This page shows you how to use theGoogle CloudsignBlob methodto create asignature from a string-to-sign or policy document. Signaturesare used as credentials in certains requests, such assigned URLs. Thisguide uses RSA keys for creating signatures.

Important: TheGoogle-managed service account keys used by thesignBlobmethod are rotated regularly. If you set an expiration time for a signature thatis greater than 12 hours and generate the signature using thesignBlob method,the signature is usable for at least 12 hours, but might stop working prior tothe expiration time due to key rotation. Signatures generated using thesignBlob method are best used for short-lived access to resources.

Before you begin

1. Enable the Service Account Credentials API.

   Roles required to enable APIs

   To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

   Enable the API

2. You must have theiam.serviceAccounts.signBlob permission for the serviceaccount that you use in this guide. Theiam.serviceAccounts.signBlobpermission is included in theroles/iam.serviceAccountTokenCreator role.

3. The service account that you use in this guide must have permission toperform the request encoded within the signature. For example, if thesignature will be used to read object data from a bucket, the serviceaccount must have permission to read the object data.

Create a signature

1. Have gcloud CLIinstalled and initialized, which lets you generate an access token for theAuthorization header.

2. Create a JSON file that contains the following information:

   {"payload":"REQUEST_INFORMATION"}

   Where:

   • REQUEST_INFORMATION is astring-to-sign or apolicy document. For both, content must be base64-encoded.

3. UsecURL to call the IAM API with asignBlob request:

   curl -X POST --data-binary @JSON_FILE_NAME \  -H "Authorization: Bearer $(gcloud auth print-access-token)" \  -H "Content-Type: application/json" \  "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/SERVICE_ACCOUNT_EMAIL:signBlob"

   Where:

   • JSON_FILE_NAME is the name of the file you createdin Step 2.

   • SERVICE_ACCOUNT_EMAIL is the email address of theservice account you want to use to create the signature. For example,example-service-account@my-pet-project.iam.gserviceaccount.com.

   If successful, amessage digest is returned in thesignedBlob field inthe response, which is base64 encoded.

4. To complete the signature, ensure the message digest is base64 decoded, andthen hex-encode the message digest.

What's next

• See the reference page for signing blobs with theGoogle Cloud CLI.
• Create a signed URL manually, using the signature you created.
• Create a signed URL with Google Cloud tools.
• Learn more aboutsignatures.