Connect to Google Cloud Platform (GCP)

To understand how GCP supports OIDC through Workload Identity Federation, consult the GCP documentation.

1. Configure a Workload Identity Federation

   1. Navigate to the Google Cloud Console
   2. Navigate to IAM & Admin then Workload Identity Federation
   3. Click on Create Pool

2. Create an identity pool

   1. Enter a name for the pool, e.g. Vercel
   2. Enter an ID for the pool, e.g. vercel and click Continue

   

3. Add a provider to the identity pool

   1. Select OpenID Connect (OIDC) from the provider types
   2. Enter a name for the provider, e.g. Vercel
   3. Enter an ID for the provider, e.g. vercel
   4. Enter the Issuer URL, the URL will depend on the issuer mode setting:
      • Team: https://oidc.vercel.com/[TEAM_SLUG], replacing [TEAM_SLUG] with the path from your Vercel team URL
      • Global: https://oidc.vercel.com
   5. Leave JWK file (JSON) empty
   6. For the Audience field, you have two options:
      • Default audience (recommended): Select Default audience. GCP generates the audience URL automatically based on your provider configuration. You can copy this value from the provider details page after creation. When using this option, you must pass the same URL as the audience in your code. See the custom audience section below
      • Allowed audiences: Select Allowed audiences and enter https://vercel.com/[TEAM_SLUG] in the "Audience 1" field. This works without any additional code configuration
   7. Click Continue

   

4. Configure the provider attributes

   1. Assign the google.subject mapping to assertion.sub
   2. Click Save

   

5. Create a service account

   1. Copy the IAM Principal from the pool details page from the previous step. It should look like principal://iam.googleapis.com/projects/012345678901/locations/global/workloadIdentityPools/vercel/subject/SUBJECT_ATTRIBUTE_VALUE
   2. Navigate to IAM & Admin then Service Accounts
   3. Click on Create Service Account

   

6. Enter the service account details

   1. Enter a name for the service account, e.g. Vercel.
   2. Enter an ID for the service account, e.g. vercel and click Create and continue.

   

7. Grant the service account access to the project

   1. Select a role or roles for the service account, e.g. Storage Object Admin.
   2. Click Continue.

   

8. Grant users access to the service account

   1. Paste in the IAM Principal copied from the pool details page in the Service account users role field.
      • Replace SUBJECT_ATTRIBUTE_VALUE with owner:[VERCEL_TEAM]:project:[PROJECT_NAME]:environment:[ENVIRONMENT]. e.g. principal://iam.googleapis.com/projects/012345678901/locations/global/workloadIdentityPools/vercel/subject/owner:acme:project:my-project:environment:production.
      • You can add multiple principals to this field, add a principal for each project and environment you want to grant access to.
   2. Click Done.

   

9. Define GCP account values as environment variables

   Once you have configured your GCP project with OIDC access, gather the following values from the Google Cloud Console:

   Value	Location	Environment Variable	Example
   Project ID	IAM & Admin -> Settings	GCP_PROJECT_ID	my-project-123456
   Project Number	IAM & Admin -> Settings	GCP_PROJECT_NUMBER	1234567890
   Service Account Email	IAM & Admin -> Service Accounts	GCP_SERVICE_ACCOUNT_EMAIL	vercel@my-project-123456.iam.gserviceaccount.com
   Workload Identity Pool ID	IAM & Admin -> Workload Identity Federation -> Pools	GCP_WORKLOAD_IDENTITY_POOL_ID	vercel
   Workload Identity Pool Provider ID	IAM & Admin -> Workload Identity Federation -> Pools -> Providers	GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID	vercel

   Then, declare them as environment variables in your Vercel project.

   You are now ready to connect to your GCP resource from your project's code. Review the example below.

By default, the OIDC token's aud claim is set to https://vercel.com/[TEAM_SLUG]. Google recommends using the default audience for your workload identity pool provider, which follows the format:

You can copy this URL from the provider details page in the Google Cloud Console after creating the provider.

To use this audience, select Default audience when configuring the provider, and pass the same URL as the audience to getVercelOidcToken in your code:

import { getVercelOidcToken } from '@vercel/oidc';
 
const GCP_AUDIENCE = process.env.GCP_AUDIENCE!;
 
const token = await getVercelOidcToken({
  audience: GCP_AUDIENCE,
});

Add GCP_AUDIENCE as an environment variable in your Vercel project, set to the default audience URL from the provider details page.

