- Resource: ServiceAccountKey
- ServiceAccountPrivateKeyType
- ServiceAccountKeyAlgorithm
- ServiceAccountKeyOrigin
- KeyType
- Methods
Resource: ServiceAccountKey
Represents a service account key.
A service account has two sets of key-pairs: user-managed, and system-managed.
User-managed key-pairs can be created and deleted by users. Users are responsible for rotating these keys periodically to ensure security of their service accounts. Users retain the private key of these key-pairs, and Google retains ONLY the public key.
System-managed keys are automatically rotated by Google, and are used for signing for a maximum of two weeks. The rotation process is probabilistic, and usage of the new key will gradually ramp up and down over the key's lifetime.
If you cache the public key set for a service account, we recommend that you update the cache every 15 minutes. User-managed keys can be added and removed at any time, so it is important to update the cache frequently. For Google-managed keys, Google will publish a key at least 6 hours before it is first used for signing and will keep publishing it for at least 6 hours after it was last used for signing.
Public keys for all service accounts are also published at the OAuth2 Service Account API.
JSON representation |
---|
{ "name": string, "privateKeyType": enum ( |
Fields | |
---|---|
name |
The resource name of the service account key in the following format |
privateKeyType |
The output format for the private key. Only provided in Google never exposes system-managed private keys, and never retains user-managed private keys. |
keyAlgorithm |
Specifies the algorithm (and possibly key size) for the key. |
privateKeyData |
The private key data. Only provided in A base64-encoded string. |
publicKeyData |
The public key data. Only provided in A base64-encoded string. |
validAfterTime |
The key can be used after this timestamp. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
validBeforeTime |
The key can be used before this timestamp. For system-managed key pairs, this timestamp is the end time for the private key signing operation. The public key could still be used for verification for a few hours after this time. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
keyOrigin |
The key origin. |
keyType |
The key type. |
disabled |
The key status. |
ServiceAccountPrivateKeyType
Supported private key output formats.
Enums | |
---|---|
TYPE_UNSPECIFIED |
Unspecified. Equivalent to TYPE_GOOGLE_CREDENTIALS_FILE . |
TYPE_PKCS12_FILE |
PKCS12 format. The password for the PKCS12 file is notasecret . For more information, see https://tools.ietf.org/html/rfc7292. |
TYPE_GOOGLE_CREDENTIALS_FILE |
Google Credentials File format. |
ServiceAccountKeyAlgorithm
Supported key algorithms.
Enums | |
---|---|
KEY_ALG_UNSPECIFIED |
An unspecified key algorithm. |
KEY_ALG_RSA_1024 |
1k RSA Key. |
KEY_ALG_RSA_2048 |
2k RSA Key. |
ServiceAccountKeyOrigin
Service Account Key Origin.
Enums | |
---|---|
ORIGIN_UNSPECIFIED |
Unspecified key origin. |
USER_PROVIDED |
Key is provided by user. |
GOOGLE_PROVIDED |
Key is provided by Google. |
KeyType
KeyType
filters to selectively retrieve certain varieties of keys.
Enums | |
---|---|
KEY_TYPE_UNSPECIFIED |
Unspecified key type. The presence of this in the message will immediately result in an error. |
USER_MANAGED |
User-managed keys (managed and rotated by the user). |
SYSTEM_MANAGED |
System-managed keys (managed and rotated by Google). |
Methods |
|
---|---|
|
Creates a ServiceAccountKey . |
|
Deletes a ServiceAccountKey . |
|
Disable a ServiceAccountKey . |
|
Enable a ServiceAccountKey . |
|
Gets a ServiceAccountKey . |
|
Lists every ServiceAccountKey for a service account. |
|
Uploads the public key portion of a key pair that you manage, and associates the public key with a ServiceAccount . |