formats: <ul> <li>IPv4 (<code translate="no" dir="ltr">198.51.100.1</code>)</li> <li>IPv6 (<code translate="no" dir="ltr">2001:db8::1</code>)</li> <li>A subnet using CIDR notation (<code translate="no" dir="ltr">198.51.100.0/24</code>, <code translate="no" dir="ltr">2001:db8::/64</code>)</li> </ul> Using <code translate="no" dir="ltr">localhost</code> is not supported for server restrictions. To restrict your API key to specific IP addresses, use one of the following options: <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section><h3 id="console_2" data-text=" Console " tabindex="-1"> Console </h3><ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click the name of the API key that you want to restrict.</li> <li>In the Application restrictions section, select IP addresses.</li> <li>For each IP address that you want to add, click Add an item, enter the address, and click Done.</li> <li>Click Save to save your changes and return to the API key list.</li> </ol></section> <section><h3 id="gcloud_2" data-text=" gcloud " tabindex="-1"> gcloud </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/sdk/gcloud/reference/services/api-keys/list"><code translate="no" dir="ltr">gcloud services api-keys list</code> command</a> to list the keys in your project.</li> <li>Use the <a href="/sdk/gcloud/reference/services/api-keys/update"><code translate="no" dir="ltr">gcloud services api-keys update</code> command</a> to add server (IP address) restrictions to an API key. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> <li><code translate="no" dir="ltr"><var translate="no">ALLOWED_IP_ADDR_1</var></code>: Your allowed IP address. You can add as many IP addresses as needed; use commas to separate the addresses.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud services api-keys update <var translate="no">KEY_ID</var> \ --allowed-ips="<var translate="no">ALLOWED_IP_ADDR_1</var>"</pre></devsite-code></li> </ol></section> <section><h3 id="java_2" data-text=" Java " tabindex="-1"> Java </h3>To run this sample, you must install the <a href="/java/docs/reference/google-cloud-apikeys/latest/overview"><code translate="no" dir="ltr">google-cloud-apikeys</code> client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyServer.java/HEAD/apikeys_restrict_api_key_server" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyServer.java" feedback-context="{"language": "java", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyServer.java"}" feedback-product="1634365" feedback-bucket="security" language="java" data-github-path="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyServer.java" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_server" dir="ltr" is-upgraded syntax="Java"><code translate="no" dir="ltr"> import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.ServerKeyRestrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.Arrays; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyServer { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyServer(projectId, keyId); } // Restricts the API key based on IP addresses. You can specify one or more IP addresses // of the callers, for example web servers or cron jobs, that are allowed to use your API key. public static void restrictApiKeyServer(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage by specifying the IP addresses. // You can specify the IP addresses in IPv4 or IPv6 or a subnet using CIDR notation. Restrictions restrictions = Restrictions.newBuilder() .setServerKeyRestrictions(ServerKeyRestrictions.newBuilder() .addAllAllowedIps(Arrays.asList("198.51.100.0/24", "2000:db8::/64")) .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } }</code></pre></devsite-code> </div> </section> <section><h3 id="python_2" data-text=" Python " tabindex="-1"> Python </h3>To run this sample, you must install the <a href="/python/docs/reference/apikeys/latest">API Keys client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_server.py/HEAD/apikeys_restrict_api_key_server" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_server.py" feedback-context="{"language": "python", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_server.py"}" feedback-product="1634365" feedback-bucket="security" language="python" data-github-path="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_server.py" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_server" dir="ltr" is-upgraded syntax="Python"><code translate="no" dir="ltr"> from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_server(project_id: str, key_id: str) -> Key: """ Restricts the API key based on IP addresses. You can specify one or more IP addresses of the callers, for example web servers or cron jobs, that are allowed to use your API key. TODO(Developer): Replace the variables before running this sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Restrict the API key usage by specifying the IP addresses. # You can specify the IP addresses in IPv4 or IPv6 or a subnet using CIDR notation. server_key_restrictions = api_keys_v2.ServerKeyRestrictions() server_key_restrictions.allowed_ips = ["198.51.100.0/24", "2000:db8::/64"] # Set the API restriction. # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.server_key_restrictions = server_key_restrictions key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response </code></pre></devsite-code> </div> </section> <section><h3 id="rest_2" data-text=" REST " tabindex="-1"> REST </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/list">keys.list</a> method. The ID is listed in the <code translate="no" dir="ltr">uid</code> field of the response. Replace <code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code> with your Google Cloud project ID or name. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/"</pre></devsite-code></li> <li>Use the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/patch">keys.patch</a> method to add server (IP address) restrictions to an API key. This request returns a <a href="#lro">long-running operation</a>; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">ALLOWED_IP_ADDR_1</var></code>: Your allowed IP address. You can add as many IP addresses as needed; use commas to separate the restrictions. You must provide all IP addresses with the request; the referrer restrictions provided replace any existing IP address restrictions on the key.</li> <li><code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code>: Your Google Cloud project ID or name.</li> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": ["<var translate="no">ALLOWED_IP_ADDR_1</var>"] } } }' \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/<var translate="no">KEY_ID</var>?updateMask=restrictions"</pre></devsite-code></li> </ol> For more information about adding IP address restrictions to a key using the REST API, see <a href="/api-keys/docs/add-restrictions-api-keys#adding_server_restrictions">Adding server restrictions</a> in the API Keys API documentation.</section> </div> <h4 id="android" data-text="Android apps" tabindex="-1">Android apps</h4> You can restrict usage of an API key to specific Android apps. You must provide the package name and the 20-byte SHA-1 certificate fingerprint for each app. When you use the API key in a request, you must specify the package name and certificate fingerprint by using the following HTTP headers: <ul> <li><code translate="no" dir="ltr">X-Android-Package</code></li> <li><code translate="no" dir="ltr">X-Android-Cert</code></li> </ul> <aside class="note">Note: Bypassing this restriction is straightforward. If you use this restriction, you should also add API restrictions and monitor usage carefully.</aside> To restrict your API key to one or more Android apps, use one of the following options: <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section><h3 id="console_3" data-text=" Console " tabindex="-1"> Console </h3><ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click the name of the API key that you want to restrict.</li> <li>In the Application restrictions section, select Android apps.</li> <li>For each Android app that you want to add, click Add an item and enter the package name and SHA-1 certificate fingerprint, then click Done.</li> <li>Click Save to save your changes and return to the API key list.</li> </ol></section> <section><h3 id="gcloud_3" data-text=" gcloud " tabindex="-1"> gcloud </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/sdk/gcloud/reference/services/api-keys/list"><code translate="no" dir="ltr">gcloud services api-keys list</code> command</a> to list the keys in your project.</li> <li>Use the <a href="/sdk/gcloud/reference/services/api-keys/update"><code translate="no" dir="ltr">gcloud services api-keys update</code> command</a> to specify the Android apps that can use an API key. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> <li><code translate="no" dir="ltr"><var translate="no">SHA1_FINGERPRINT</var></code> and <code translate="no" dir="ltr"><var translate="no">PACKAGE_NAME</var></code>: The app information for an Android app that can use the key. You can add as many apps as needed; use additional <code translate="no" dir="ltr">--allowed-application</code> flags.