This page explains how to list and get service account keys using the Google Cloud console, the Google Cloud CLI, the Identity and Access Management API, or one of the Google Cloud Client Libraries.
Before you begin
Enable the IAM API.
Understand service account credentials.
Required roles
To get the permissions that you need to list and get service account keys,
ask your administrator to grant you the
View Service Accounts (roles/iam.serviceAccountViewer
) IAM role on either the project or the service account whose keys you
want to manage.
For more information about granting roles, see
Manage access.
You might also be able to get the required permissions through custom roles or other predefined roles.
For more information, see Service Accounts roles.
IAM basic roles also contain permissions to manage service account keys. You should not grant basic roles in a production environment, but you can grant them in a development or test environment.
List service account keys
You can list the service account keys for a service account using the
Google Cloud console, the gcloud CLI, the
serviceAccount.keys.list()
method, or one of the client libraries.
The serviceAccount.keys.list()
method is commonly used to audit service
accounts and keys, or to build custom tooling for managing service accounts.
To find out which project your key belongs to, you can download the key as a JSON file and look at that file.
You might see keys listed that you did not create. These are keys created by Google and used by the Service Account Credentials API. To learn more, see Google-managed key pairs.
Console
- In the Google Cloud console, go to the Service accounts page.
The remaining steps will appear automatically in the Google Cloud console.
- Select a project.
- On the Service accounts page, click the email address of the service account whose keys you want to list.
- Click Keys. The Google Cloud console displays a list of keys for the service account.
gcloud
Execute the gcloud iam service-accounts keys list
command to list service account keys.
Replace the following values:
SA_NAME
: The name of the service account to list keys for.PROJECT_ID
: Your Google Cloud project ID.
gcloud iam service-accounts keys list \ --iam-account=SA_NAME@PROJECT_ID.iam.gserviceaccount.com
Output:
KEY_ID | CREATED_AT | EXPIRES_AT | DISABLED |
8e6e3936d7024646f8ceb39792006c07f4a9760c | 2021-01-01T21:01:42Z | 9999-12-31T23:59:59Z | |
937c98f870f5c8db970af527aa3c12fd88b1c20a | 2021-01-01T20:55:40Z | 9999-12-31T23:59:59Z | True |
REST
The
projects.serviceAccounts.keys.list
method lists all of the service account keys for a service account.
Before using any of the request data, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.SA_NAME
: The name of the service account whose keys you want to list.KEY_TYPES
: Optional. A comma-separated list of key types that you want to include in the response. The key type indicates whether a key is user-managed (USER_MANAGED
) or system-managed (SYSTEM_MANAGED
). If left blank, all keys are returned.
HTTP method and URL:
GET https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys?keyTypes=KEY_TYPES
To send your request, expand one of these options:
You should receive a JSON response similar to the following:
{ "keys": [ { "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/90c48f61c65cd56224a12ab18e6ee9ca9c3aee7c", "validAfterTime": "2020-03-04T17:39:47Z", "validBeforeTime": "9999-12-31T23:59:59Z", "keyAlgorithm": "KEY_ALG_RSA_2048", "keyOrigin": "GOOGLE_PROVIDED", "keyType": "USER_MANAGED" }, { "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/e5e3800831ac1adc8a5849da7d827b4724b1fce8", "validAfterTime": "2020-03-31T23:50:09Z", "validBeforeTime": "9999-12-31T23:59:59Z", "keyAlgorithm": "KEY_ALG_RSA_2048", "keyOrigin": "GOOGLE_PROVIDED", "keyType": "USER_MANAGED" }, { "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/b97699f042b8eee6a846f4f96259fbcd13e2682e", "validAfterTime": "2020-05-17T18:58:13Z", "validBeforeTime": "9999-12-31T23:59:59Z", "keyAlgorithm": "KEY_ALG_RSA_2048", "keyOrigin": "GOOGLE_PROVIDED", "keyType": "USER_MANAGED", "disabled": true } ] }
C++
To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C++ API reference documentation.
To authenticate to IAM, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
C#
To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C# API reference documentation.
To authenticate to IAM, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Go
To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Go API reference documentation.
To authenticate to IAM, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Java
To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Java API reference documentation.
To authenticate to IAM, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Python
To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Python API reference documentation.
To authenticate to IAM, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Get a service account key
You can use the gcloud CLI or the REST API to get the public key data for a service account key. In addition, you can use the Google Cloud console, the gcloud CLI, or the REST API to get metadata for the key, such as the algorithm that the key uses and whether the key is managed by you or by Google.
Console
To get the public key data for a service account key:
Use the gcloud CLI or the REST API. This data is not available in the Google Cloud console.
To get metadata for a service account key:
- In the Google Cloud console, go to the Service accounts page.
The remaining steps will appear automatically in the Google Cloud console.
- Select a project.
- On the Service accounts page, click the email address of the service account whose keys you want to list.
- Click Keys. The Google Cloud console displays a list of keys for the service account, including metadata for each key.
gcloud
To get the public key data for a service account key:
Run the
gcloud beta iam service-accounts keys get-public-key
command:
gcloud beta iam service-accounts keys get-public-key KEY_ID \ --iam-account=SA_NAME --output-file=FILENAME
Provide the following values:
KEY_ID
: The ID of the public key you want to get. To find the key's ID, list all keys for the service account, identify the key that you want to get, and then copy its ID.SA_NAME
: The name of the service account whose public key you want to get.FILENAME
: The file in which to save the public key data.
By default, the public key data is saved in X.509 PEM format. To get the raw
public key, run the command with the additional flag --type=raw
.
