이제 Cloud Data Loss Prevention(Cloud DLP)은 민감한 정보 보호에 포함됩니다. API 이름은 Cloud Data Loss Prevention API(DLP API)로 그대로 유지됩니다. 민감한 정보 보호를 구성하는 서비스에 대한 자세한 내용은 민감한 정보 보호 개요를 참조하세요.
ADC를 사용하는 서비스는 GOOGLE_APPLICATION_CREDENTIALS 환경 변수에서 사용자 인증 정보를 찾습니다. ADC에서 다른 사용자 인증 정보(예: 특정 사용자의 인증 정보)를 사용해야 하는 경우가 아니라면, 이 환경 변수가 서비스 계정 키 파일을 가리키도록 설정하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Authenticating to the DLP API\n\nYou must authenticate to the DLP API in order to use it. The\nDLP API can handle both API keys and authentication.\nThe main distinction between these two methods is:\n\n- API keys identify the calling project---the app or site---that is making the call to an API.\n- Auth tokens identify a user---the person---that is using the project.\n\nUsing an API key for unauthenticated access\n-------------------------------------------\n\nYou can use a Google Cloud console API key to authenticate to the\nDLP API for some methods, including all\n[`projects.content.*`](/sensitive-data-protection/docs/reference/rest/v2/projects.content)\nand\n[`projects.image.*`](/sensitive-data-protection/docs/reference/rest/v2/projects.image)\nmethods.\n\n1. Follow the instructions to [create an API key\n for your Google Cloud console project](https://support.google.com/cloud/answer/6158862).\n2. When making any DLP API request, pass your key as the value of a `key` parameter. For example: \n\n ```\n curl https://dlp.googleapis.com/v2/infoTypes?key=[YOUR_API_KEY]\n ```\n\nIt's important to protect your API keys against unauthorized use. For advice on\nhow to do this, see [Best practices for securely using API\nkeys](https://support.google.com/cloud/answer/6310037).\n| **Note:** When a Cloud Key Management Service wrapped key is used on [`deidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.content/deidentify) or [`reidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.content/reidentify) requests, API keys can't be used for authentication. Cloud Key Management Service does not support API keys as an authentication method. For more information, see [Accessing the API](/kms/docs/accessing-the-api).\n\nUsing a service account\n-----------------------\n\nTo use a service account to authenticate to the DLP API:\n\n- Follow the instructions to [create a service account](/iam/docs/creating-managing-service-accounts#creating_a_service_account). Select **JSON** as your key type, and grant the user the **DLP User** role (roles/dlp.user).\n\nFor more information about granting roles to service accounts, see\n[Granting Roles to Service Accounts](/iam/docs/granting-roles-to-service-accounts).\n| **Note:** Granting the user the **Owner** role is not necessary.\n\nOnce complete, your service account key is downloaded to your browser's\ndefault location.\n\nNext, decide whether you'll provide your service account authentication as a\n[*bearer token*](#bearer) or using\n[*application default credentials*](#default-creds).\n\n### Bearer tokens using a service account\n\nIf you're calling the DLP API directly, such as by making an\nHTTP request with cURL, you'll pass your authentication as a bearer token in an\nHTTP Authorization request header. To obtain a bearer token using your service\naccount:\n\n1. Install the [Google Cloud CLI](/sdk/downloads#interactive).\n2. Authenticate to your service account, replacing \\[KEY_FILE\\] below with the path to your service account key file: \n\n ```\n gcloud auth activate-service-account --key-file [KEY_FILE]\n ```\n3. Obtain an authorization token using your service account: \n\n ```\n gcloud auth print-access-token\n ```\n The command returns an access token value.\n4. When calling the API, pass the token value as a `bearer` token in an `Authorization` header: \n\n ```\n curl -s -H 'Content-Type: application/json' \\\n -H 'Authorization: Bearer [ACCESS_TOKEN]' \\\n 'https://dlp.googleapis.com/v2/infoTypes'\n ```\n\n### Application default credentials\n\nIf you're using a client library to call the DLP API, use\n[Application Default\nCredentials](https://developers.google.com/identity/protocols/application-default-credentials) (ADC).\n\nServices using ADC look for credentials within a\n`GOOGLE_APPLICATION_CREDENTIALS` environment variable. Unless you specifically\nwant to have ADC use other credentials (for example, user credentials), set\nthis environment variable to point to your service account key file. \n\n```\nexport GOOGLE_APPLICATION_CREDENTIALS=[PATH_TO_KEY_FILE]\n```\n\n### Using Sensitive Data Protection from Compute Engine VMs\n\nIn order to access the DLP API from VM instances, select\n**Allow full access to all Cloud APIs** under the **Identity and API Access**\nsection when creating the VM."]]