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud services api-keys update <var translate="no">KEY_ID</var> \ --allowed-application=sha1_fingerprint=<var translate="no">SHA1_FINGERPRINT_1</var>,package_name=<var translate="no">PACKAGE_NAME_1</var> \ --allowed-application=sha1_fingerprint=<var translate="no">SHA1_FINGERPRINT_2</var>,package_name=<var translate="no">PACKAGE_NAME_2</var></pre></devsite-code></li> </ol></section> <section><h3 id="java_3" data-text=" Java " tabindex="-1"> Java </h3>To run this sample, you must install the <a href="/java/docs/reference/google-cloud-apikeys/latest/overview"><code translate="no" dir="ltr">google-cloud-apikeys</code> client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyAndroid.java/HEAD/apikeys_restrict_api_key_android" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyAndroid.java" feedback-context="{"language": "java", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyAndroid.java"}" feedback-product="1634365" feedback-bucket="security" language="java" data-github-path="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyAndroid.java" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_android" dir="ltr" is-upgraded syntax="Java"><code translate="no" dir="ltr"> import com.google.api.apikeys.v2.AndroidApplication; import com.google.api.apikeys.v2.AndroidKeyRestrictions; import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyAndroid { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyAndroid(projectId, keyId); } // Restricts an API key based on android applications. // Specifies the Android application that can use the key. public static void restrictApiKeyAndroid(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage by specifying the allowed android applications. Restrictions restrictions = Restrictions.newBuilder() .setAndroidKeyRestrictions(AndroidKeyRestrictions.newBuilder() .addAllowedApplications(AndroidApplication.newBuilder() // Specify the android application's package name and SHA1 fingerprint. .setPackageName("com.google.appname") .setSha1Fingerprint("0873D391E987982FBBD30873D391E987982FBBD3") .build()) .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } }</code></pre></devsite-code> </div> </section> <section><h3 id="python_3" data-text=" Python " tabindex="-1"> Python </h3>To run this sample, you must install the <a href="/python/docs/reference/apikeys/latest">API Keys client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_android.py/HEAD/apikeys_restrict_api_key_android" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_android.py" feedback-context="{"language": "python", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_android.py"}" feedback-product="1634365" feedback-bucket="security" language="python" data-github-path="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_android.py" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_android" dir="ltr" is-upgraded syntax="Python"><code translate="no" dir="ltr"> from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_android(project_id: str, key_id: str) -> Key: """ Restricts an API key based on android applications. Specifies the Android application that can use the key. TODO(Developer): Replace the variables before running this sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Specify the android application's package name and SHA1 fingerprint. allowed_application = api_keys_v2.AndroidApplication() allowed_application.package_name = "com.google.appname" allowed_application.sha1_fingerprint = "0873D391E987982FBBD30873D391E987982FBBD3" # Restrict the API key usage by specifying the allowed applications. android_key_restriction = api_keys_v2.AndroidKeyRestrictions() android_key_restriction.allowed_applications = [allowed_application] # Set the restriction(s). # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.android_key_restrictions = android_key_restriction key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response </code></pre></devsite-code> </div> </section> <section><h3 id="rest_3" data-text=" REST " tabindex="-1"> REST </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/list">keys.list</a> method. The ID is listed in the <code translate="no" dir="ltr">uid</code> field of the response. Replace <code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code> with your Google Cloud project ID or name. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/"</pre></devsite-code></li> <li>Use the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/patch">keys.patch</a> method to specify the Android apps that can use an API key. This request returns a <a href="#lro">long-running operation</a>; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">SHA1_FINGERPRINT_1</var></code> and <code translate="no" dir="ltr"><var translate="no">PACKAGE_NAME_1</var></code>: The app information for an Android app that can use the key. You can add the information for as many apps as needed; use commas to separate the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys#AndroidApplication">AndroidApplication</a> objects. You must provide all applications with the request; the applications provided replace any existing allowed applications on the key.</li> <li><code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code>: Your Google Cloud project ID or name.</li> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "androidKeyRestrictions": { "allowedApplications": [ { "sha1Fingerprint": "<var translate="no">SHA1_FINGERPRINT_1</var>", "packageName": "<var translate="no">PACKAGE_NAME_1</var>" }, ] } } }' \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/<var translate="no">KEY_ID</var>?updateMask=restrictions"</pre></devsite-code></li> </ol> For more information about adding Android app restrictions to a key using the REST API, see <a href="/api-keys/docs/add-restrictions-api-keys#adding_android_restrictions">Adding Android restrictions</a> in the API Keys API documentation.</section> </div> <h4 id="ios" data-text="iOS apps" tabindex="-1">iOS apps</h4> You can restrict usage of an API key to specific iOS apps by providing the bundle ID of each app. When you use the API key in a request, you must specify the bundle ID by using the <code translate="no" dir="ltr">X-Ios-Bundle-Identifier</code> HTTP header. <aside class="note">Note: Bypassing this restriction is straightforward. If you use this restriction, you should also add API restrictions and monitor usage carefully.</aside> To restrict your API key to one or more iOS apps, use one of the following options: <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section><h3 id="console_4" data-text=" Console " tabindex="-1"> Console </h3><ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click the name of the API key that you want to restrict.</li> <li>In the Application restrictions section, select iOS apps.</li> <li>For each iOS app that you want to add, click Add an item and enter the bundle ID, then click Done.</li> <li>Click Save to save your changes and return to the API key list.</li> </ol></section> <section><h3 id="gcloud_4" data-text=" gcloud " tabindex="-1"> gcloud </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/sdk/gcloud/reference/services/api-keys/list"><code translate="no" dir="ltr">gcloud services api-keys list</code> command</a> to list the keys in your project.</li> <li>Use the <a href="/sdk/gcloud/reference/services/api-keys/update"><code translate="no" dir="ltr">gcloud services api-keys update</code></a> method to specify the iOS apps that can use the key. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> <li><code translate="no" dir="ltr"><var translate="no">ALLOWED_BUNDLE_ID</var></code>: The bundle ID of an iOS app that you want to be able to use this API key. You can add as many bundle IDs as needed; use commas to separate the IDs.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud services api-keys update <var translate="no">KEY_ID</var> \ --allowed-bundle-ids=<var translate="no">ALLOWED_BUNDLE_ID_1</var>,<var translate="no">ALLOWED_BUNDLE_ID_2</var></pre></devsite-code></li> </ol></section> <section><h3 id="java_4" data-text=" Java " tabindex="-1"> Java </h3>To run this sample, you must install the <a href="/java/docs/reference/google-cloud-apikeys/latest/overview"><code translate="no" dir="ltr">google-cloud-apikeys</code> client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyIos.java/HEAD/apikeys_restrict_api_key_ios" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyIos.java" feedback-context="{"language": "java", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyIos.java"}" feedback-product="1634365" feedback-bucket="security" language="java" data-github-path="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyIos.java" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_ios" dir="ltr" is-upgraded syntax="Java"><code translate="no" dir="ltr"> import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.IosKeyRestrictions; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.Arrays; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyIos { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyIos(projectId, keyId); } // Restricts an API key. You can restrict usage of an API key to specific iOS apps // by providing the bundle ID of each app. public static void restrictApiKeyIos(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage by specifying the bundle ID(s) // of iOS app(s) that can use the key. Restrictions restrictions = Restrictions.newBuilder() .setIosKeyRestrictions(IosKeyRestrictions.newBuilder() .addAllAllowedBundleIds(Arrays.asList("com.google.gmail", "com.google.drive")) .