For example, the following command gets the public key data for the key
c97cc34494c07c9b483701f28368f20145b9ef97
, which belongs to the service account
my-service-account@my-project.iam.gserviceaccount.com
, then saves the public
key data to the file public_key.pem
:
gcloud beta iam service-accounts keys get-public-key \
c97cc34494c07c9b483701f28368f20145b9ef97 \
--iam-account=my-service-account@my-project.iam.gserviceaccount.com \
--output-file=public_key.pem
To get metadata for a service account key:
Run the gcloud iam service-accounts keys list
command:
gcloud iam service-accounts keys list --iam-account=SA_NAME \ --filter="name~KEY_ID" --format=json
Provide the following values:
SA_NAME
: The name of the service account for which you want key metadata.KEY_ID
: The ID of the key for which you want metadata.
For example, the following command gets metadata for the key
c97cc34494c07c9b483701f28368f20145b9ef97
, which belongs to the service account
my-service-account@my-project.iam.gserviceaccount.com
:
gcloud iam service-accounts keys list \
--iam-account=my-service-account@my-project.iam.gserviceaccount.com \
--filter="name~c97cc34494c07c9b483701f28368f20145b9ef97" --format=json
REST
The
projects.serviceAccounts.keys.get
method returns information about a public key for a service account.
Before using any of the request data, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.SA_NAME
: The name of the service account whose public key you want to get.-
KEY_ID
: The ID of the public key you want to get. To find the key's ID, list all keys for the service account, identify the key that you want to get, and then copy its ID from the end of thename
field. The key's ID is everything afterkeys/
. KEY_TYPE
: The format in which to return the public key. UseTYPE_X509_PEM_FILE
for X.509 PEM format orTYPE_RAW_PUBLIC_KEY
for the raw public key. If you omit this query parameter, the method returns metadata for the key, but it does not return the public key data.
HTTP method and URL:
GET https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NAME@PROJECT_ID.iam.gserviceaccount.com/keys/KEY_ID?publicKeyType=KEY_TYPE
To send your request, expand one of these options:
You should receive a JSON response similar to the following:
{ "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com/keys/f4a83933ac07cf52bb74e0e66d99662a09f51a36", "validAfterTime": "2021-12-10T17:32:06Z", "validBeforeTime": "9999-12-31T23:59:59Z", "publicKeyData": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvRENDQWVTZ0F3SUJBZ0lJT2lCdm9hR09nV0F3RFFZSktvWklodmNOQVFFRkJRQXdJREVlTUJ3R0ExVUUKQXhNVk1UQXhNVGsxTlRFMk5UWXlPRGszTmpFek1qQXpNQ0FYRFRJeE1USXhNREUzTXpJd05sb1lEems1T1RreApNak14TWpNMU9UVTVXakFnTVI0d0hBWURWUVFERXhVeE1ERXhPVFUxTVRZMU5qSTRPVGMyTVRNeU1ETXdnZ0VpCk1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQzdzeDBFcXVUMGNwSXhlczl1SW0yRy9DS3EKdnc4YTl2a2JkaWZZbDZHSDh1ZUxEWDhGNHVUeEVQMkNzU3JLTHZtOFo2My9IVUxnWjBtQXByb0JlM08vaVR1ZwpmYVZ0NVNtakhvWm9YQ1lpbjR0MS93SkpvdDhrRFdPeDZhOEdieUdqZ215ak8yYk1XdEtaQ2dqeGZ3cUV0MmN3CklnajA5VzJKYTlHTWRsdVA0VGVubTRKSkJoaFpFbTJ1bVAwYVZZdkRnUWF5d0RCYnJuNG8yY0EzSWplRDZGM1gKK0VHRDNKU0s4VW02Sk5sM21adGp6VWNZSHBrYkF0U1A2ZDI5d1RmZkdIRFY0THJRWlM3bG15d3hsb3p5WnpaawpCOFpHckMzSkF1MVNVRTdQOTN6bWtFb1B6MlRUNWhaYXZMWFQ5TGM2SExiRklRVHFnVEJVWHlNMkpIcGZBZ01CCkFBR2pPREEyTUF3R0ExVWRFd0VCL3dRQ01BQXdEZ1lEVlIwUEFRSC9CQVFEQWdlQU1CWUdBMVVkSlFFQi93UU0KTUFvR0NDc0dBUVVGQndNQ01BMEdDU3FHU0liM0RRRUJCUVVBQTRJQkFRQkhPNXlpUDY3NkE4UEN2RjdRSzdFMApYZVljbzdsSStFZkowaGJrWVlmdUtnSENPcXcvd3FBbCtOSithanljT2FPWDFPMlRZN3ZOc05pR2t3eWc2QXdqCklhL1NHVjd3NkxpS2JldFRuSVp4UlhRY25lcnVvZEwycUR5eWphMDJJSXJVTmVKY1o0MVJBNXRTL3NkcTFGNm4KM0NjSXFoZTI1OTA4TUNna3cwaFB1K0VLbFF6R1B5T3pVRHBLdXg0cnRBaHJTYTBUVW1wbEMxdTJnUk1YRkF6aApWUjU0V2dNa2tabURyalBNeWdBS3JmNkd0bHo2VHRTYTVLb1BWdGpsWExUQkxaSnlhdk4zc1F2dFlBK1NFQWpWCnA1N1ZabFBYZmR0dWN4ekJaOC9zS25SOHNyYU5hVWFjamg1NEE1Nm1URTE3b0IyUWkrTHBJUTYvNnVqVnNXaUYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", "keyAlgorithm": "KEY_ALG_RSA_2048", "keyOrigin": "GOOGLE_PROVIDED", "keyType": "USER_MANAGED" }
What's next
- Learn how to create and delete service account keys.
- Learn how to disable and enable service account keys.
- Learn how to use service account keys to authenticate as a service account.
- Understand the best practices for managing service account keys.
Try it for yourself
If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
Get started for free