In the following example, you create a Vercel function in the Vercel project where you have defined the GCP account environment variables. The function will connect to GCP using OIDC and use a specific resource provided by Google Cloud services.

Install the following packages:

pnpm i google-auth-library @ai-sdk/google-vertex ai @vercel/oidc

yarn add google-auth-library @ai-sdk/google-vertex ai @vercel/oidc

npm i google-auth-library @ai-sdk/google-vertex ai @vercel/oidc

bun add google-auth-library @ai-sdk/google-vertex ai @vercel/oidc

In the API route for this function, use the following code to perform the following tasks:

• Use google-auth-library to create an External Account Client
• Use it to authenticate with Google Cloud Services
• Use Vertex AI with Google Vertex Provider to generate text from a prompt

import { getVercelOidcToken } from '@vercel/oidc';
import { ExternalAccountClient } from 'google-auth-library';
import { createVertex } from '@ai-sdk/google-vertex';
import { generateText } from 'ai';
 
const GCP_PROJECT_ID = process.env.GCP_PROJECT_ID;
const GCP_PROJECT_NUMBER = process.env.GCP_PROJECT_NUMBER;
const GCP_SERVICE_ACCOUNT_EMAIL = process.env.GCP_SERVICE_ACCOUNT_EMAIL;
const GCP_WORKLOAD_IDENTITY_POOL_ID = process.env.GCP_WORKLOAD_IDENTITY_POOL_ID;
const GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID =
  process.env.GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID;
 
// Initialize the External Account Client
const authClient = ExternalAccountClient.fromJSON({
  type: 'external_account',
  audience: `//iam.googleapis.com/projects/${GCP_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GCP_WORKLOAD_IDENTITY_POOL_ID}/providers/${GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID}`,
  subject_token_type: 'urn:ietf:params:oauth:token-type:jwt',
  token_url: 'https://sts.googleapis.com/v1/token',
  service_account_impersonation_url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_SERVICE_ACCOUNT_EMAIL}:generateAccessToken`,
  subject_token_supplier: {
    // Use the Vercel OIDC token as the subject token
    getSubjectToken: getVercelOidcToken,
  },
});
 
const vertex = createVertex({
  project: GCP_PROJECT_ID,
  location: 'us-central1',
  googleAuthOptions: {
    authClient,
    projectId: GCP_PROJECT_ID,
  },
});
 
// Export the route handler
export const GET = async (req: Request) => {
  const result = generateText({
    model: vertex('gemini-1.5-flash'),
    prompt: 'Write a vegetarian lasagna recipe for 4 people.',
  });
  return Response.json(result);
};

This example uses GCP's recommended default audience for the workload identity pool provider:

import { getVercelOidcToken } from '@vercel/oidc';
import { ExternalAccountClient } from 'google-auth-library';
import { createVertex } from '@ai-sdk/google-vertex';
import { generateText } from 'ai';
 
const GCP_PROJECT_ID = process.env.GCP_PROJECT_ID;
const GCP_PROJECT_NUMBER = process.env.GCP_PROJECT_NUMBER;
const GCP_SERVICE_ACCOUNT_EMAIL = process.env.GCP_SERVICE_ACCOUNT_EMAIL;
const GCP_WORKLOAD_IDENTITY_POOL_ID = process.env.GCP_WORKLOAD_IDENTITY_POOL_ID;
const GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID =
  process.env.GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID;
 
const GCP_AUDIENCE = `https://iam.googleapis.com/projects/${GCP_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GCP_WORKLOAD_IDENTITY_POOL_ID}/providers/${GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID}`;
 
const authClient = ExternalAccountClient.fromJSON({
  type: 'external_account',
  audience: GCP_AUDIENCE,
  subject_token_type: 'urn:ietf:params:oauth:token-type:jwt',
  token_url: 'https://sts.googleapis.com/v1/token',
  service_account_impersonation_url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_SERVICE_ACCOUNT_EMAIL}:generateAccessToken`,
  subject_token_supplier: {
    getSubjectToken: () =>
      getVercelOidcToken({
        audience: GCP_AUDIENCE,
      }),
  },
});
 
const vertex = createVertex({
  project: GCP_PROJECT_ID,
  location: 'us-central1',
  googleAuthOptions: {
    authClient,
    projectId: GCP_PROJECT_ID,
  },
});
 
export const GET = async (req: Request) => {
  const result = generateText({
    model: vertex('gemini-1.5-flash'),
    prompt: 'Write a vegetarian lasagna recipe for 4 people.',
  });
  return Response.json(result);
};