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } }</code></pre></devsite-code> </div> </section> <section><h3 id="python_4" data-text=" Python " tabindex="-1"> Python </h3>To run this sample, you must install the <a href="/python/docs/reference/apikeys/latest">API Keys client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_ios.py/HEAD/apikeys_restrict_api_key_ios" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_ios.py" feedback-context="{"language": "python", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_ios.py"}" feedback-product="1634365" feedback-bucket="security" language="python" data-github-path="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_ios.py" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_ios" dir="ltr" is-upgraded syntax="Python"><code translate="no" dir="ltr"> from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_ios(project_id: str, key_id: str) -> Key: """ Restricts an API key. You can restrict usage of an API key to specific iOS apps by providing the bundle ID of each app. TODO(Developer): Replace the variables before running this sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Restrict the API key usage by specifying the bundle ID(s) of iOS app(s) that can use the key. ios_key_restrictions = api_keys_v2.IosKeyRestrictions() ios_key_restrictions.allowed_bundle_ids = ["com.google.gmail", "com.google.drive"] # Set the API restriction. # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.ios_key_restrictions = ios_key_restrictions key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response </code></pre></devsite-code> </div> </section> <section><h3 id="rest_4" data-text=" REST " tabindex="-1"> REST </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/list">keys.list</a> method. The ID is listed in the <code translate="no" dir="ltr">uid</code> field of the response. Replace <code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code> with your Google Cloud project ID or name. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/"</pre></devsite-code></li> <li>Use the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/patch">keys.patch</a> method to specify the iOS apps that can use an API key. This request returns a <a href="#lro">long-running operation</a>; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">ALLOWED_BUNDLE_ID</var></code>: The bundle ID of an iOS app that can use the key. You can add the information for as many apps as needed; use commas to separate the bundle IDs. You must provide all bundle IDs with the request; the bundle IDs provided replace any existing allowed applications on the key.</li> <li><code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code>: Your Google Cloud project ID or name.</li> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "iosKeyRestrictions": { "allowedBundleIds": ["<var translate="no">ALLOWED_BUNDLE_ID_1</var>","<var translate="no">ALLOWED_BUNDLE_ID_2</var>"] } } }' \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/<var translate="no">KEY_ID</var>?updateMask=restrictions"</pre></devsite-code></li> </ol> For more information about adding iOS app restrictions to a key using the REST API, see <a href="/api-keys/docs/add-restrictions-api-keys#adding_ios_restrictions">Adding iOS restrictions</a> in the API Keys API documentation.</section> </div> <h3 id="adding-api-restrictions" data-text="Add API restrictions" tabindex="-1">Add API restrictions</h3> API restrictions specify which APIs can be called using the API key. <aside class="note">Note: Before you can specify an API for an API restriction, the API must be enabled for your project. To enable an API, go to the <a href="https://console.cloud.google.com/apis/dashboard" target="console">API dashboard</a>.</aside> To add API restrictions, use one of the following options: <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section><h3 id="console_5" data-text=" Console " tabindex="-1"> Console </h3><ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click the name of the API key that you want to restrict.</li> <li>In the API restrictions section, click Restrict key.</li> <li>Select all APIs that your API key will be used to access.</li> <li>Click Save to save your changes and return to the API key list.</li> </ol></section> <section><h3 id="gcloud_5" data-text=" gcloud " tabindex="-1"> gcloud </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/sdk/gcloud/reference/services/api-keys/list"><code translate="no" dir="ltr">gcloud services api-keys list</code> command</a> to list the keys in your project.</li> <li>Use the <a href="/sdk/gcloud/reference/services/api-keys/update"><code translate="no" dir="ltr">gcloud services api-keys update</code> command</a> to specify which services an API key can be used to access. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> <li><code translate="no" dir="ltr"><var translate="no">SERVICE_1</var></code>, <code translate="no" dir="ltr"><var translate="no">SERVICE_2</var></code>...: The service names of the APIs that the key can be used to access. You must provide all service names with the update command; the service names provided replace any existing services on the key.</li> </ul> You can find the service name by searching for the API on the <a href="https://console.cloud.google.com/apis/dashboard" target="console">API dashboard</a>. Service names are strings like <code translate="no" dir="ltr">bigquery.googleapis.com</code>. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud services api-keys update <var translate="no">KEY_ID</var> \ --api-target=service=<var translate="no">SERVICE_1</var> --api-target=service=<var translate="no">SERVICE_2</var></pre></devsite-code></li> </ol></section> <section><h3 id="java_5" data-text=" Java " tabindex="-1"> Java </h3>To run this sample, you must install the <a href="/java/docs/reference/google-cloud-apikeys/latest/overview"><code translate="no" dir="ltr">google-cloud-apikeys</code> client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyApi.java/HEAD/apikeys_restrict_api_key_api" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyApi.java" feedback-context="{"language": "java", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/RestrictApiKeyApi.java"}" feedback-product="1634365" feedback-bucket="security" language="java" data-github-path="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/RestrictApiKeyApi.java" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_api" dir="ltr" is-upgraded syntax="Java"><code translate="no" dir="ltr"> import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.ApiTarget; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyApi { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyApi(projectId, keyId); } // Restricts an API key. Restrictions specify which APIs can be called using the API key. public static void restrictApiKeyApi(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage by specifying the target service and methods. // The API key can only be used to authenticate the specified methods in the service. Restrictions restrictions = Restrictions.newBuilder() .addApiTargets(ApiTarget.newBuilder() .setService("translate.googleapis.com") .addMethods("translate.googleapis.com.TranslateText") .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } }</code></pre></devsite-code> </div> </section> <section><h3 id="python_5" data-text=" Python " tabindex="-1"> Python </h3>To run this sample, you must install the <a href="/python/docs/reference/apikeys/latest">API Keys client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_api.py/HEAD/apikeys_restrict_api_key_api" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_api.py" feedback-context="{"language": "python", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/restrict_api_key_api.py"}" feedback-product="1634365" feedback-bucket="security" language="python" data-github-path="GoogleCloudPlatform/python-docs-samples/auth/api-client/restrict_api_key_api.py" data-git-revision="HEAD" data-region-tag="apikeys_restrict_api_key_api" dir="ltr" is-upgraded syntax="Python"><code translate="no" dir="ltr"> from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_api(project_id: str, key_id: str) -> Key: """ Restricts an API key. Restrictions specify which APIs can be called using the API key. TODO(Developer): Replace the variables before running the sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Restrict the API key usage by specifying the target service and methods. # The API key can only be used to authenticate the specified methods in the service. api_target = api_keys_v2.ApiTarget() api_target.service = "translate.googleapis.com" api_target.methods = ["transate.googleapis.com.TranslateText"] # Set the API restriction(s). # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.api_targets = [api_target] key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response </code></pre></devsite-code> </div> </section> <section><h3 id="rest_5" data-text=" REST " tabindex="-1"> REST </h3><ol> <li>Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/list">keys.list</a> method. The ID is listed in the <code translate="no" dir="ltr">uid</code> field of the response. Replace <code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code> with your Google Cloud project ID or name. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/"</pre></devsite-code></li> <li>Use the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/patch">keys.patch</a> method to specify which services an API key can be used to access. This request returns a <a href="#lro">long-running operation</a>; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">SERVICE_1</var></code>, <code translate="no" dir="ltr"><var translate="no">SERVICE_2</var></code>...: The service names of the APIs that the key can be used to access. You must provide all service names with the request; the service names provided replace any existing services on the key. You can find the service name by searching for the API on the <a href="https://console.cloud.google.com/apis/dashboard" target="console">API dashboard</a>. Service names are strings like <code translate="no" dir="ltr">bigquery.googleapis.com</code>.</li> <li><code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code>: Your Google Cloud project ID or name.