This page explains how to disable and enable service account keys using theGoogle Cloud console, theGoogle Cloud CLI,theIdentity and Access Management API, or oneof theGoogle Cloud Client Libraries.

If you acquired the service account key from an external source, you must validate it before use.For more information, see Security requirements for externally sourced credentials.

Before you begin

• Enable the IAM API.

  Roles required to enable APIs

  To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

  Enable the API

• Set up authentication.

  Select the tab for how you plan to use the samples on this page:

  gcloud

  In the Google Cloud console, activate Cloud Shell.

  Activate Cloud Shell

  At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  Java

  To use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloudauthapplication-defaultlogin

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  For more information, seeAuthenticate for using REST in the Google Cloud authentication documentation.

• Understandservice account credentials.

Required roles

To get the permissions that you need to disable and enable service account keys, ask your administrator to grant you theService Account Key Admin (roles/iam.serviceAccountKeyAdmin) IAM role on the project, or the service account whose keys you wantto manage. For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

For more information, seeService Accounts roles.

IAM basic roles also contain permissions to manage serviceaccount keys. You should not grant basic roles in a production environment, but you can grant them in adevelopment or test environment.

Disable a service account key

Disabling a service account key prevents you from using the key to authenticatewith Google APIs. You canenable a disabled key at any time.

Before youdelete a service account key, we recommend that youdisable the key, then wait until you are sure that the key is no longer needed.You can then delete the key.

You can view disabled keys in the Google Cloud console, but you cannot use theGoogle Cloud console to disable a key. Use the gcloud CLI or theREST API instead.

gcloudiamservice-accountskeysdisableKEY_ID\--iam-account=SA_NAME@PROJECT_ID.iam.gserviceaccount.com\--project=PROJECT_ID

Disabled key [KEY_ID] for service account[SA_NAME@PROJECT_ID.iam.gserviceaccount.com]

importcom.google.cloud.iam.admin.v1.IAMClient;importjava.io.IOException;publicclassDisableServiceAccountKey{publicstaticvoidmain(String[]args)throwsIOException{// TODO(Developer): Replace the below variables before running.StringprojectId="gcloud-project-id";StringserviceAccountName="service-account-name";StringserviceAccountKeyName="service-account-key-name";disableServiceAccountKey(projectId,serviceAccountName,serviceAccountKeyName);}// Disables a service account key.publicstaticvoiddisableServiceAccountKey(StringprojectId,StringaccountName,Stringkey)throwsIOException{// Construct the service account email.// You can modify the ".iam.gserviceaccount.com" to match the service account name in which// you want to disable the key.// See, https://cloud.google.com/iam/docs/creating-managing-service-account-keys#disablingStringemail=String.format("%s@%s.iam.gserviceaccount.com",accountName,projectId);Stringname=String.format("projects/%s/serviceAccounts/%s/keys/%s",projectId,email,key);// Initialize client that will be used to send requests.// This client only needs to be created once, and can be reused for multiple requests.try(IAMClientiamClient=IAMClient.create()){iamClient.disableServiceAccountKey(name);System.out.println("Disabled service account key: "+name);}}}

POST https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID:disable

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d "" \
     "https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID:disable"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -Uri "https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID:disable" | Select-Object -Expand Content

{}

Enable a service account key

After you disable a service account key, you can enable the key at any time,then use the key to authenticate with Google APIs.

You cannot use the Google Cloud console to enable service account keys. Usethe gcloud CLI or the REST API instead.

gcloudiamservice-accountskeysenableKEY_ID\--iam-account=SA_NAME@PROJECT_ID.iam.gserviceaccount.com\--project=PROJECT_ID

Enabled key [KEY_ID] for service account[SA_NAME@PROJECT_ID.iam.gserviceaccount.com]

importcom.google.cloud.iam.admin.v1.IAMClient;importjava.io.IOException;publicclassEnableServiceAccountKey{publicstaticvoidmain(String[]args)throwsIOException{// TODO(Developer): Replace the below variables before running.StringprojectId="gcloud-project-id";StringserviceAccountName="service-account-name";StringserviceAccountKeyName="service-account-key-name";enableServiceAccountKey(projectId,serviceAccountName,serviceAccountKeyName);}// Enables a service account key.publicstaticvoidenableServiceAccountKey(StringprojectId,StringaccountName,Stringkey)throwsIOException{// Construct the service account email.// You can modify the ".iam.gserviceaccount.com" to match the service account name in which// you want to enable the key.// See, https://cloud.google.com/iam/docs/creating-managing-service-account-keys#enablingStringemail=String.format("%s@%s.iam.gserviceaccount.com",accountName,projectId);Stringname=String.format("projects/%s/serviceAccounts/%s/keys/%s",projectId,email,key);// Initialize client that will be used to send requests.// This client only needs to be created once, and can be reused for multiple requests.try(IAMClientiamClient=IAMClient.create()){iamClient.enableServiceAccountKey(name);System.out.println("Enabled service account key: "+name);}}}

POST https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID:enable

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d "" \
     "https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID:enable"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -Uri "https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID:enable" | Select-Object -Expand Content

{}

What's next

• Learn how todelete service account keys.
• Learn how tolist and get service account keys.
• Learn how to use service account keys toauthenticate as a serviceaccount.
• Learn aboutalternatives to service account keys for authentication.
• Understand thebest practices for managing service accountkeys.