This page describes how authorization works in Cloud Shell.
Authorizing tools in Cloud Shell
When you make a Google Cloud API call or use a command-line tool that requires credentials (such as the gcloud command-line tool, bq, gsutil, etc.) with Cloud Shell for the first time, Cloud Shell prompts you with the 'Authorize Cloud Shell' dialog.
Click 'Authorize' to allow the tool to use your credentials to make calls.
Duration of authorization
This authorization lasts the lifetime of your Cloud Shell session. Since each Cloud Shell session is tied to an ephemeral, pre-configured virtual machine, if you restart your VM or close your browser, you will need to reauthorize these tools if you use them in your next new session. To learn more about how Cloud Shell works, refer to the Concepts page that outlines key features and how they work.
If you'd like to revoke access for a session, all you need to do is restart your VM to start a new session. The Restart option can be found in the Cloud Shell bar under the More menu.