</li> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> </ul> <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "apiTargets": [ { "service": "<var translate="no">SERVICE_1</var>" }, { "service" : "<var translate="no">SERVICE_2</var>" }, ] } }' \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/<var translate="no">KEY_ID</var>?updateMask=restrictions"</pre></devsite-code></li> </ol> For more information about adding API restrictions to a key using the REST API, see <a href="/api-keys/docs/add-restrictions-api-keys#add-api-restrictions">Adding API restrictions</a> in the API Keys API documentation.</section> </div> <h2 id="get-info" data-text="Get project information from a key string" tabindex="-1">Get project information from a key string</h2> You can determine which Google Cloud project an API key is associated with from its string. Replace <code translate="no" dir="ltr"><var translate="no">KEY_STRING</var></code> with the key string you need project information for. <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section><h3 id="gcloud_6" data-text=" gcloud " tabindex="-1"> gcloud </h3>You use the <a href="/sdk/gcloud/reference/services/api-keys/lookup"><code translate="no" dir="ltr">gcloud services api-keys lookup</code> command</a> to get the project ID from a key string. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash"> gcloud services api-keys lookup <var translate="no">KEY_STRING</var> </pre></devsite-code></section> <section><h3 id="java_6" data-text=" Java " tabindex="-1"> Java </h3>To run this sample, you must install the <a href="/java/docs/reference/google-cloud-apikeys/latest/overview"><code translate="no" dir="ltr">google-cloud-apikeys</code> client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/LookupApiKey.java/HEAD/apikeys_lookup_api_key" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/LookupApiKey.java" feedback-context="{"language": "java", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/LookupApiKey.java"}" feedback-product="1634365" feedback-bucket="security" language="java" data-github-path="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/LookupApiKey.java" data-git-revision="HEAD" data-region-tag="apikeys_lookup_api_key" dir="ltr" is-upgraded syntax="Java"><code translate="no" dir="ltr"> import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.LookupKeyRequest; import com.google.api.apikeys.v2.LookupKeyResponse; import java.io.IOException; public class LookupApiKey { public static void main(String[] args) throws IOException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. // 2. Set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc // 3. Make sure you have the necessary permission to view API keys. // API key string to retrieve the API key name. String apiKeyString = "API_KEY_STRING"; lookupApiKey(apiKeyString); } // Retrieves name (full path) of an API key using the API key string. public static void lookupApiKey(String apiKeyString) throws IOException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Initialize the lookup request and set the API key string. LookupKeyRequest lookupKeyRequest = LookupKeyRequest.newBuilder() .setKeyString(apiKeyString) .build(); // Make the request and obtain the response. LookupKeyResponse response = apiKeysClient.lookupKey(lookupKeyRequest); System.out.printf("Successfully retrieved the API key name: %s", response.getName()); } } }</code></pre></devsite-code> </div> </section> <section><h3 id="python_6" data-text=" Python " tabindex="-1"> Python </h3>To run this sample, you must install the <a href="/python/docs/reference/apikeys/latest">API Keys client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/python-docs-samples/auth/api-client/lookup_api_key.py/HEAD/apikeys_lookup_api_key" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/lookup_api_key.py" feedback-context="{"language": "python", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/python-docs-samples/blob/HEAD/auth/api-client/lookup_api_key.py"}" feedback-product="1634365" feedback-bucket="security" language="python" data-github-path="GoogleCloudPlatform/python-docs-samples/auth/api-client/lookup_api_key.py" data-git-revision="HEAD" data-region-tag="apikeys_lookup_api_key" dir="ltr" is-upgraded syntax="Python"><code translate="no" dir="ltr"> from google.cloud import api_keys_v2 def lookup_api_key(api_key_string: str) -> None: """ Retrieves name (full path) of an API key using the API key string. TODO(Developer): 1. Before running this sample, set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc 2. Make sure you have the necessary permission to view API keys. Args: api_key_string: API key string to retrieve the API key name. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Initialize the lookup request and set the API key string. lookup_key_request = api_keys_v2.LookupKeyRequest( key_string=api_key_string, # Optionally, you can also set the etag (version). # etag=etag, ) # Make the request and obtain the response. lookup_key_response = client.lookup_key(lookup_key_request) print(f"Successfully retrieved the API key name: {lookup_key_response.name}") </code></pre></devsite-code> </div> </section> <section><h3 id="rest_6" data-text=" REST " tabindex="-1"> REST </h3>You use the <a href="/api-keys/docs/reference/rest/v2/keys/lookupKey"><code translate="no" dir="ltr">lookupKey</code> method</a> to get the project ID from a key string. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/keys:lookupKey?keyString=<var translate="no">KEY_STRING</var>"</pre></devsite-code></section> </div> <h2 id="copy" data-text="Create a copy of an API key" tabindex="-1">Create a copy of an API key</h2> If you need a new API key with the same restrictions as an existing API key, you can create a copy of the existing API key. This operation creates a new API key with a unique key string and ID, with the existing API key's restrictions. The copy operation is available only in the Google Cloud console. To use other methods, follow the steps to <a href="#create">create an API key</a>, and then <a href="#adding-api-restrictions">apply the same API key restrictions</a> to the newly generated API key. <ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click the name of the API key that you want to copy. The API key's details page opens.</li> <li>Click Create a copy.</li> <li>Enter a name for the new API key and confirm that the restrictions are correct.</li> <li>Click Create.</li> </ol> <h2 id="rotate" data-text="Rotate an API key" tabindex="-1">Rotate an API key</h2> By periodically rotating your API keys, you can limit the impact of any compromised API keys. When you rotate an API key, you create a new key with the same restrictions as the old key, and update your applications to use the new key. After all of your applications are updated, you delete the old key. The rotation operation is available only in the Google Cloud console. To use other methods, follow the steps to <a href="#create">create an API key</a>, and then <a href="#adding-api-restrictions">apply the same API key restrictions</a> to the newly generated API key. After updating your applications to use the new key, you delete the old key. <ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click the name of the API key that you want to rotate to open its details page.</li> <li>Click Rotate key.</li> <li>Enter a name for the new API key and confirm that the restrictions are correct.</li> <li>Click Create.</li> <li>Copy the key string and update your applications to use the new string.</li> <li>After you have updated all applications to use the new key, return to the details page for the new key. In the Previous key section, click Delete the previous key to delete the old key. If you find that you deleted the old key prematurely, you can <a href="#undelete">undelete it</a>.</li> </ol> <h2 id="undelete" data-text="Undelete an API key" tabindex="-1">Undelete an API key</h2> If you delete an API key by mistake, you can undelete (restore) that key within 30 days of deleting the key. After 30 days, you cannot undelete the API key. <div class="ds-selector-tabs" data-ds-scope="code-sample"> <section><h3 id="console_6" data-text=" Console " tabindex="-1"> Console </h3><ol> <li>In the Google Cloud console, go to the Credentials page: <a href="https://console.cloud.google.com/apis/credentials" class="button button-primary" target="console">Go to Credentials</a></li> <li>Click Restore deleted credentials.</li> <li>Find the deleted API key that you want to undelete, and click Restore. Undeleting an API key may take a few minutes to propagate. After propagation, the undeleted API key is displayed in the API keys list.</li> </ol></section> <section><h3 id="gcloud_7" data-text=" gcloud " tabindex="-1"> gcloud </h3><ol> <li>Get the ID of the key that you want to undelete. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/sdk/gcloud/reference/services/api-keys/list"><code translate="no" dir="ltr">gcloud services api-keys list --show-deleted</code> command</a> to list the deleted keys in your project.</li> <li>Use the <a href="/sdk/gcloud/reference/services/api-keys/undelete"><code translate="no" dir="ltr">gcloud services api-keys undelete</code> command</a> to undelete an API key. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="Bash">gcloud services api-keys undelete <var translate="no">KEY_ID</var></pre></devsite-code> Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to undelete.