This page explains how to list and get service account keys using theGoogle Cloud console, theGoogle Cloud CLI,theIdentity and Access Management API, or oneof theGoogle Cloud Client Libraries.

Note: If you need to access resources from a workload that runs outside of Google Cloud, such as on Amazon Web Services (AWS) or Microsoft Azure, consider usingWorkload Identity Federation instead of service account keys. Federation lets your workloads access resources directly, using a short-lived access token, and eliminates the maintenance and security burden associated with service account keys.

Before you begin

• Enable the IAM API.

  Roles required to enable APIs

  To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

  Enable the API

• Set up authentication.

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

  gcloud

  In the Google Cloud console, activate Cloud Shell.

  Activate Cloud Shell

  At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  C#

  To use the .NET samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloudauthapplication-defaultlogin

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  C++

  To use the C++ samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloudauthapplication-defaultlogin

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  Go

  To use the Go samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloudauthapplication-defaultlogin

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  Java

  To use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloudauthapplication-defaultlogin

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  Python

  To use the Python samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  If you're using a local shell, then create local authentication credentials for your user account:

  gcloudauthapplication-defaultlogin

  You don't need to do this if you're using Cloud Shell.

  If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity.

  For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI.

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  For more information, seeAuthenticate for using REST in the Google Cloud authentication documentation.

• Understandservice account credentials.

Required roles

To get the permissions that you need to list and get service account keys, ask your administrator to grant you theView Service Accounts (roles/iam.serviceAccountViewer) IAM role on either the project or the service account whose keys youwant to manage. For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

For more information, seeService Accounts roles.

IAM basic roles also contain permissions to manage serviceaccount keys. You should not grant basic roles in a production environment, but you can grant them in adevelopment or test environment.

List service account keys

You can list the service account keys for a service account using theGoogle Cloud console, the gcloud CLI, theserviceAccount.keys.list()method, or one of theclient libraries.

TheserviceAccount.keys.list() method is commonly used to audit serviceaccounts and keys, or to build custom tooling for managing service accounts.

To find out which project your key belongs to, you can download the key as aJSON file and look at that file.

You might see keys listed that you did not create. These are keys created byGoogle and used by the Service Account Credentials API. To learn more, seeGoogle-owned and managed key pairs.

gcloud iam service-accounts keys list \    --iam-account=SA_NAME@PROJECT_ID.iam.gserviceaccount.com

namespaceiam=::google::cloud::iam_admin_v1;[](std::stringconst&service_account_name,std::vector<std::string>const&key_type_labels){iam::IAMClientclient(iam::MakeIAMConnection());std::vector<google::iam::admin::v1::ListServiceAccountKeysRequest::KeyType>key_types;for(autoconst&type:key_type_labels){if(type=="USER_MANAGED"){key_types.push_back(google::iam::admin::v1::ListServiceAccountKeysRequest::USER_MANAGED);}elseif(type=="SYSTEM_MANAGED"){key_types.push_back(google::iam::admin::v1::ListServiceAccountKeysRequest::SYSTEM_MANAGED);}}autoresponse=client.ListServiceAccountKeys(service_account_name,key_types);if(!response)throwstd::move(response).status();std::cout <<"ServiceAccountKeys successfully retrieved: "            <<response->DebugString() <<"\n";}

usingSystem;usingSystem.Collections.Generic;usingGoogle.Apis.Auth.OAuth2;usingGoogle.Apis.Iam.v1;usingGoogle.Apis.Iam.v1.Data;publicpartialclassServiceAccountKeys{publicstaticIList<ServiceAccountKey>ListKeys(stringserviceAccountEmail){varcredential=GoogleCredential.GetApplicationDefault().CreateScoped(IamService.Scope.CloudPlatform);varservice=newIamService(newIamService.Initializer{HttpClientInitializer=credential});varresponse=service.Projects.ServiceAccounts.Keys.List($"projects/-/serviceAccounts/{serviceAccountEmail}").Execute();foreach(ServiceAccountKeykeyinresponse.Keys){Console.WriteLine("Key: "+key.Name);}returnresponse.Keys;}}

import("context""fmt""io"iam"google.golang.org/api/iam/v1")// listKey lists a service account's keys.funclistKeys(wio.Writer,serviceAccountEmailstring)([]*iam.ServiceAccountKey,error){ctx:=context.Background()service,err:=iam.NewService(ctx)iferr!=nil{returnnil,fmt.Errorf("iam.NewService: %w",err)}resource:="projects/-/serviceAccounts/"+serviceAccountEmailresponse,err:=service.Projects.ServiceAccounts.Keys.List(resource).Do()iferr!=nil{returnnil,fmt.Errorf("Projects.ServiceAccounts.Keys.List: %w",err)}for_,key:=rangeresponse.Keys{fmt.Fprintf(w,"Listing key: %v",key.Name)}returnresponse.Keys,nil}

