List service account keys
Stay organized with collections
Save and categorize content based on your preferences.
Demonstrates listing service account keys.
Explore further
For detailed documentation that includes this code sample, see the following:
Code sample
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],[],[[["\u003cp\u003eThis page provides code samples in C++, C#, Go, Java, and Python demonstrating how to list service account keys.\u003c/p\u003e\n"],["\u003cp\u003eEach code sample utilizes the IAM client library for its respective language to interact with the IAM API for listing keys.\u003c/p\u003e\n"],["\u003cp\u003eThe code examples in each language provide methods to list keys associated with a given service account, and may include how to filter key types.\u003c/p\u003e\n"],["\u003cp\u003eBefore running the code samples, users need to set up Application Default Credentials (ADC) for authentication.\u003c/p\u003e\n"],["\u003cp\u003eFurther resources are provided, such as the IAM client library documentation and API reference documentation for each language.\u003c/p\u003e\n"]]],[],null,["# List service account keys\n\nDemonstrates listing service account keys.\n\nExplore further\n---------------\n\n\nFor detailed documentation that includes this code sample, see the following:\n\n- [List and get service account keys](/iam/docs/keys-list-get)\n\nCode sample\n-----------\n\n### C++\n\n\nTo learn how to install and use the client library for IAM, see\n[IAM client libraries](/iam/docs/reference/libraries).\n\n\nFor more information, see the\n[IAM C++ API\nreference documentation](/cpp/docs/reference/iam/latest).\n\n\nTo authenticate to IAM, set up Application Default Credentials.\nFor more information, see\n\n[Set up authentication for a local development environment](/docs/authentication/set-up-adc-local-dev-environment).\n\n namespace iam = ::google::cloud::iam_admin_v1;\n [](std::string const& service_account_name,\n std::vector\u003cstd::string\u003e const& key_type_labels) {\n iam::IAMClient client(iam::MakeIAMConnection());\n std::vector\u003cgoogle::iam::admin::v1::ListServiceAccountKeysRequest::KeyType\u003e\n key_types;\n for (auto const& type : key_type_labels) {\n if (type == \"USER_MANAGED\") {\n key_types.push_back(google::iam::admin::v1::\n ListServiceAccountKeysRequest::USER_MANAGED);\n } else if (type == \"SYSTEM_MANAGED\") {\n key_types.push_back(google::iam::admin::v1::\n ListServiceAccountKeysRequest::SYSTEM_MANAGED);\n }\n }\n auto response =\n client.ListServiceAccountKeys(service_account_name, key_types);\n if (!response) throw std::move(response).status();\n std::cout \u003c\u003c \"ServiceAccountKeys successfully retrieved: \"\n \u003c\u003c response-\u003eDebugString() \u003c\u003c \"\\n\";\n }\n\n### C#\n\n\nTo learn how to install and use the client library for IAM, see\n[IAM client libraries](/iam/docs/reference/libraries).\n\n\nFor more information, see the\n[IAM C# API\nreference documentation](https://developers.google.com/api-client-library/dotnet/apis/iam/v1).\n\n\nTo authenticate to IAM, set up Application Default Credentials.\nFor more information, see\n\n[Set up authentication for a local development environment](/docs/authentication/set-up-adc-local-dev-environment).\n\n\n using System;\n using System.Collections.Generic;\n using https://cloud.google.com/dotnet/docs/reference/Google.Apis/latest/Google.Apis.Auth.OAuth2.html;\n using Google.Apis.Iam.v1;\n using Google.Apis.Iam.v1.Data;\n\n public partial class ServiceAccountKeys\n {\n public static IList\u003cServiceAccountKey\u003e ListKeys(string serviceAccountEmail)\n {\n var credential = https://cloud.google.com/dotnet/docs/reference/Google.Apis/latest/Google.Apis.Auth.OAuth2.GoogleCredential.html.https://cloud.google.com/dotnet/docs/reference/Google.Apis/latest/Google.Apis.Auth.OAuth2.GoogleCredential.html#Google_Apis_Auth_OAuth2_GoogleCredential_GetApplicationDefault()\n .https://cloud.google.com/dotnet/docs/reference/Google.Apis/latest/Google.Apis.Auth.OAuth2.GoogleCredential.html#Google_Apis_Auth_OAuth2_GoogleCredential_CreateScoped_System_Collections_Generic_IEnumerable_System_String__(IamService.Scope.CloudPlatform);\n var service = new IamService(new IamService.Initializer\n {\n HttpClientInitializer = credential\n });\n\n var response = service.Projects.ServiceAccounts.Keys\n .List($\"projects/-/serviceAccounts/{serviceAccountEmail}\")\n .Execute();\n foreach (ServiceAccountKey key in response.Keys)\n {\n Console.WriteLine(\"Key: \" + key.Name);\n }\n return response.Keys;\n }\n }\n\n### Go\n\n\nTo learn how to install and use the client library for IAM, see\n[IAM client libraries](/iam/docs/reference/libraries).\n\n\nFor more information, see the\n[IAM Go API\nreference documentation](https://godoc.org/google.golang.org/genproto/googleapis/iam/admin/v1).