이 페이지에서는 Google Distributed Cloud (GDC) 에어갭에서 Vertex AI 서비스에 대한 호출을 인증하는 방법을 설명합니다. 에어갭 애플리케이션 내에서 Vertex AI API에 대한 요청을 보호하려면 토큰 인증을 설정해야 합니다. 이 프로세스는 ID를 제공하고 상호작용을 승인하여 API 요청을 검증합니다.
이 페이지는 AI 기능을 사용 설정하기 위해 애플리케이션 및 개발 환경을 설정하는 애플리케이션 운영자 그룹 내 애플리케이션 개발자를 위한 페이지입니다. 자세한 내용은 GDC 오프라인 문서 대상을 참고하세요.
PATH_TO_SERVICE_KEY를 서비스 계정의 키 쌍이 포함된 JSON 파일의 경로로 바꿉니다.
google-auth 클라이언트 라이브러리를 설치합니다.
pipinstallgoogle-auth
Python 스크립트에 다음 코드를 추가합니다.
importosimportgoogle.authfromgoogle.auth.transportimportrequestsimportrequestsasreqsos.environ["GOOGLE_APPLICATION_CREDENTIALS"]="PATH_TO_SERVICE_KEY"os.environ["GRPC_DEFAULT_SSL_ROOTS_FILE_PATH"]="CERT_NAME"# If you use a client library for your request,# you must include port :443 after the service endpoint# in the audience path.audience="https://ENDPOINT"creds,project_id=google.auth.default()print(project_id)creds=creds.with_gdch_audience(audience)deftest_get_token():sesh=reqs.Session()req=requests.Request(session=sesh)creds.refresh(req)print(creds.token)if__name__=="__main__":test_get_token()
다음을 바꿉니다.
PATH_TO_SERVICE_KEY: 서비스 계정의 키 쌍이 포함된 JSON 파일의 경로입니다.
CERT_NAME: 인증 기관(CA) 인증서 파일의 이름(예: org-1-trust-bundle-ca.cert) 개발 환경에 있는 경우에만 이 값이 필요합니다. 그렇지 않으면 생략합니다.
ENDPOINT: 조직에서 사용하는 API 엔드포인트입니다. 자세한 내용은 서비스 상태 및 엔드포인트 보기를 참고하세요. 인증 토큰의 용도에 따라 다음과 같이 대상 경로의 서비스 엔드포인트 뒤에 포트를 포함해야 할 수 있습니다.
요청에 클라이언트 라이브러리를 사용하는 경우 대상 경로의 서비스 엔드포인트 뒤에 포트 :443를 포함해야 합니다. 따라서 스크립트의 audience 경로는 "https://ENDPOINT:443"이어야 합니다.
요청에 gRPC, curl 또는 프로그래매틱 REST 호출을 사용하는 경우 포트를 포함하지 마세요. 따라서 스크립트의 audience 경로는 "https://ENDPOINT"이어야 합니다.
Python 스크립트를 저장합니다.
Python 스크립트를 실행하여 토큰을 가져옵니다.
pythonSCRIPT_NAME
SCRIPT_NAME을 Python 스크립트에 지정한 이름(예: token.py)으로 바꿉니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis guide details the process of obtaining authentication tokens for accessing Vertex AI APIs on Google Distributed Cloud (GDC) air-gapped.\u003c/p\u003e\n"],["\u003cp\u003eAuthentication can be performed using either a user account or a service account, each with its own distinct set of steps.\u003c/p\u003e\n"],["\u003cp\u003eTo obtain a user account token, you must log in to Distributed Cloud and run a command that includes the relevant service endpoint.\u003c/p\u003e\n"],["\u003cp\u003eTo obtain a service account token, you'll use a python script that sets the relevant environmental variables and uses the \u003ccode\u003egoogle-auth\u003c/code\u003e client library, referencing the service key and relevant endpoint.\u003c/p\u003e\n"],["\u003cp\u003eThe obtained authentication token is then added to the header of your API requests as an authorization bearer token.\u003c/p\u003e\n"]]],[],null,["# Authenticate Vertex AI API requests\n\nThis page describes how to authenticate calls to Vertex AI services on Google Distributed Cloud (GDC) air-gapped. You must set up token authentication to secure your requests to the Vertex AI API within your air-gapped applications. This process validates your API requests by providing your identity and authorizing your interactions.\n\n\u003cbr /\u003e\n\nThis page is for application developers within application operator groups responsible for setting up their application and development environments to enable AI features. For more information, see [Audiences for GDC air-gapped documentation](/distributed-cloud/hosted/docs/latest/gdch/resources/audiences).\n\nBefore you begin\n----------------\n\nYou must have your project set up for Vertex AI. For more information, see [Set up a project for Vertex AI](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-set-up-project).\n\n- Make sure to update your local trust store before you set up authentication in your development environment.\n\nAuthenticating to Vertex AI services\n------------------------------------\n\nInteractions with Vertex AI services are done through authentication tokens. Tokens are digital objects that verify your identity and authorization after you provide valid credentials. The token carries specific information about your account and the permissions it has to access and operate with services and resources.\n\nThere are two ways you can set up authentication:\n\n- [Authenticate with your user account](#authenticate-with-user-account)\n- [Authenticate with your service account](#authenticate-with-service-account)\n\n### Authenticate with your user account\n\nThe following guides you through getting an authentication token for your user account:\n\n1. Note [the endpoint of the API](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-api-status) you want to use.\n\n2. Gain access to the Vertex AI service or Generative AI model you want to use by granting your user account the corresponding role listed in [Prepare IAM permissions](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-ao-permissions).\n\n3. Sign in to Distributed Cloud with the user account you have to interact with the API:\n\n gdcloud auth login\n\n4. Get the authentication token:\n\n gdcloud auth print-identity-token --audiences=https://\u003cvar translate=\"no\"\u003eENDPOINT\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eENDPOINT\u003c/var\u003e with the API endpoint that you use for your organization. For more information, [view service status and endpoints](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-api-status).\n\n Depending on the intended use of the authentication token, you might need to include the port after the service endpoint in the audiences path as follows:\n - If you use a [client library](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-install-libraries) for your request, you must include port `:443` after the service endpoint in the audiences path. Therefore, the `--audiences` path in the command must be `https://`\u003cvar translate=\"no\"\u003eENDPOINT\u003c/var\u003e`:443`.\n - If you use gRPC, `curl`, or programmatic REST calls for your request, don't include the port. Therefore, the `--audiences` path in the command must be `https://`\u003cvar translate=\"no\"\u003eENDPOINT\u003c/var\u003e.\n\n The output displays the authentication token. Add the token to the header of the command-line requests you make, as in the following example: \n\n -H \"Authorization: Bearer \u003cvar translate=\"no\"\u003eTOKEN\u003c/var\u003e\"\n\n Replace \u003cvar translate=\"no\"\u003eTOKEN\u003c/var\u003e with the value for the authentication token that the output displays.\n\n### Authenticate with your service account\n\nThe following guides you through getting an authentication token for your service account:\n\n1. Note [the endpoint of the API](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-api-status) you want to use.\n\n2. [Set up the service account](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-set-up-project#set-up-service) you want to use to access the Vertex AI service or Generative AI model.\n\n3. Grant the service account the corresponding role listed in [Prepare IAM permissions](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-ao-permissions) to let it gain access to the service or model you want to use.\n\n4. [Get the service key pairs of your service account](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/iam/service-identities#list_credentials_for_service_accounts).\n\n5. Set the following environment variable:\n\n export GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003ePATH_TO_SERVICE_KEY\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePATH_TO_SERVICE_KEY\u003c/var\u003e with the path to the JSON\n file that contains the key pairs of your service account.\n6. Install the `google-auth` client library:\n\n pip install google-auth\n\n7. Add the following code to a Python script:\n\n import os\n import google.auth\n from google.auth.transport import requests\n import requests as reqs\n\n os.environ[\"GOOGLE_APPLICATION_CREDENTIALS\"] = \"\u003cvar translate=\"no\"\u003ePATH_TO_SERVICE_KEY\u003c/var\u003e\"\n os.environ[\"GRPC_DEFAULT_SSL_ROOTS_FILE_PATH\"] = \"\u003cvar translate=\"no\"\u003eCERT_NAME\u003c/var\u003e\"\n\n # If you use a client library for your request,\n # you must include port :443 after the service endpoint\n # in the audience path.\n audience = \"https://\u003cvar translate=\"no\"\u003eENDPOINT\u003c/var\u003e\"\n\n creds, project_id = google.auth.default()\n print(project_id)\n creds = creds.with_gdch_audience(audience)\n\n def test_get_token():\n sesh = reqs.Session()\n req = requests.Request(session=sesh)\n creds.refresh(req)\n print(creds.token)\n\n if __name__==\"__main__\":\n test_get_token()\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePATH_TO_SERVICE_KEY\u003c/var\u003e: the path to the JSON file that contains the key pairs of your service account.\n - \u003cvar translate=\"no\"\u003eCERT_NAME\u003c/var\u003e: the name of the Certificate Authority (CA) certificate file, such as `org-1-trust-bundle-ca.cert`. You only need this value if you are in a development environment. Otherwise, omit it.\n - \u003cvar translate=\"no\"\u003eENDPOINT\u003c/var\u003e: the API endpoint that you use for your organization. For more information, [view service status and endpoints](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-api-status). Depending on the intended use of the authentication token, you might need to include the port after the service endpoint in the audience path as follows:\n\n - If you use a [client library](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vertex-ai-install-libraries) for your request, you must include port `:443` after the service endpoint in the audience path. Therefore, the `audience` path in the script must be `\"https://`\u003cvar translate=\"no\"\u003eENDPOINT\u003c/var\u003e`:443\"`.\n - If you use gRPC, `curl`, or programmatic REST calls for your request, don't include the port. Therefore, the `audience` path in the script must be `\"https://`\u003cvar translate=\"no\"\u003eENDPOINT\u003c/var\u003e`\"`.\n8. Save the Python script.\n\n9. Run the Python script to fetch the token:\n\n python \u003cvar translate=\"no\"\u003eSCRIPT_NAME\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eSCRIPT_NAME\u003c/var\u003e with the name you gave to your Python script, such as `token.py`.\n\n The output displays the authentication token. Add the token to the header of the command-line requests you make, as in the following example: \n\n -H \"Authorization: Bearer \u003cvar translate=\"no\"\u003eTOKEN\u003c/var\u003e\"\n\n Replace \u003cvar translate=\"no\"\u003eTOKEN\u003c/var\u003e with the value for the authentication token that the output displays."]]