</li> </ul></li> </ol></section> <section><h3 id="java_7" data-text=" Java " tabindex="-1"> Java </h3>To run this sample, you must install the <a href="/java/docs/reference/google-cloud-apikeys/latest/overview"><code translate="no" dir="ltr">google-cloud-apikeys</code> client library</a>. <div class="github-docwidget-gitinclude-code"> <div></div><devsite-code><pre suppresswarning="suppresswarning" translate="no" class="devsite-click-to-copy" track-metadata-position="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/UndeleteApiKey.java/HEAD/apikeys_undelete_api_key" data-code-snippet="true" data-github-includecode-link="https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/UndeleteApiKey.java" feedback-context="{"language": "java", "region_tag": "apikeys_create_api_key", "snippet_file_url": "https://github.com/GoogleCloudPlatform/java-docs-samples/blob/HEAD/auth/src/main/java/UndeleteApiKey.java"}" feedback-product="1634365" feedback-bucket="security" language="java" data-github-path="GoogleCloudPlatform/java-docs-samples/auth/src/main/java/UndeleteApiKey.java" data-git-revision="HEAD" data-region-tag="apikeys_undelete_api_key" dir="ltr" is-upgraded syntax="Java"><code translate="no" dir="ltr">import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.UndeleteKeyRequest; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class UndeleteApiKey { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(developer): Replace these variables before running the sample. // Project ID or project number of the Google Cloud project. String projectId = "YOUR_PROJECT_ID"; // The API key id to undelete. String keyId = "YOUR_KEY_ID"; undeleteApiKey(projectId, keyId); } // Undeletes an API key. public static void undeleteApiKey(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Initialize the undelete request and set the argument. UndeleteKeyRequest undeleteKeyRequest = UndeleteKeyRequest.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) .build(); // Make the request and wait for the operation to complete. Key undeletedKey = apiKeysClient.undeleteKeyAsync(undeleteKeyRequest) .get(3, TimeUnit.MINUTES); System.out.printf("Successfully undeleted the API key: %s", undeletedKey.getName()); } } }</code></pre></devsite-code> </div> </section> <section><h3 id="rest_7" data-text=" REST " tabindex="-1"> REST </h3><ol> <li>Get the ID of the key that you want to undelete. The ID is not the same as the display name or the key string. You can get the ID by using the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/list">keys.list</a> method, with the <code translate="no" dir="ltr">showDeleted</code> query parameter set to <code translate="no" dir="ltr">true</code>. The key ID is listed in the <code translate="no" dir="ltr">uid</code> field of the response. Replace <code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code> with your Google Cloud project ID or name. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys?showDeleted=true"</pre></devsite-code></li> <li>Use the <a href="/api-keys/docs/reference/rest/v2/projects.locations.keys/undelete">undelete</a> method to undelete the API key. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/projects/<var translate="no">PROJECT_ID</var>/locations/global/keys/<var translate="no">KEY_ID</var>:undelete"</pre></devsite-code> This request returns a <a href="#lro">long-running operation</a>; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: <ul> <li><code translate="no" dir="ltr"><var translate="no">PROJECT_ID</var></code>: Your Google Cloud project ID or name.</li> <li><code translate="no" dir="ltr"><var translate="no">KEY_ID</var></code>: The ID of the key that you want to restrict.</li> </ul></li> </ol></section> </div> <h2 id="lro" data-text="Poll long-running operations" tabindex="-1">Poll long-running operations</h2> API Keys API methods use long-running operations. If you use the REST API to create and manage API keys, an operation object is returned from the initial method request. You use the operation name to poll the long-running operation. When the long-running request completes, polling the operation returns the data from the long-running request. To poll a long-running API Keys API operation, you use the <a href="/api-keys/docs/reference/rest/v2/operations/get"><code translate="no" dir="ltr">operations.get</code></a> method. Replace <code translate="no" dir="ltr"><var translate="no">OPERATION_NAME</var></code> with the operation name returned by the long-running operation. For example, <code translate="no" dir="ltr">operations/akmf.p7-358517206116-cd10a88a-7740-4403-a8fd-979f3bd7fe1c</code>. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JSON">curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/<var translate="no">OPERATION_NAME</var>"</pre></devsite-code> <h2 id="limits" data-text="Limits on API keys" tabindex="-1">Limits on API keys</h2> You can create up to 300 API keys per project. This limit is a system limit, and can't be changed using a quota increase request. If more API keys are needed, you must use more than one project. You can add up to 1200 <a href="#adding-application-restrictions">application restrictions</a> to an API key. <h2 id="whats_next" data-text="What's next" tabindex="-1">What's next</h2> <ul> <li>Learn about <a href="/docs/authentication/api-keys-best-practices">best practices for keeping your API keys secure</a>.</li> <li>Learn more about the <a href="/api-keys/docs/overview">API Keys API</a>.</li> </ul> <devsite-hats-survey class="nocontent" hats-id="Nd7nTix2o0eU5NUYprb0ThtUc5jf" listnr-id="83405"></devsite-hats-survey> </div> <devsite-thumb-rating position="footer"> </devsite-thumb-rating> <devsite-feedback position="footer" project-name="Authentication" product-id="5152837" bucket="Auth Docs" context="" version="t-devsite-webserver-20250220-r00-rc00.467186154483790716" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="footer" class="nocontent" project-icon="https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/favicons/onecloud/super_cloud.png" > <button> Send feedback </button> </devsite-feedback> <div class="devsite-floating-action-buttons"> </div> </article> <devsite-content-footer class="nocontent"> Except as otherwise noted, the content of this page is licensed under the <a href="https://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution 4.0 License</a>, and code samples are licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache 2.0 License</a>. For details, see the <a href="https://developers.google.com/site-policies">Google Developers Site Policies</a>. Java is a registered trademark of Oracle and/or its affiliates. Last updated 2025-02-25 UTC. </devsite-content-footer> <devsite-notification > </devsite-notification> <div class="devsite-content-data"> <template class="devsite-thumb-rating-feedback"> <devsite-feedback position="thumb-rating" project-name="Authentication" product-id="5152837" bucket="Auth Docs" context="" version="t-devsite-webserver-20250220-r00-rc00.467186154483790716" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="thumb-rating" class="nocontent" project-icon="https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/favicons/onecloud/super_cloud.png" > <button> Need to tell us more? </button> </devsite-feedback> </template> <template class="devsite-content-data-template"> [[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-02-25 UTC."],[],[]] </template> </div> </devsite-content> </main> <devsite-footer-promos class="devsite-footer"> </devsite-footer-promos> <devsite-footer-linkboxes class="devsite-footer"> <nav class="devsite-footer-linkboxes nocontent" aria-label="Footer links"> <ul class="devsite-footer-linkboxes-list"> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Why Google</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="/why-google-cloud/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" track-metadata-module="footer"track-metadata-position="footer"track-type="footer link"track-metadata-child_headline="why google"track-name="choosing google cloud"track-metadata-eventDetail="cloud.google.com/why-google-cloud/"> Choosing Google Cloud </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/trust-center/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" track-type="footer link"track-metadata-child_headline="why google"track-metadata-position="footer"track-name="trust and security"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/security/"> Trust and security </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/modern-infrastructure/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 3)" track-name="modern infrastructure cloud"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/solutions/modern-infrastructure/"track-type="footer link"track-metadata-position="footer"track-metadata-child_headline="why google"> Modern Infrastructure Cloud </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/multicloud/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 4)" track-metadata-child_headline="why google"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/multicloud/"track-name="multicloud"track-type="footer link"track-metadata-module="footer"> Multicloud </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/infrastructure/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 5)" track-type="footer link"track-metadata-child_headline="why google"track-metadata-eventDetail="cloud.google.com/infrastructure/"track-metadata-position="footer"track-metadata-module="footer"track-name="global infrastructure"> Global infrastructure </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/customers/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 6)" track-name="customers and case studies"track-metadata-position="footer"track-metadata-child_headline="why google"track-metadata-eventDetail="cloud.google.com/customers/"track-type="footer link"track-metadata-module="footer"> Customers and case studies </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/analyst-reports/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 7)" track-metadata-module="footer"track-name="analyst reports"track-metadata-eventDetail="cloud.google.com/analyst-reports/"track-metadata-child_headline="why google"track-metadata-position="footer"track-type="footer link"> Analyst reports </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/whitepapers/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 8)" track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/whitepapers/"track-metadata-module="footer"track-type="footer link"track-metadata-child_headline="why google"track-name="whitepapers"> Whitepapers </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//cloud.google.com/blog/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 9)" track-name="blog"track-metadata-module="footer"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/blog/"track-metadata-child_headline="engage"track-type="footer link"> Blog </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Products and pricing</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="/pricing/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" track-name="google cloud pricing"track-metadata-module="footer"track-type="footer link"track-metadata-child_headline="products and pricing"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/pricing/"> Google Cloud pricing </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//workspace.google.com/pricing.html" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" target="_blank"track-metadata-eventDetail="workspace.google.com/pricing.html"track-type="footer link"track-metadata-child_headline="products and pricing"track-name="google workspace pricing"track-metadata-module="footer"track-metadata-position="footer"> Google Workspace pricing </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/products/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 3)" track-type="footer link"track-name="see all products"track-metadata-child_headline="products and pricing"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/products/"track-metadata-module="footer"> See all products </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Solutions</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="/solutions/infrastructure-modernization/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" track-name="infrastructure modernization"track-metadata-child_headline="solutions"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/solutions/infrastructure-modernization/"track-metadata-module="footer"track-type="footer link"> Infrastructure modernization </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/databases/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" track-metadata-module="footer"track-metadata-child_headline="solutions"track-metadata-position="footer"track-type="footer link"track-name="databases"track-metadata-eventDetail="cloud.google.com/solutions/databases"> Databases </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/application-modernization/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 3)" track-name="application development"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/solutions/application-modernization/"track-metadata-module="footer"track-metadata-child_headline="solutions"track-type="footer link"> Application modernization </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/smart-analytics/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 4)" track-metadata-child_headline="solutions"track-name="smart analytics"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/solutions/smart-analytics/"track-metadata-module="footer"track-type="footer link"> Smart analytics </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/ai/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 5)" track-metadata-child_headline="solutions"track-metadata-position="footer"track-metadata-module="footer"track-name="artificial intelligence"track-metadata-eventDetail="cloud.google.com/solutions/ai/"track-type="footer link"> Artificial Intelligence </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/security/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 6)" track-metadata-eventDetail="cloud.google.com/solutions/security/"track-metadata-module="footer"track-metadata-position="footer"track-metadata-child_headline="solutions"track-name="security"track-type="footer link"> Security </a> </li> <li class="devsite-footer-linkbox-item"> <a href="https://workspace.google.com/enterprise/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 7)" track-type="footer link"track-name="productivity and work transformation"track-metadata-eventDetail="workspace.google.com/enterprise/"track-metadata-position="footer"track-metadata-module="footer"track-metadata-child_headline="solutions"target="_blank"> Productivity & work transformation </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/#industry-solutions" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 8)" track-name="industry solutions"track-type="footer link"track-metadata-child_headline="solutions"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/solutions/#industry-solutions"track-metadata-position="footer"> Industry solutions </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/devops/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 9)" track-metadata-eventDetail="cloud.google.com/solutions/devops/"track-metadata-module="footer"track-metadata-child_headline="solutions"track-type="footer link"track-name="devops solutions"track-metadata-position="footer"> DevOps solutions </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/#section-14" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 10)" track-type="footer link"track-name="small business solutions"track-metadata-child_headline="solutions"track-metadata-eventDetail="cloud.google.com/solutions/#section-14"track-metadata-module="footer"track-metadata-position="footer"> Small business solutions </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/solutions/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 11)" track-name="see all solutions"track-metadata-position="footer"track-metadata-child_headline="solutions"track-metadata-eventDetail="cloud.google.com/solutions/"track-metadata-module="footer"track-type="footer link"> See all solutions </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Resources</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="/affiliate-program/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" track-metadata-eventDetail="cloud.google.com/affiliate-program/"track-metadata-position="footer"track-metadata-module="footer"track-type="footer link"track-name="google cloud affiliate program"track-metadata-child_headline="resources"> Google Cloud Affiliate Program </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/docs/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" track-type="footer link"track-name="google cloud documentation"track-metadata-child_headline="resources"track-metadata-position="footer"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/docs/"> Google Cloud documentation </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/docs/get-started/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 3)" track-metadata-module="footer"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/docs/get-started/"track-name="google cloud quickstarts"track-type="footer link"track-metadata-child_headline="resources"> Google Cloud quickstarts </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/marketplace/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 4)" track-metadata-child_headline="resources"track-name="google cloud marketplace"track-metadata-module="footer"track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/marketplace/"track-type="footer link"> Google Cloud Marketplace </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/discover/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 5)" track-metadata-position="footer"track-metadata-eventDetail="learn/"track-metadata-module="footer"track-name="learn about cloud computing"track-metadata-child_headline="resources"track-type="footer link"> Learn about cloud computing </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/support-hub/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 6)" track-metadata-child_headline="resources"track-metadata-eventDetail="cloud.google.com/support-hub/"track-metadata-position="footer"track-metadata-module="footer"track-name="support"track-type="footer link"> Support </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/docs/samples" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 7)" track-metadata-position="footer"track-type="footer link"track-name="code samples"track-metadata-child_headline="resources"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/docs/samples"> Code samples </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/architecture/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 8)" track-metadata-position="footer"track-metadata-child_headline="resources"track-name="cloud architecture center"track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/architecture/"track-type="footer link"> Cloud Architecture Center </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/learn/training/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 9)" track-metadata-module="footer"track-metadata-eventDetail="cloud.google.com/training/"track-metadata-position="footer"track-name="training"track-type="footer link"track-metadata-child_headline="resources"> Training </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/learn/certification/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 