먼저 OAuth 클라이언트를 만들고 해당 클라이언트의 클라이언트 ID와 클라이언트 보안 비밀번호를 생성합니다. 이러한 값은 Looker(Google Cloud 핵심 서비스) 인스턴스를 만드는 동안 필요합니다.
원하는 Google Cloud 프로젝트에서 OAuth 클라이언트를 설정할 수 있습니다. Looker (Google Cloud 핵심 서비스) 인스턴스와 동일한 프로젝트가 아니어도 됩니다. 하지만 이 프로젝트에서 Looker (Google Cloud 핵심 서비스) API를 사용 설정해야 합니다.
클라이언트와 사용자 인증 정보를 만들려면 다음 단계를 따르세요.
OAuth 클라이언트를 만들 프로젝트로 이동합니다.
API 및 서비스 > 사용자 인증 정보로 이동합니다.
사용자 인증 정보 페이지에서 사용자 인증 정보 만들기를 클릭합니다.
드롭다운 메뉴에서 OAuth 클라이언트 ID를 선택합니다.
애플리케이션 유형 드롭다운에서 웹 애플리케이션을 선택합니다.
이름 필드에 OAuth 클라이언트 이름을 입력합니다.
이 시점에는 승인된 JavaScript 출처 또는 승인된 리디렉션 URI 섹션에 URI를 추가하지 않아도 됩니다.
브랜딩 섹션의 승인된 도메인에서 도메인은 OAuth 사용자 인증 정보를 사용하는 Looker (Google Cloud 핵심 서비스) 인스턴스의 도메인과 일치해야 합니다. Looker (Google Cloud 핵심 서비스) 인스턴스의 커스텀 도메인을 만들고 할당할 도메인을 알고 있는 경우 지금 입력할 수 있습니다. 그렇지 않으면 이 필드를 비워 두어도 됩니다. Looker (Google Cloud 핵심 서비스) 인스턴스가 생성된 후에 승인된 리디렉션 URI를 추가하면 자동으로 채워집니다.
잠재고객 섹션의 사용자 유형에서 다음 중 하나를 선택합니다.
내부: 이 설정은 기본값입니다. 조직 내 사용자만 IAM을 통해 추가된 후 인스턴스에 액세스할 수 있습니다.
Looker(Google Cloud 핵심 서비스) 인스턴스의 URL을 URI 필드에 붙여넣습니다. /oauth2callback을 URL 끝에 추가합니다. 예를 들면 https://uuid.looker.app/oauth2callback입니다.
BigQuery에 대한 OAuth 승인을 설정하는 경우 Looker (Google Cloud 핵심 서비스) 인스턴스의 URL 뒤에 /external_oauth/redirect이 추가된 두 번째 리디렉션 URI를 추가할 수도 있습니다. 예를 들면 https://uuid.looker.app/external_oauth/redirect입니다.
저장을 클릭합니다.
업데이트가 적용되는 데 5분에서 몇 시간 정도 걸릴 수 있습니다.