\n\n\nTo authenticate to IAM, set up Application Default Credentials.\nFor more information, see\n\n[Set up authentication for a local development environment](/docs/authentication/set-up-adc-local-dev-environment).\n\n import (\n \t\"context\"\n \t\"fmt\"\n \t\"io\"\n\n \tiam \"google.golang.org/api/iam/v1\"\n )\n\n // listKey lists a service account's keys.\n func listKeys(w io.Writer, serviceAccountEmail string) ([]*iam.ServiceAccountKey, error) {\n \tctx := context.Background()\n \tservice, err := iam.NewService(ctx)\n \tif err != nil {\n \t\treturn nil, fmt.Errorf(\"iam.NewService: %w\", err)\n \t}\n\n \tresource := \"projects/-/serviceAccounts/\" + serviceAccountEmail\n \tresponse, err := service.Projects.ServiceAccounts.Keys.List(resource).Do()\n \tif err != nil {\n \t\treturn nil, fmt.Errorf(\"Projects.ServiceAccounts.Keys.List: %w\", err)\n \t}\n \tfor _, key := range response.Keys {\n \t\tfmt.Fprintf(w, \"Listing key: %v\", key.Name)\n \t}\n \treturn response.Keys, nil\n }\n\n### Java\n\n\nTo learn how to install and use the client library for IAM, see\n[IAM client libraries](/iam/docs/reference/libraries).\n\n\nFor more information, see the\n[IAM Java API\nreference documentation](https://developers.google.com/api-client-library/java/apis/iam/v1).\n\n\nTo authenticate to IAM, set up Application Default Credentials.\nFor more information, see\n\n[Set up authentication for a local development environment](/docs/authentication/set-up-adc-local-dev-environment).\n\n import com.google.cloud.iam.admin.v1.https://cloud.google.com/java/docs/reference/google-iam-admin/latest/com.google.cloud.iam.admin.v1.IAMClient.html;\n import com.google.iam.admin.v1.https://cloud.google.com/java/docs/reference/google-iam-admin/latest/com.google.iam.admin.v1.ListServiceAccountKeysRequest.html;\n import com.google.iam.admin.v1.https://cloud.google.com/java/docs/reference/google-iam-admin/latest/com.google.iam.admin.v1.ServiceAccountKey.html;\n import java.io.IOException;\n import java.util.List;\n\n public class ListServiceAccountKeys {\n\n public static void main(String[] args) throws IOException {\n // TODO(Developer): Replace the below variables before running.\n String projectId = \"your-project-id\";\n String serviceAccountName = \"your-service-account-name\";\n\n List\u003cServiceAccountKey\u003e keys = listKeys(projectId, serviceAccountName);\n keys.forEach(key -\u003e System.out.println(\"Key: \" + key.getName()));\n }\n\n // Lists all keys for a service account.\n public static List\u003cServiceAccountKey\u003e listKeys(String projectId, String accountName)\n throws IOException {\n // Initialize client that will be used to send requests.\n // This client only needs to be created once, and can be reused for multiple requests.\n String email = String.format(\"%s@%s.iam.gserviceaccount.com\", accountName, projectId);\n try (https://cloud.google.com/java/docs/reference/google-iam-admin/latest/com.google.cloud.iam.admin.v1.IAMClient.html iamClient = https://cloud.google.com/java/docs/reference/google-iam-admin/latest/com.google.cloud.iam.admin.v1.IAMClient.html.create()) {\n https://cloud.google.com/java/docs/reference/google-iam-admin/latest/com.google.iam.admin.v1.ListServiceAccountKeysRequest.html req = https://cloud.google.com/java/docs/reference/google-iam-admin/latest/com.google.iam.admin.v1.ListServiceAccountKeysRequest.html.newBuilder()\n .setName(String.format(\"projects/%s/serviceAccounts/%s\", projectId, email))\n .build();\n\n return iamClient.listServiceAccountKeys(req).getKeysList();\n }\n }\n }\n\n### Python\n\n\nTo learn how to install and use the client library for IAM, see\n[IAM client libraries](/iam/docs/reference/libraries).\n\n\nFor more information, see the\n[IAM Python API\nreference documentation](https://developers.google.com/api-client-library/python/apis/iam/v1).\n\n\nTo authenticate to IAM, set up Application Default Credentials.\nFor more information, see\n\n[Set up authentication for a local development environment](/docs/authentication/set-up-adc-local-dev-environment).\n\n from typing import List\n\n from google.cloud import iam_admin_v1\n from google.cloud.iam_admin_v1 import types\n\n\n def list_keys(project_id: str, account: str) -\u003e List[iam_admin_v1.ServiceAccountKey]:\n \"\"\"Creates a key for a service account.\n\n project_id: ID or number of the Google Cloud project you want to use.\n account: ID or email which is unique identifier of the service account.\n \"\"\"\n\n iam_admin_client = iam_admin_v1.IAMClient()\n request = types.ListServiceAccountKeysRequest()\n request.name = f\"projects/{project_id}/serviceAccounts/{account}\"\n\n response = iam_admin_client.list_service_account_keys(request=request)\n return response.keys\n\nWhat's next\n-----------\n\n\nTo search and filter code samples for other Google Cloud products, see the\n[Google Cloud sample browser](/docs/samples?product=iam)."]]