10)" track-type="footer link"track-name="certifications"track-metadata-eventDetail="cloud.google.com/certification"track-metadata-module="footer"track-metadata-child_headline="resources"track-metadata-position="footer"> Certifications </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//developers.google.com" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 11)" track-type="footer link"track-metadata-child_headline="resources"track-metadata-eventDetail="developers.google.com"track-metadata-position="footer"track-metadata-module="footer"track-name="google developers"target="_blank"> Google for Developers </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/startup/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 12)" track-metadata-eventDetail="cloud.google.com/startup/"track-metadata-module="footer"track-name="google cloud for startups"track-metadata-position="footer"track-metadata-child_headline="resources"track-type="footer link"> Google Cloud for Startups </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//status.cloud.google.com" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 13)" target="_blank"track-name="system status"track-type="footer link"track-metadata-child_headline="resources"track-metadata-position="footer"track-metadata-module="footer"track-metadata-eventDetail="status.cloud.google.com"> System status </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/release-notes" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 14)" track-metadata-eventDetail="cloud.google.com/release-notes/"track-metadata-position="footer"track-metadata-module="footer"track-metadata-child_headline="resources"track-type="footer link"track-name="release notes"> Release Notes </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Engage</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="/contact/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" track-metadata-eventDetail="cloud.google.com/contact/"track-metadata-module="footer"track-metadata-child_headline="engage"track-metadata-position="footer"track-name="contact sales"track-type="footer link"> Contact sales </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//cloud.google.com/find-a-partner" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" track-type="footer link"track-name="find a partner"track-metadata-eventDetail="cloud.google.com/find-a-partner"track-metadata-position="footer"track-metadata-module="footer"track-metadata-child_headline="engage"target="_blank"> Find a Partner </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/partners/become-a-partner/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 3)" track-type="footer link"track-metadata-eventDetail="cloud.google.com/partners/become-a-partner/"track-metadata-module="footer"track-name="become a partner"track-metadata-position="footer"track-metadata-child_headline="engage"> Become a Partner </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/events/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 4)" track-name="events"track-metadata-position="footer"track-metadata-eventDetail="cloud.withgoogle.com/events"track-metadata-module="footer"track-type="footer link"track-metadata-child_headline="engage"> Events </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/podcasts/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 5)" track-metadata-position="footer"track-metadata-eventDetail="cloud.google.com/podcasts/"track-metadata-child_headline="engage"target="_blank"rel="noopener"track-type="footer link"track-name="podcasts"track-metadata-module="footer"> Podcasts </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/developers/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 6)" track-type="footer link"track-metadata-child_headline="engage"track-metadata-eventDetail="cloud.google.com/developers/"track-metadata-module="footer"track-name="developer center"track-metadata-position="footer"> Developer Center </a> </li> <li class="devsite-footer-linkbox-item"> <a href="https://www.googlecloudpresscorner.com/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 7)" track-metadata-eventDetail="www.googlecloudpresscorner.com"track-metadata-child_headline="engage"target="_blank"track-metadata-position="footer"rel="noopener"track-type="footer link"track-name="press corner"track-metadata-module="footer"> Press Corner </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//www.youtube.com/googlecloud" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 8)" track-metadata-position="footer"track-metadata-module="footer"track-metadata-eventDetail="www.youtube.com/googlecloud"track-metadata-child_headline="engage"target="_blank"track-type="footer link"track-name="google cloud on youtube"rel="noopener"> Google Cloud on YouTube </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//www.youtube.com/googlecloudplatform" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 9)" track-metadata-child_headline="engage"track-metadata-position="footer"rel="noopener"track-name="google cloud tech on youtube"track-metadata-module="footer"track-metadata-eventDetail="www.youtube.com/googlecloudplatform"target="_blank"track-type="footer link"> Google Cloud Tech on YouTube </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//x.com/googlecloud" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 10)" track-name="follow on x"rel="noopener"track-type="footer link"track-metadata-eventDetail="x.com/googlecloud"track-metadata-module="footer"track-metadata-child_headline="engage"target="_blank"track-metadata-position="footer"> Follow on X </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//userresearch.google.com/?reserved=1&utm_source=website&Q_Language=en&utm_medium=own_srch&utm_campaign=CloudWebFooter&utm_term=0&utm_content=0&productTag=clou&campaignDate=jul19&pType=devel&referral_code=jk212693" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 11)" track-metadata-module="footer"track-metadata-eventDetail="userresearch.google.com/?reserved=1&utm_source=website&Q_Language=en&utm_medium=own_srch&utm_campaign=CloudWebFooter&utm_term=0&utm_content=0&productTag=clou&campaignDate=jul19&pType=devel&referral_code=jk212693"track-metadata-child_headline="engage"target="_blank"track-metadata-position="footer"track-name="join user research"track-type="footer link"> Join User Research </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//careers.google.com/cloud" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 12)" track-name="we are hiring join google cloud"track-type="footer link"track-metadata-child_headline="engage"track-metadata-module="footer"track-metadata-eventDetail="careers.google.com/cloud"track-metadata-position="footer"target="_blank"> We're hiring. Join Google Cloud! </a> </li> <li class="devsite-footer-linkbox-item"> <a href="https://www.googlecloudcommunity.com/" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 13)" track-metadata-eventDetail="www.googlecloudcommunity.com"rel="noopener"track-metadata-position="footer"track-type="footer link"track-metadata-child_headline="engage"track-name="google cloud community"target="_blank"track-metadata-module="footer"> Google Cloud Community </a> </li> </ul> </li> </ul> </nav> </devsite-footer-linkboxes> <devsite-footer-utility class="devsite-footer"> <div class="devsite-footer-utility nocontent"> <nav class="devsite-footer-utility-links" aria-label="Utility links"> <ul class="devsite-footer-utility-list"> <li class="devsite-footer-utility-item "> <a class="devsite-footer-utility-link gc-analytics-event" href="//about.google/" data-category="Site-Wide Custom Events" data-label="Footer About Google link" track-metadata-module="utility footer" target="_blank" track-type="footer link" track-metadata-eventDetail="//about.google/" track-name="about google" track-metadata-position="footer" > About Google </a> </li> <li class="devsite-footer-utility-item devsite-footer-privacy-link"> <a class="devsite-footer-utility-link gc-analytics-event" href="//policies.google.com/privacy" data-category="Site-Wide Custom Events" data-label="Footer Privacy link" track-metadata-module="utility footer" track-metadata-eventDetail="//policies.google.com/privacy" target="_blank" track-metadata-position="footer" track-name="privacy" track-type="footer link" > Privacy </a> </li> <li class="devsite-footer-utility-item "> <a class="devsite-footer-utility-link gc-analytics-event" href="//www.google.com/intl/en/policies/terms/regional.html" data-category="Site-Wide Custom Events" data-label="Footer Site terms link" track-metadata-eventDetail="//www.google.com/intl/en/policies/terms/regional.html" track-metadata-module="utility footer" track-name="site terms" track-metadata-position="footer" target="_blank" track-type="footer link" > Site terms </a> </li> <li class="devsite-footer-utility-item "> <a class="devsite-footer-utility-link gc-analytics-event" href="/product-terms/" data-category="Site-Wide Custom Events" data-label="Footer Google Cloud terms link" track-name="google cloud terms" track-type="footer link" track-metadata-module="utility footer" track-metadata-position="footer" track-metadata-eventDetail="/product-terms/" > Google Cloud terms </a> </li> <li class="devsite-footer-utility-item glue-cookie-notification-bar-control"> <a class="devsite-footer-utility-link gc-analytics-event" href="#" data-category="Site-Wide Custom Events" data-label="Footer Manage cookies link" track-metadata-position="footer" track-metadata-module="utility footer" aria-hidden="true" track-metadata-eventDetail="#" track-type="footer link" track-name="Manage cookies" > Manage cookies </a> </li> <li class="devsite-footer-utility-item devsite-footer-carbon-button"> <a