사용자 관리
OAuth 클라이언트가 구성되고 Looker(Google Cloud 핵심 서비스) 인스턴스가 생성되면 인스턴스의 인증 방법을 선택할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| **Note:** To learn how to set up OAuth for authentication, see the [Use Google OAuth for Looker (Google Cloud core) user authentication](/looker/docs/looker-core-oauth-authentication) documentation page.\n\nAn OAuth client must be set up and OAuth credentials must be generated as part of Looker (Google Cloud core) instance creation, even if you want to use a [different authentication method](/looker/docs/looker-core-user-authentication) for authenticating your users into a Looker (Google Cloud core) instance.\n\nRequired roles\n\nTo use the Google Cloud console to create and edit OAuth credentials, you need the following permissions. (To hide the list of permissions, collapse the **Required permissions** section.) \n\nRequired permissions\n\n\u003cbr /\u003e\n\n- clientauthconfig.\\*\n - clientauthconfig.brands.create\n - clientauthconfig.brands.delete\n - clientauthconfig.brands.get\n - clientauthconfig.brands.list\n - clientauthconfig.brands.update\n - clientauthconfig.clients.create\n - clientauthconfig.clients.createSecret\n - clientauthconfig.clients.delete\n - clientauthconfig.clients.get\n - clientauthconfig.clients.getWithSecret\n - clientauthconfig.clients.list\n - clientauthconfig.clients.listWithSecrets\n - clientauthconfig.clients.undelete\n - clientauthconfig.clients.update\n- oauthconfig.\\*\n - oauthconfig.clientpolicy.get\n - oauthconfig.testusers.get\n - oauthconfig.testusers.update\n - oauthconfig.verification.get\n - oauthconfig.verification.submit\n - oauthconfig.verification.update\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nYou might also be able to get the required permissions through [custom roles](/iam/docs/creating-custom-roles) or other [predefined roles](/iam/docs/understanding-roles). For more information about granting roles, see the [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access) page in the Identity and Access Management (IAM) documentation.\n\nBefore you create a Looker (Google Cloud core) instance\n\nBefore you create a Looker (Google Cloud core) instance, complete the steps that are described in these sections:\n\n- [Generate the OAuth client ID and client secret](#generate_the_oauth_client_id_and_client_secret)\n- [Configure the user consent screen, scopes, and test users](#configure_the_user_consent_screen_scopes_and_test_users)\n\nGenerate the OAuth client ID and client secret\n\nFirst, create an OAuth client and generate the client ID and client secret for that client. These values are required during creation of the Looker (Google Cloud core) instance.\n\nYou can set up the OAuth client in any Google Cloud project you want. It doesn't need to be the same project as the Looker (Google Cloud core) instance. However, the Looker (Google Cloud core) API **must be enabled** in this project.\n\nTo create the client and its credentials, follow these steps:\n\n1. Navigate to the project that you want to create the OAuth client in.\n2. Navigate to **APIs \\& Services \\\u003e Credentials**.\n3. From the **Credentials** page, click **Create Credentials**.\n4. From the drop-down menu, select **OAuth client ID**.\n5. In the **Application type** drop-down, select **Web application**.\n6. In the **Name** field, enter a name for your OAuth client.\n7. At this point, you **don't** need to add URIs in the **Authorized JavaScript origins** or **Authorized redirect URIs** sections.\n8. Click **Create**.\n\nAfter you click **Create** , an **OAuth client created** window appears. This window displays the client ID and client secret created for your OAuth client. These values will be required when you [create the Looker (Google Cloud core) instance](/looker/docs/looker-core-instance-create#oauth).\n\nOptionally, click **Download JSON** to download the credential information in a JSON file. To close the window, click **OK**.\n\nConfigure the user consent screen, scopes, and test users\n\nNext, you may want to configure the consent screen. The consent screen is shown to a user of the Looker (Google Cloud core) instance at their first login and at any point when their authorization [expires](https://support.google.com/a/answer/7576830) or is [revoked by the user](https://developers.google.com/identity/gsi/web/guides/revoke).\n\nFollow the instructions on the [Configure the OAuth consent screen and choose scopes](https://developers.google.com/workspace/guides/configure-oauth-consent#configure_oauth_consent) documentation page. While configuring your screen, complete the following settings as described:\n\n- In the **Branding** section, under **Authorized domains** , the domain must match the domain of the Looker (Google Cloud core) instance that uses the OAuth credentials. If you are going to create a [custom domain](/looker/docs/looker-core-custom-domain) for your Looker (Google Cloud core) instance and know the domain that you will assign to it, you can enter it now. Otherwise, you can leave this field empty; it will be automatically populated when you [add the authorized redirect URI](#after_instance_creation) after the Looker (Google Cloud core) instance is created.