importcom.google.cloud.iam.admin.v1.IAMClient;importcom.google.iam.admin.v1.ListServiceAccountKeysRequest;importcom.google.iam.admin.v1.ServiceAccountKey;importjava.io.IOException;importjava.util.List;publicclassListServiceAccountKeys{publicstaticvoidmain(String[]args)throwsIOException{// TODO(Developer): Replace the below variables before running.StringprojectId="your-project-id";StringserviceAccountName="your-service-account-name";List<ServiceAccountKey>keys=listKeys(projectId,serviceAccountName);keys.forEach(key->System.out.println("Key: "+key.getName()));}// Lists all keys for a service account.publicstaticList<ServiceAccountKey>listKeys(StringprojectId,StringaccountName)throwsIOException{// Initialize client that will be used to send requests.// This client only needs to be created once, and can be reused for multiple requests.Stringemail=String.format("%s@%s.iam.gserviceaccount.com",accountName,projectId);try(IAMClientiamClient=IAMClient.create()){ListServiceAccountKeysRequestreq=ListServiceAccountKeysRequest.newBuilder().setName(String.format("projects/%s/serviceAccounts/%s",projectId,email)).build();returniamClient.listServiceAccountKeys(req).getKeysList();}}}

fromtypingimportListfromgoogle.cloudimportiam_admin_v1fromgoogle.cloud.iam_admin_v1importtypesdeflist_keys(project_id:str,account:str)->List[iam_admin_v1.ServiceAccountKey]:"""Lists a key for a service account.    project_id: ID or number of the Google Cloud project you want to use.    account: ID or email which is unique identifier of the service account.    """iam_admin_client=iam_admin_v1.IAMClient()request=types.ListServiceAccountKeysRequest()request.name=f"projects/{project_id}/serviceAccounts/{account}"response=iam_admin_client.list_service_account_keys(request=request)returnresponse.keys

GET https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys?keyTypes=KEY_TYPES

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys?keyTypes=KEY_TYPES"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys?keyTypes=KEY_TYPES" | Select-Object -Expand Content

{  "keys": [    {      "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/90c48f61c65cd56224a12ab18e6ee9ca9c3aee7c",      "validAfterTime": "2020-03-04T17:39:47Z",      "validBeforeTime": "9999-12-31T23:59:59Z",      "keyAlgorithm": "KEY_ALG_RSA_2048",      "keyOrigin": "GOOGLE_PROVIDED",      "keyType": "USER_MANAGED"    },    {      "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/e5e3800831ac1adc8a5849da7d827b4724b1fce8",      "validAfterTime": "2020-03-31T23:50:09Z",      "validBeforeTime": "9999-12-31T23:59:59Z",      "keyAlgorithm": "KEY_ALG_RSA_2048",      "keyOrigin": "GOOGLE_PROVIDED",      "keyType": "USER_MANAGED"    },    {      "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/b97699f042b8eee6a846f4f96259fbcd13e2682e",      "validAfterTime": "2020-05-17T18:58:13Z",      "validBeforeTime": "9999-12-31T23:59:59Z",      "keyAlgorithm": "KEY_ALG_RSA_2048",      "keyOrigin": "GOOGLE_PROVIDED",      "keyType": "USER_MANAGED",      "disabled": true      "disable_reason": "SERVICE_ACCOUNT_KEY_DISABLE_REASON_EXPOSED"      "extended_status": "SERVICE_ACCOUNT_KEY_EXTENDED_STATUS_KEY_EXPOSED"      "extended_status_message": "exposed at: https://www.github.com/SomePublicRepo"    }  ]}

Get a service account key

You can use the gcloud CLI or the REST API to get the public key datafor a service account key. In addition, you can use the Google Cloud console,the gcloud CLI, or the REST API to get metadata for the key, such asthe algorithm that the key uses and whether the key is managed by you or byGoogle.