class="devsite-footer-utility-link gc-analytics-event" href="/sustainability" data-category="Site-Wide Custom Events" data-label="Footer Our third decade of climate action: join us link" track-metadata-module="utility footer" track-metadata-position="footer" track-type="footer link" track-name="Our third decade of climate action: join us" track-metadata-eventDetail="/sustainability/" > Our third decade of climate action: join us </a> </li> <li class="devsite-footer-utility-item devsite-footer-utility-button"> Sign up for the Google Cloud newsletter <a class="devsite-footer-utility-link gc-analytics-event" href="/newsletter/" data-category="Site-Wide Custom Events" data-label="Footer Subscribe link" track-type="footer link" track-name="subscribe" track-metadata-position="footer" track-metadata-module="utility footer" track-metadata-eventDetail="/newsletter/" > Subscribe </a> </li> </ul> <devsite-language-selector> <ul role="presentation"> <li role="presentation"> <a role="menuitem" lang="en" >English</a> </li> <li role="presentation"> <a role="menuitem" lang="de" >Deutsch</a> </li> <li role="presentation"> <a role="menuitem" lang="es_419" >Español – América Latina</a> </li> <li role="presentation"> <a role="menuitem" lang="fr" >Français</a> </li> <li role="presentation"> <a role="menuitem" lang="id" >Indonesia</a> </li> <li role="presentation"> <a role="menuitem" lang="it" >Italiano</a> </li> <li role="presentation"> <a role="menuitem" lang="pt_br" >Português – Brasil</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_cn" >中文 – 简体</a> </li> <li role="presentation"> <a role="menuitem" lang="ja" >日本語</a> </li> <li role="presentation"> <a role="menuitem" lang="ko" >한국어</a> </li> </ul> </devsite-language-selector> </nav> </div> </devsite-footer-utility> <devsite-panel></devsite-panel> </section></section> <devsite-sitemask></devsite-sitemask> <devsite-snackbar></devsite-snackbar> <devsite-tooltip ></devsite-tooltip> <devsite-heading-link></devsite-heading-link> <devsite-analytics> <script type="application/json" analytics>[]</script> <script type="application/json" tag-management>{"at": "True", "ga4": [], "ga4p": [], "gtm": [{"id": "GTM-5CVQBG", "purpose": 1}], "parameters": {"internalUser": "False", "language": {"machineTranslated": "False", "requested": "en", "served": "en"}, "pageType": "article", "projectName": "Authentication", "signedIn": "False", "tenant": "cloud", "recommendations": {"sourcePage": "", "sourceType": 0, "sourceRank": 0, "sourceIdenticalDescriptions": 0, "sourceTitleWords": 0, "sourceDescriptionWords": 0, "experiment": ""}, "experiment": {"ids": ""}}}</script> </devsite-analytics> <devsite-badger></devsite-badger> <cloudx-user></cloudx-user> <cloudx-free-trial-eligible-store freeTrialEligible='true'></cloudx-free-trial-eligible-store> <cloudx-pricing-socket></cloudx-pricing-socket> <cloudx-experiments type="TestAACodivertedExperiment" path="/virtual/TestAACodivertedExperiment/configureExperiment" location="SG" variant="variant2" ></cloudx-experiments> <cloudx-experiment-ids userCountry="SG" devsiteExperimentIdList="[39300012, 39300020, 39300118, 39300195, 39300241, 39300317, 39300322, 39300324, 39300346, 39300354, 39300364, 39300374, 39300412, 39300422, 39300436, 39300473, 39300488, 39300496, 39300498, 39300569]"> </cloudx-experiment-ids> <script nonce="eqiumjwR5tTPB4Ve+XXDFbG9UDRm46"> (function(d,e,v,s,i,t,E){d['GoogleDevelopersObject']=i; t=e.createElement(v);t.async=1;t.src=s;E=e.getElementsByTagName(v)[0]; E.parentNode.insertBefore(t,E);})(window, document, 'script', 'https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/js/app_loader.js', '[2,"en",null,"/js/devsite_app_module.js","https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f","https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud","https://cloud-dot-devsite-v2-prod.appspot.com",null,null,["/_pwa/cloud/manifest.json","https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/images/video-placeholder.svg","https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/favicons/onecloud/favicon.ico","https://www.gstatic.com/devrel-devsite/prod/vdbb152dfd6ef5e309aa1d261d45f3fd443aed2691cbfba3f9f80f8a4012a0a8f/cloud/images/cloud-logo.svg","https://fonts.googleapis.com/css?family=Google+Sans:400,500,700|Google+Sans+Text:400,400italic,500,500italic,700,700italic|Roboto:400,400italic,500,500italic,700,700italic|Roboto+Mono:400,500,700&display=swap"],1,null,[1,6,8,12,14,17,21,25,50,52,63,70,75,76,80,87,91,92,93,97,98,100,101,102,103,104,105,107,108,109,110,112,113,116,117,118,120,122,124,125,126,127,129,130,131,132,133,134,135,136,138,140,141,147,148,149,151,152,156,157,158,159,161,163,164,168,169,170,179,180,182,183,186,191,193,196],"AIzaSyAP-jjEJBzmIyKR4F-3XITp8yM9T1gEEI8","AIzaSyB6xiKGDR5O3Ak2okS4rLkauxGUG7XP0hg","cloud.google.com","AIzaSyAQk0fBONSGUqCNznf6Krs82Ap1-NV6J4o","AIzaSyCCxcqdrZ_7QMeLCRY20bh_SXdAYqy70KY",null,null,null,["Profiles__enable_complete_playlist_endpoint","TpcFeatures__enable_unmirrored_page_left_nav","Profiles__enable_join_program_group_endpoint","Search__enable_ai_eligibility_checks","MiscFeatureFlags__enable_firebase_utm","MiscFeatureFlags__developers_footer_dark_image","Profiles__enable_page_saving","Cloud__enable_legacy_calculator_redirect","MiscFeatureFlags__enable_variable_operator","DevPro__enable_developer_subscriptions","Cloud__enable_cloud_shell","Profiles__enable_dashboard_curated_recommendations","TpcFeatures__enable_mirror_tenant_redirects","MiscFeatureFlags__enable_project_variables","Cloud__enable_llm_concierge_chat","Profiles__enable_stripe_subscription_management","Profiles__enable_recognition_badges","Cloud__enable_cloudx_experiment_ids","Search__scope_to_project_tenant","MiscFeatureFlags__emergency_css","Search__enable_suggestions_from_borg","Profiles__enable_release_notes_notifications","Search__enable_dynamic_content_confidential_banner","MiscFeatureFlags__enable_explain_this_code","Search__enable_ai_search_summaries","CloudShell__cloud_shell_button","Experiments__reqs_query_experiments","Profiles__enable_completequiz_endpoint","MiscFeatureFlags__enable_view_transitions","Analytics__enable_clearcut_logging","Cloud__enable_cloud_dlp_service","Profiles__enable_developer_profiles_callout","Cloud__enable_cloud_facet_chat","CloudShell__cloud_code_overflow_menu","Concierge__enable_pushui","Profiles__require_profile_eligibility_for_signin","Cloud__enable_cloudx_ping","Profiles__enable_awarding_url","Concierge__enable_concierge_restricted","Cloud__enable_free_trial_server_call","Search__enable_ai_search_summaries_restricted","Cloud__enable_cloud_shell_fte_user_flow","Profiles__enable_profile_collections","DevPro__enable_cloud_innovators_plus","BookNav__enable_tenant_cache_key","Profiles__enable_public_developer_profiles","EngEduTelemetry__enable_engedu_telemetry","Profiles__enable_completecodelab_endpoint","MiscFeatureFlags__developers_footer_image","Search__enable_page_map"],null,null,"AIzaSyBLEMok-5suZ67qRPzx0qUtbnLmyT_kCVE","https://developerscontentserving-pa.clients6.google.com","AIzaSyCM4QpTRSqP5qI4Dvjt4OAScIN8sOUlO-k","https://developerscontentsearch-pa.clients6.google.com",1,4,1,"https://developerprofiles-pa.clients6.google.com",[2,"cloud","Google Cloud","cloud.google.com",null,"cloud-dot-devsite-v2-prod.appspot.com",null,null,[1,1,null,null,null,null,null,null,null,null,null,[1],null,null,null,null,null,1,[1],[null,null,null,[1,20],"/terms/recommendations"],[1],null,[1],[1,null,1],[1,1,null,null,1,null,["/vertex-ai/"]]],null,[22,null,null,null,null,null,"/images/cloud-logo.svg","/images/favicons/onecloud/apple-icon.png",null,null,null,null,1,1,1,[6,5],[],null,null,[[],[],[],[],[],[],[],[]],null,1,null,null,null,null,[]],[],null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,[6,1,14,15,22,23,29,37],null,[[null,null,null,null,null,null,[1,[["docType","Choose a content type",[["ApiReference",null,null,null,null,null,null,null,null,"API reference"],["Sample",null,null,null,null,null,null,null,null,"Code sample"],["ReferenceArchitecture",null,null,null,null,null,null,null,null,"Reference architecture"],["Tutorial",null,null,null,null,null,null,null,null,"Tutorial"]]],["category","Choose a topic",[["AiAndMachineLearning",null,null,null,null,null,null,null,null,"Artificial intelligence and machine learning (AI/ML)"],["ApplicationDevelopment",null,null,null,null,null,null,null,null,"Application development"],["BigDataAndAnalytics",null,null,null,null,null,null,null,null,"Big data and analytics"],["Compute",null,null,null,null,null,null,null,null,"Compute"],["Containers",null,null,null,null,null,null,null,null,"Containers"],["Databases",null,null,null,null,null,null,null,null,"Databases"],["HybridCloud",null,null,null,null,null,null,null,null,"Hybrid and multicloud"],["LoggingAndMonitoring",null,null,null,null,null,null,null,null,"Logging and monitoring"],["Migrations",null,null,null,null,null,null,null,null,"Migrations"],["Networking",null,null,null,null,null,null,null,null,"Networking"],["SecurityAndCompliance",null,null,null,null,null,null,null,null,"Security and compliance"],["Serverless",null,null,null,null,null,null,null,null,"Serverless"],["Storage",null,null,null,null,null,null,null,null,"Storage"]]]]]],[1],null,1],[[null,null,null,null,null,["GTM-5CVQBG"],null,null,null,null,null,[["GTM-5CVQBG",2]],1],null,null,null,null,null,1],"mwETRvWii0eU5NUYprb0Y9z5GVbc",4,null,null,null,null,null,null,null,null,null,null,null,null,null,"cloud.devsite.google"],null,"pk_live_5170syrHvgGVmSx9sBrnWtA5luvk9BwnVcvIi7HizpwauFG96WedXsuXh790rtij9AmGllqPtMLfhe2RSwD6Pn38V00uBCydV4m",1]') </script> <devsite-a11y-announce></devsite-a11y-announce> </body> </html>

CINXE.COM

Manage API keys | Authentication | Google Cloud