Create signatures

This page shows you how to use the Google Cloud signBlob method to create a signature from a string-to-sign or policy document. Signatures are used as credentials in certains requests, such as signed URLs. This guide uses RSA keys for creating signatures.

Before you begin

  1. You must have the iam.serviceAccounts.signBlob permission for the service account that you use in this guide. The iam.serviceAccounts.signBlob permission is included in the roles/iam.serviceAccountTokenCreator role.

  2. The service account that you use in this guide must have permission to perform the request encoded within the signature. For example, if the signature will be used to read object data from a bucket, the service account must have permission to read the object data.

Create a signature

  1. Get an authorization access token from the OAuth 2.0 Playground. Configure the playground to use your own OAuth credentials. For instructions, see API authentication.
  2. Create a JSON file that contains the following information:

      "payload": "REQUEST_INFORMATION"


  3. Use cURL to call the IAM API with a signBlob request:

    curl -X POST --data-binary @JSON_FILE_NAME \
      -H "Authorization: Bearer OAUTH2_TOKEN" \
      -H "Content-Type: application/json" \


    • JSON_FILE_NAME is the name of the file you created in Step 2.

    • OAUTH2_TOKEN is the access token you created in Step 1.

    • SERVICE_ACCOUNT_EMAIL is the email address of the service account you want to use to create the signature. For example,

If successful, the signature is returned in the signedBlob field in the response.

What's next