Authenticate users with Google Accounts

This page walks you through deploying an App Engine standard or flexibleenvironment application and securing it withIdentity-Aware Proxy(IAP). The quickstart includessample code for an App Engine standard environment web app thatverifies a logged-in user'sname. This quickstart uses Cloud Shell to clone and deploy the sampleapplication. You can use this quickstart to enable IAP foryour own App Engine standard environment orApp Engine flexible environment app.

If you plan to serve resources from a content delivery network (CDN), see thebest practices guidefor important information.

When an App Engine application consists of multiple services, it ispossible to configure different IAP permissions on thedifferent services, including making only some of the servicespublicly-accessible while keeping the others protected.

To follow step-by-step guidance for this task directly in the Google Cloud console, clickGuide me:

Guide me

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.
    Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.
    Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

    Go to project selector

  5. Verify that billing is enabled for your Google Cloud project.

Before you begin

To enable IAP for App Engine, you need thefollowing:

  • A Google Cloud console project with billing enabled.

If you don't have your App Engine instance set up already, seeDeploying App Enginefor a complete walkthrough.

IAP uses a Google-managed OAuth client to authenticate users.Only users within the organization can access the IAP-enabled application.If you want to allow access to users outside of your organization, seeEnable IAP for external applications.

Note: The ability to authenticate users with a Google-managed OAuth client is available inPreview.

Enabling IAP

Console

The Google-managed OAuth client is not available when enabling IAP using the Google Cloud console.

Dynamic include file

If you haven't configured your project's OAuth consent screen, you'll beprompted to do so. To configure your OAuth consent screen, seeSetting up your OAuth consent screen.

Setting up IAP access

  1. Go to theIdentity-Aware Proxy page.
    Go to the Identity-Aware Proxy page
  2. Select the project you want to secure with IAP.
  3. Select the checkbox next to the resource you want to grant access to.
  4. On the right side panel, clickAdd principal.
  5. In theAdd principals dialog that appears, enter the email addresses of groups or individuals who should have theIAP-secured Web App User role for the project.

    The following kinds of principals can have this role:

    • Google Account: user@gmail.com
    • Google Group: admins@googlegroups.com
    • Service account: server@example.gserviceaccount.com
    • Google Workspace domain: example.com

    Make sure to add a Google Account that you have access to.

  6. SelectCloud IAP > IAP-secured Web App User from theRoles drop-down list.
  7. ClickSave.

Turning on IAP

  1. On theIdentity-Aware Proxy page, underAPPLICATIONS, find the application you want to restrict access to. To turn on IAP for a resource,
  2. In theTurn on IAP window that appears, clickTurn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with theIAP-Secured Web App User role on the project will be given access.

gcloud

Before you set up your project and IAP, you need an up-to-date version of the gcloud CLI. For instructions on how to install the gcloud CLI, seeInstall the gcloud CLI.

  1. To authenticate, use the Google Cloud CLI and run the following command.
    gcloud auth login
  2. Click the URL that appears and sign in.
  3. After you sign in, copy the verification code that appears and paste it in the command line.
  4. Run the following command to specify the project that contains the applications that you want to protect with IAP.
    gcloud config set projectPROJECT_ID
  5. To enable IAP, run the following command.
    gcloud iap web enable --resource-type=app-engine --versions=version
  6. Add principals who should have the IAP-secured Web App user role to the project.
    gcloud projects add-iam-policy-bindingPROJECT_ID \       --member=PRINCIPAL_IDENTIFIER \       --role=roles/iap.httpsResourceAccessor
    • ReplacePROJECT_ID with your project ID.
    • ReplacePRINCIPAL_IDENTIFIER with the necessary principals. This can be a type of domain, group, serviceAccount, or user. For example,user:myemail@example.com.

After you enable IAP, you can use the gcloud CLI to modify theIAP access policy using the IAM roleroles/iap.httpsResourceAccessor. Learn more aboutmanaging roles and permissions.

API

  1. Run the following command to prepare asettings.json file.

    cat << EOF > settings.json{"iap":  {    "enabled":true  }}EOF

  2. Run the following command to enable IAP.

    curl -X PATCH \-H "Authorization: Bearer $(gcloud auth print-access-token)" \-H "Accept: application/json" \-H "Content-Type: application/json" \-d @settings.json \"https://appengine.googleapis.com/v1/apps/PROJECT_ID?updateMask=iap"

After you enable IAP, you can use the Google Cloud CLI to modify theIAP access policy using the IAM roleroles/iap.httpsResourceAccessor. Learn more aboutmanaging roles and permissions.

Note: When a App Engine application consists of multiple services, in order to make some services publicly-accessible and keep others restricted, enable IAP on the entire application, then grant theIAP-secured Web App User role to `allUsers` or `allAuthenticatedUsers` on the services that should be publicly-accessible.Role-based access: If you're a project owner, you may think that you get automatic access to the app. That is not the case as only accounts with theIAP-secured Web App User role on this project will be given access. Imagine you're in corporate IT implementing IAP access to the HR payroll system. In most scenarios, only the staff on the Payroll team should have access to the app. This is one of the reasons why role-based access is more secure. The owner (or editor, etc.) of a project can manage all aspects of the project but doesn't automatically get app access.

Test user authentication

  1. Access the app URL from a Google account that you added toIAP with theIAP-secured Web App User roleas described above. You should have unrestricted access to the app.

  2. Use an incognito window in Chrome to access the app and sign in whenprompted. If you try to access the app with an account that isn't authorizedwith theIAP-secured Web App User role, you'll see a messagesaying that you don't have access.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.