Some applications or tools might need access to the public key data or metadatafor a service account key for things like auditing and interoperability withexternal systems. For example,Terraformmight need to verify that the state of a service account key in Google Cloudmatches what's defined in the Terraform configuration file.

gcloudbetaiamservice-accountskeysget-public-keyKEY_ID\--iam-account=SA_NAME@PROJECT_ID.iam.gserviceaccount.com\--output-file=FILENAME

gcloudbetaiamservice-accountskeysget-public-key\c97cc34494c07c9b483701f28368f20145b9ef97\--iam-account=my-service-account@my-project.iam.gserviceaccount.com\--output-file=public_key.pem

gcloudiamservice-accountskeyslist--iam-account=SA_NAME\--filter="name~KEY_ID"--format=json

gcloudiamservice-accountskeyslist\--iam-account=my-service-account@my-project.iam.gserviceaccount.com\--filter="name~c97cc34494c07c9b483701f28368f20145b9ef97"--format=json

GET https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID?publicKeyType=KEY_TYPE

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID?publicKeyType=KEY_TYPE"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID?publicKeyType=KEY_TYPE" | Select-Object -Expand Content

{  "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/f4a83933ac07cf52bb74e0e66d99662a09f51a36",  "validAfterTime": "2021-12-10T17:32:06Z",  "validBeforeTime": "9999-12-31T23:59:59Z",  "publicKeyData": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvRENDQWVTZ0F3SUJBZ0lJT2lCdm9hR09nV0F3RFFZSktvWklodmNOQVFFRkJRQXdJREVlTUJ3R0ExVUUKQXhNVk1UQXhNVGsxTlRFMk5UWXlPRGszTmpFek1qQXpNQ0FYRFRJeE1USXhNREUzTXpJd05sb1lEems1T1RreApNak14TWpNMU9UVTVXakFnTVI0d0hBWURWUVFERXhVeE1ERXhPVFUxTVRZMU5qSTRPVGMyTVRNeU1ETXdnZ0VpCk1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQzdzeDBFcXVUMGNwSXhlczl1SW0yRy9DS3EKdnc4YTl2a2JkaWZZbDZHSDh1ZUxEWDhGNHVUeEVQMkNzU3JLTHZtOFo2My9IVUxnWjBtQXByb0JlM08vaVR1ZwpmYVZ0NVNtakhvWm9YQ1lpbjR0MS93SkpvdDhrRFdPeDZhOEdieUdqZ215ak8yYk1XdEtaQ2dqeGZ3cUV0MmN3CklnajA5VzJKYTlHTWRsdVA0VGVubTRKSkJoaFpFbTJ1bVAwYVZZdkRnUWF5d0RCYnJuNG8yY0EzSWplRDZGM1gKK0VHRDNKU0s4VW02Sk5sM21adGp6VWNZSHBrYkF0U1A2ZDI5d1RmZkdIRFY0THJRWlM3bG15d3hsb3p5WnpaawpCOFpHckMzSkF1MVNVRTdQOTN6bWtFb1B6MlRUNWhaYXZMWFQ5TGM2SExiRklRVHFnVEJVWHlNMkpIcGZBZ01CCkFBR2pPREEyTUF3R0ExVWRFd0VCL3dRQ01BQXdEZ1lEVlIwUEFRSC9CQVFEQWdlQU1CWUdBMVVkSlFFQi93UU0KTUFvR0NDc0dBUVVGQndNQ01BMEdDU3FHU0liM0RRRUJCUVVBQTRJQkFRQkhPNXlpUDY3NkE4UEN2RjdRSzdFMApYZVljbzdsSStFZkowaGJrWVlmdUtnSENPcXcvd3FBbCtOSithanljT2FPWDFPMlRZN3ZOc05pR2t3eWc2QXdqCklhL1NHVjd3NkxpS2JldFRuSVp4UlhRY25lcnVvZEwycUR5eWphMDJJSXJVTmVKY1o0MVJBNXRTL3NkcTFGNm4KM0NjSXFoZTI1OTA4TUNna3cwaFB1K0VLbFF6R1B5T3pVRHBLdXg0cnRBaHJTYTBUVW1wbEMxdTJnUk1YRkF6aApWUjU0V2dNa2tabURyalBNeWdBS3JmNkd0bHo2VHRTYTVLb1BWdGpsWExUQkxaSnlhdk4zc1F2dFlBK1NFQWpWCnA1N1ZabFBYZmR0dWN4ekJaOC9zS25SOHNyYU5hVWFjamg1NEE1Nm1URTE3b0IyUWkrTHBJUTYvNnVqVnNXaUYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=",  "keyAlgorithm": "KEY_ALG_RSA_2048",  "keyOrigin": "GOOGLE_PROVIDED",  "keyType": "USER_MANAGED"}

What's next

• Learn how tocreate and delete service account keys.
• Learn how todisable and enable service account keys.
• Learn aboutalternatives to service account keys for authentication.
• Learn how to use service account keys toauthenticate as a serviceaccount.
• Understand thebest practices for managing service accountkeys.