\n\n- In the **Audience** section, under **User Type**, select one of the following:\n\n - **Internal** : This setting is the default. Only users within your [organization](/resource-manager/docs/cloud-platform-resource-hierarchy#organizations) can access the instance once they are [added through IAM](/looker/docs/looker-core-oauth-authentication#adding-users).\n - **Make external** : Users with any kind of [Google Account](https://www.google.com/account/about/) can access the instance once they are [added through IAM](/looker/docs/looker-core-oauth-authentication#adding-users).\n\n | **Note:** If you want a user such as Google Support to access your instance using OAuth and IAM, **User Type** must be set to **External** , and the Support user must be [added through IAM](/looker/docs/looker-core-oauth-authentication). You can edit the **User Type** setting at any point.\n\nDuring Looker (Google Cloud core) instance creation\n\nWhen you are [creating the Looker (Google Cloud core) instance](/looker/docs/looker-core-instance-create), add the OAuth client ID and client secret in the [**OAuth Application Credentials** section](/looker/docs/looker-core-instance-create#oauth). You cannot create an instance without OAuth credentials. Find the OAuth client ID and client secret by navigating to the OAuth client in the Google Cloud console.\n\nAfter you create a Looker (Google Cloud core) instance\n\nComplete the following instructions to finish configuration. When you add an authorized redirect URI, it will be added to your OAuth consent screen as an authorized domain.\n\nAdd the authorized redirect URI to the OAuth client\n\nIf you haven't done so already, follow these steps to enter the URL of the newly created Looker (Google Cloud core) instance into the OAuth client.\n\n1. After you have created a Looker (Google Cloud core) instance, find and copy the URL for the instance. You can find the URL on the [**Instances** page](/looker/docs/looker-core-view-console).\n\n | **Note:** If you are setting up a [custom domain](/looker/docs/looker-core-custom-domain) for your instance, be sure to complete that setup before copying the URL. Once you add the custom domain to the OAuth client, users will no longer be able to log in to the autogenerated instance URL that was granted when the instance was created, even if that domain is also in the OAuth client.\n2. In the Google Cloud console, navigate to **APIs \\& Services \\\u003e Credentials**.\n\n3. Under the **OAuth 2.0 Client IDs** heading, click the name of the [client you created](#generate_the_oauth_client_id_and_client_secret).\n\n4. In the **Authorized redirect URIs** section, click **Add URI**.\n\n5. Paste the URL of the Looker (Google Cloud core) instance into the **URIs** field. Add `/oauth2callback` to the end of the URL. For example: `https://uuid.looker.app/oauth2callback`.\n\n If you are going to set up [OAuth authorization for BigQuery](/looker/docs/looker-core-dialects#oauth-options), you can also add a second redirect URI that points to the URL of the Looker (Google Cloud core) instance followed by `/external_oauth/redirect` added to the end of the URL. For example: `https://uuid.looker.app/external_oauth/redirect`.\n6. Click **Save**.\n\nIt may take from five minutes to a few hours for the update to take effect.\n\nManage users\n\nOnce the OAuth client is configured and the Looker (Google Cloud core) instance is [created](/looker/docs/looker-core-instance-create), you can [choose the authentication method](/looker/docs/looker-core-user-authentication) for your instance.\n\nIf using OAuth as your primary authentication method, complete the steps as described on the [Use Google OAuth for Looker (Google Cloud core) user authentication](/looker/docs/looker-core-oauth-authentication) documentation page to complete OAuth setup for user authentication.\n\nOnce your authentication method is set up, you can add or remove users through your identity provider and [manage them within Looker](/looker/docs/looker-core-user-management).\n\nEdit the OAuth client for a Looker (Google Cloud core) instance\n\nIf you want, you can edit or change the OAuth credentials for your Looker (Google Cloud core) instance by following these steps:\n\n1. [Set up](#before_you_create_a_instance) the new client or credentials.\n2. In the Google Cloud console, from the **Instances** page, click on an instance's name to open the **DETAILS** page.\n3. From the **DETAILS** page, click **Edit**.\n4. On the **Edit Looker (Google Cloud core) instance** page, enter the new values in the **OAuth Client ID** and **OAuth Client Secret** fields.\n5. Click **Save**.\n\nWhat's next\n\n- [Create a public IP Looker (Google Cloud core) instance](/looker/docs/looker-core-instance-create)\n- [Create a private connections (private services access) Looker (Google Cloud core) instance](/looker/docs/looker-core-create-private-ip)"]]
