For an overview of authentication at Google, see Authentication at Google.
Authenticate to Google APIs
Google APIs require a valid access token or API key with every request. How you provide these required credentials depends on where your code is running and what types of credentials the API accepts.
Use the client libraries and Application Default Credentials
The recommended way to use Google APIs is to use a client library and Application Default Credentials (ADC).
Application Default Credentials (ADC) is a strategy used by the authentication libraries to automatically find credentials based on the application environment. The authentication libraries make those credentials available to Cloud Client Libraries and Google API Client Libraries. When you use ADC, your code can run in either a development or production environment without changing how your application authenticates to Google Cloud services and APIs.
How you set up ADC depends on where your code is running. ADC supports both authenticating as a service account and authenticating as a user.
Authenticate from Google Kubernetes Engine (GKE)
You use Workload Identity Federation for GKE to enable your workloads running on GKE to securely access Google APIs. Workload Identity Federation for GKE lets a GKE service account in your GKE cluster act as an Identity and Access Management (IAM) service account.
Authenticate from Knative serving
You authenticate your Knative serving services by using Workload Identity Federation for GKE, which lets you access Google APIs.
Use an API that accepts API keys
If an API supports API keys, an API key can be provided with a request instead of the access token. API keys associate the request with a Google Cloud project for billing and quota purposes.
To determine whether an API supports API keys, see the documentation for your API.
Use self-signed JSON Web Tokens (JWTs)
Some Google APIs support self-signed JSON Web Tokens (JWTs) instead of access tokens. Using a self-signed JWT lets you avoid making a network request to Google's authorization server. This approach requires that you create your own signed JWT. For more information about tokens, see Tokens overview.
Use the authentication libraries and packages
If ADC and the OAuth implementation provided by the Cloud Client Libraries or Google API Client Libraries isn't available in your environment, you can use the authentication libraries and packages.
The following authentication libraries and packages are available: