To access Google Cloud products and services programmatically, you useCloud APIs. These APIs expose a simple JSON RESTinterface. The recommended way to access the Cloud APIs is to use theCloud Client Libraries.

Cloud Code makes it easy to add the Cloud Client Librariesfor the Cloud APIs and language you're using to your project. In the same view,you can search for samples for each API and easily incorporate samples into yourapplication.

Browsing Cloud APIs

To explore all available Google Cloud APIs:

1. ClickCloud Code and then expand theCloud APIssection.

   The Cloud APIs view groups Cloud APIs by category.

2. To view details of an API, click the API name. Details such as the servicename, status, installation instructions for client libraries, documentation,and code samples are displayed.

Enabling Cloud APIs

To enable Cloud APIs for a project using the API details page, follow thesesteps:

1. On the Cloud API details page, choose the project to enable the Cloud API for.
2. ClickEnable API. After the API is enabled, a message is displayed to confirm the change.

Adding client libraries to your project

In addition to exploring and enabling Cloud APIs using Cloud Code,you can add a language-specific client library to your project.

To install a client library, follow the instructions on the API details pagefor your language.

Using API samples

You can search for and use code samples for each API in the API browser.

1. ClickCloud Code and then expand theCloud APIssection.

2. To open the detail view, click the name of an API.

3. To view code samples for the API, clickCode Samples.

4. To filter the list of samples, type text to search for or choose aprogramming language from theLanguage list.

5. To view a sample, click the name of the sample. There are also options tocopy the sample to your clipboard or view the sample in GitHub.

Setting up authentication

After you've enabled the required APIs and added the necessary clientlibraries, you need to configure your application for it to be successfullyauthenticated. Your configuration depends on your type of development andthe platform you're running on.

After you complete the authentication steps, your application can authenticateand is ready to be deployed.

Local development

The Cloud Shell VM instance uses the Compute Engine defaultservice account (the service account Google Kubernetes Engine uses by default) as itsdefault service account. This means that when developing withCloud Code on Cloud Shell, you don't need to set up anyadditional configuration when working with client libraries. Your application isauthenticated and ready to run locally.

Local development with APIs that require a service account

Some APIs, such as the Cloud Translation API, require a service account withappropriate permissions to authenticate your requests. For more information, seeCreating and managing service accounts.

1. To open a terminal, clickTerminal>New Terminal.

2. Create a service account to authenticate your API requests:

   gcloudiamservice-accountscreate\SERVICE_ACCOUNT_ID\--projectPROJECT_ID

   Replace the following values:

   • SERVICE_ACCOUNT_ID: the service account ID
   • PROJECT_ID: the project ID

   To find these IDs, in Google Cloud, click theNavigation menu at thetop-left of the screen, hold your pointer overIAM & Admin and clickService Accounts.

   TheEmail column shows the uniqueSERVICE_ACCOUNT_ID andPROJECT_ID for each of your service accounts in thefollowing format:

   SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com

   For example: A service account email address ofmy-service-account@my-project.iam.gserviceaccount.com has the followingvalues:

   • SERVICE_ACCOUNT_ID:my-service-account
   • PROJECT_ID:my-project

3. Grant your service account the appropriate role. The following samplecommand grants the Cloud Translation API User role. To determine the role togrant, see the documentation for the Cloud API you're using.

   gcloudprojects\add-iam-policy-binding\PROJECT_ID\--member='serviceAccount:SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com'\--role='roles/cloudtranslate.user'

4. Create a service account key:

   gcloudiamservice-accountskeys\createkey.json--iam-account\SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com

5. Set the key as your default credentials:

   export\GOOGLE_APPLICATION_CREDENTIALS=key.json

6. Optional: To permit users toimpersonate the service account,run thegcloud iam service-accounts add-iam-policy-bindingcommand to grant a user the Service Account User role(roles/iam.serviceAccountUser) on the service account:

   gcloudiamservice-accountsadd-iam-policy-binding\SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com\--member="user:USER_EMAIL"\--role="roles/iam.serviceAccountUser"

   Replace the following values:

   • USER_EMAIL: the email address for the user

Remote development

Remote development with Secret Manager permissions enabled

If you're developing remotely, using a service account for authentication,and your application usessecrets, youneed to complete a few more steps in addition to theremote development instructions. These steps assign your Google service accounttherole required to access a particular Secret Manager secret:

1. ClickCloud Code and then expand theSecret Manager section.

   

2. Right-click the secret and selectEdit Permissions in Cloud console.This launches the Secret Manager configuration page for thatsecret in your web browser.

   

3. In Google Cloud console, clickPermissions and then clickAdd.

4. In theNew principals field, enter the name of your service account.

5. In theSelect a role field, choose theSecret Manager Secret Accessorrole.

6. ClickSave.

   Your service account now has permission to access this particular secret.