Authenticate using REST

Stay organized with collections Save and categorize content based on your preferences.

This page describes how to access the credentials provided to Application Default Credentials (ADC) when you make a REST request to a Google API.

For information about using ADC to call Google APIs using client libraries, see Authenticate using client libraries.

Before you begin

Before you can make a REST request using Application Default Credentials (ADC), you must first provide credentials to ADC.

Send a REST request using Application Default Credentials

To send a REST request using Application Default Credentials, you use the gcloud auth application-default print-access-token command to insert the access token returned by ADC into your REST request.

The following example gets details for your current project. The same pattern can be used for any REST request.

To run this example, you need the resourcemanager.projects.get permission. The resourcemanager.projects.get permission is included in a variety of roles—for example, the Browser role (roles/browser).

Before using any of the request data, make the following replacements:

  • PROJECT_ID: your Google Cloud project ID or name.

To send your request, choose one of these options:

curl

Execute the following command:

curl -X GET \
-H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
"https://cloudresourcemanager.googleapis.com/v3/projects/PROJECT_ID"

PowerShell

Execute the following command:

$cred = gcloud auth application-default print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method GET `
-Headers $headers `
-Uri "https://cloudresourcemanager.googleapis.com/v3/projects/PROJECT_ID" | Select-Object -Expand Content

The details for your project are returned.

If your request returns an error message about end-user credentials not being supported by thi API, see Set the quota project with a REST request on this page.

Set the quota project with a REST request

For some APIs, user credentials can't be used without also setting the project used for billing and quota. To set the billing project with a REST request, you include the x-goog-user-project header with your request.

You must have the serviceusage.services.use IAM permission for a project to be able to designate it as your billing project. The serviceusage.services.use permission is included in the Service Usage Consumer IAM role. If you don't have the serviceusage.services.use permission for any project, contact your security administrator or a project owner who can give you the Service Usage Consumer role in the project.

The following example translates the word "hello" into Spanish. To run the sample, create a file named request.json with the request body content.

Before using any of the request data, make the following replacements:

  • PROJECT_ID: The ID or name of the Google Cloud project to use as a billing project.

Request JSON body:

{
  "q": "hello",
  "source": "en",
  "target": "es"
}

To send your request, choose one of these options:

curl

Save the request body in a file called request.json, and execute the following command:

curl -X POST \
-H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
-H "x-goog-user-project: PROJECT_ID" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://translation.googleapis.com/language/translate/v2"

PowerShell

Save the request body in a file called request.json, and execute the following command:

$cred = gcloud auth application-default print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "x-goog-user-project" = "PROJECT_ID" }

Invoke-WebRequest `
-Method POST `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://translation.googleapis.com/language/translate/v2" | Select-Object -Expand Content

The translation request succeeds. You can try the command without the x-goog-user-project header to see what happens when you do not specify the billing project.

For more information about when you might encounter this issue, see User credentials not working.