--- title: Google Cloud url: https://www.tines.com/stories/docs/credentials/workload-identity-federation/google-cloud/ updated: 2026-10-09T18:41:07+00:00 --- *[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Credentials](https://www.tines.com/llm/stories/docs/credentials.md) › [Workload identity Federation](https://www.tines.com/llm/stories/docs/credentials/workload-identity-federation.md)* # Google Cloud *[View on tines.com](https://www.tines.com/stories/docs/credentials/workload-identity-federation/google-cloud/)* ## Introduction A Google Cloud credential authenticates to Google Cloud through [workload identity federation](https://www.tines.com/docs/credentials/workload-identity-federation). Tines signs a short-lived token for the credential and Google exchanges it for a short-lived access token, so no service account key is stored in Tines. The federated identity can impersonate a service account, or you can grant it roles directly. You can create the credential with the Google Cloud connect flow, which walks you through the steps below, or manually by choosing **Manual creation** and the **GCP** credential type. Both show the same trust details. ## Creating a Google Cloud credential ### Step 1: Start the credential in Tines From the credentials page, select **New credential** and choose **Google Cloud**, or choose **Manual creation** and then **GCP**. Tines shows the credential's **Issuer URL** and **Subject**. Keep this open while you work in Google Cloud. ### Step 2: Create a workload identity pool and provider 1. In the Google Cloud console, open **IAM & Admin › Workload Identity Federation** and select **Create pool**. Name the pool. 2. Add a provider of type **OpenID Connect (OIDC)**. For **Issuer (URL)**, enter the credential's issuer URL. Skip the JWK file; Google fetches the keys from the issuer. Under **Audiences**, keep **Default audience**. 3. Under **Attribute mapping**, map `google.subject` to `assertion.sub`, then create the provider. ### Step 3: Grant this credential access On the pool's page, select **Grant access**. To act as a service account, choose **Grant access using service account impersonation**, select the service account, and filter principals by the **subject** attribute with the credential's subject. To grant roles to the federated identity directly instead, use the pool principal for this subject and leave the service account blank in the next step. Dismiss the "Configure your application" dialog Google offers afterwards; Tines does not use a credential file. ### Step 4: Enter the provider details In the connect flow, enter the **Project number**, **Pool ID**, and **Provider ID**, and optionally the **Service account email** to impersonate. In the manual form, enter the **Workload identity pool provider**, which is the provider's full resource name: `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/`. Optionally enter the **Service account to impersonate**. Leave it blank if you granted roles to the federated identity directly. ### Step 5: Save Saving verifies the connection by exchanging a token with Google. IAM changes made just now can take a minute to take effect; if verification fails, wait briefly and save again. ## Using a Google Cloud credential The credential's value is a Google access token with the `cloud-platform` scope, renewed automatically. Use it as a bearer token in the `Authorization` header of an HTTP Request action: ```json "Authorization": "Bearer <>" ``` The access the token carries is whatever you granted in Google Cloud IAM, either to the service account Tines impersonates or directly to the pool principal for this credential's subject. ## Test credentials A test credential has its own subject, the live subject with a `:test` suffix, so grant it access separately, typically in a non-production project. See [test credentials](https://www.tines.com/docs/credentials/workload-identity-federation#test-credentials).