Dataform 用戶端程式庫提供高階語言支援，可透過程式輔助方式向 Dataform 進行驗證。為驗證對 Google Cloud API 的呼叫，用戶端程式庫支援應用程式預設憑證 (ADC)；程式庫會在定義的一組位置中尋找憑證，並使用這些憑證驗證對 API 的要求。使用 ADC，您可以在各種環境 (例如本機開發或正式版) 中，為應用程式提供憑證，不必修改應用程式程式碼。
在多數情況下，您可以使用使用者憑證，從本機開發環境進行驗證。如果無法這麼做，或是需要測試指派給服務帳戶的權限，可以使用服務帳戶模擬功能。您必須具備 iam.serviceAccounts.getAccessToken 權限，這項權限包含在「服務帳戶權杖建立者」(roles/iam.serviceAccountTokenCreator) IAM 角色中。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eDataform offers programmatic access through client libraries and REST APIs, enabling automation and integration.\u003c/p\u003e\n"],["\u003cp\u003eApplication Default Credentials (ADC) are the recommended method for authentication, allowing consistent credential management across various environments.\u003c/p\u003e\n"],["\u003cp\u003eFor local development, you can set up authentication using user credentials, including ADC setup with the gcloud CLI, or through REST requests using the \u003ccode\u003egcloud auth print-access-token\u003c/code\u003e command.\u003c/p\u003e\n"],["\u003cp\u003eService account impersonation is available for testing service account permissions or when using user credentials isn't viable, requiring the \u003ccode\u003eiam.serviceAccounts.getAccessToken\u003c/code\u003e permission.\u003c/p\u003e\n"],["\u003cp\u003eOnce authenticated, Dataform uses Identity and Access Management (IAM) for authorization to control access to Google Cloud resources.\u003c/p\u003e\n"]]],[],null,["# Authenticate to Dataform\n\nThis document describes how to authenticate to Dataform programmatically. How\nyou authenticate to Dataform depends on the interface you use to access the API\nand the environment where your code is running.\n\n\nFor more information about Google Cloud authentication, see the\n[Authentication methods](/docs/authentication).\n\nAPI access\n----------\n\n\nDataform supports programmatic access. You can access the API in\nthe following ways:\n\n- [Client libraries](#client-libraries)\n- [REST](#rest)\n\n### Client libraries\n\n\nThe [Dataform client libraries](/dataform/docs/reference/libraries) provide\nhigh-level language support for authenticating to Dataform\nprogrammatically.\n\n\nTo authenticate calls to Google Cloud APIs, client libraries support\n[Application Default Credentials (ADC)](/docs/authentication/application-default-credentials);\nthe libraries look for credentials in a set of defined locations and use those credentials\nto authenticate requests to the API. With ADC, you can make\ncredentials available to your application in a variety of environments, such as local\ndevelopment or production, without needing to modify your application code.\n\n### REST\n\n\nYou can authenticate to\n[the Dataform API](/dataform/reference/rest)\nby using your gcloud CLI credentials or by using\n[Application Default Credentials](/docs/authentication/application-default-credentials).\nFor more information about authentication for REST requests, see\n[Authenticate for using REST](/docs/authentication/rest).\nFor information about the types of credentials, see\n[gcloud CLI credentials and ADC credentials](/docs/authentication/gcloud#gcloud-credentials).\n\nSet up authentication for Dataform\n----------------------------------\n\n\nHow you set up authentication depends on the environment where your code is running.\n\n\nThe following options for setting up authentication are the most commonly used. For more\noptions and information about authentication, see\n[Authentication methods](/docs/authentication).\n\n### For a local development environment\n\n\nYou can set up credentials for a local development environment in the following ways:\n\n- [User credentials for client libraries or third-party tools](#client-libs)\n- [User credentials for REST requests from the command line](#rest-requests)\n- [Service account impersonation](#sa-impersonation)\n\n#### Client libraries or third-party tools\n\n\nSet up\n[Application Default Credentials (ADC)](/docs/authentication/application-default-credentials)\nin your local environment:\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\nFor more information about working with ADC in a local environment, see\n[Set up ADC for a local development environment](/docs/authentication/set-up-adc-local-dev-environment).\n\n#### REST requests from the command line\n\n\nWhen you make a REST request from the command line,\nyou can use your gcloud CLI credentials by including\n[`gcloud auth print-access-token`](/sdk/gcloud/reference/auth/print-access-token)\nas part of the command that sends the request.\n\n\nThe following example lists service accounts for the specified project. You can use the\nsame pattern for any REST request.\n\n\nBefore using any of the request data,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your Google Cloud project ID.\n\nTo send your request, expand one of these options:\n\n#### curl (Linux, macOS, or Cloud Shell)\n\n\nExecute the following command:\n\n```\ncurl -X GET \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts\"\n```\n\n#### PowerShell (Windows)\n\n\nExecute the following command:\n\n```\n$cred = gcloud auth print-access-token\n$headers = @{ \"Authorization\" = \"Bearer $cred\" }\n\nInvoke-WebRequest `\n -Method GET `\n -Headers $headers `\n -Uri \"https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts\" | Select-Object -Expand Content\n```\n\n\nFor more information about authenticating using REST and gRPC, see\n[Authenticate for using REST](/docs/authentication/rest).\nFor information about the difference between your local ADC credentials and your\ngcloud CLI credentials, see\n[gcloud CLI authentication configuration and ADC configuration](/docs/authentication/gcloud#gcloud-credentials).\n\n#### Service account impersonation\n\n\nIn most cases, you can use your user credentials to authenticate from a local development\nenvironment. If that is not feasible, or if you need to test the permissions assigned to\na service account, you can use service account impersonation. You must have the\n`iam.serviceAccounts.getAccessToken` permission, which is included in the\n[Service Account Token Creator](/iam/docs/understanding-roles#iam.serviceAccountTokenCreator)\n(`roles/iam.serviceAccountTokenCreator`) IAM role.\n\n\nYou can set up the gcloud CLI to use service account impersonation by using the\n[`gcloud config set` command](/sdk/gcloud/reference/config): \n\n```bash\ngcloud config set auth/impersonate_service_account SERVICE_ACCT_EMAIL\n```\n\n\nFor select languages, you can use service account impersonation to create a local ADC file\nfor use by client libraries. This approach is supported only for the Go, Java, Node.js, and\nPython client libraries---it is not supported for the other languages.\nTo set up a local ADC file with service account impersonation, use the\n[`--impersonate-service-account` flag](/sdk/gcloud/reference#--impersonate-service-account)\nwith the [`gcloud auth application-default login` command](/sdk/gcloud/reference/auth/application-default/login): \n\n```bash\ngcloud auth application-default login --impersonate-service-account=SERVICE_ACCT_EMAIL\n```\n\n\nFor more information about service account impersonation, see\n[Use service account impersonation](/docs/authentication/use-service-account-impersonation).\n\nAccess control for Dataform\n---------------------------\n\n\nAfter you authenticate to Dataform, you must be authorized to access\nGoogle Cloud resources. Dataform uses\nIdentity and Access Management (IAM) for authorization.\n\n\nFor more information about the roles for Dataform, see\n[Access control with IAM](/dataform/docs/access-control).\nFor more information about IAM and authorization, see\n[IAM overview](/iam/docs/overview).\n\nWhat's next\n-----------\n\n- Learn about [Google Cloud authentication methods](/docs/authentication#auth-decision-tree).\n- See a list of [authentication use cases](/docs/authentication/use-cases)."]]
