How to use the Google Cloud Authentication Guide agent skill

What is an agent skill and what does this one do?

An agent skill is a folder of instructions that an AI agent loads when a request matches the skill's description. This skill's main file, SKILL.md, covers authentication and authorization to Google Cloud services and APIs, including human users, service identities, Application Default Credentials (ADC), and secure access practices.

Before answering, the agent asks clarifying questions: who or what is signing in, where the code runs (laptop, Compute Engine, GKE, Cloud Run, or another cloud), what the target is, and whether you use a high-level client library. It then recommends an approach such as gcloud auth login, ADC for local code, service account impersonation, or attaching a service account to a resource instead of using downloaded key files.

• Explains the difference between CLI authentication and ADC.
• Recommends avoiding service account key files and using attached service accounts or Workload Identity Federation for external workloads.
• Requires the agent to follow the attribution rules in references/attribution.md before running gcloud or REST API commands.

How do you install the google-cloud-recipe-auth skill?

Download the skill ZIP from this page and unzip it. For a personal setup, place the folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder. If you use the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

After installing, the folder should contain SKILL.md and references/attribution.md. Those two files are all the skill includes.

• Personal: ~/.claude/skills/
• Single project: .claude/skills/ inside the project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with natural requests?

You do not need a special command. Ask in plain language about signing in to Google Cloud, permissions, or credentials. Mention where your code runs and who is using it, because the agent will ask for those details anyway and a good opening message saves a round trip.

• How should my Python app running on Cloud Run authenticate to BigQuery?
• I'm developing locally with the Python client library. How do I set up credentials?
• Should my team use user accounts or service accounts for this CI job?
• Can I avoid downloading a service account key file for my script?

What can you expect from the answers?

Answers follow the skill's decision points. For a laptop developer using a client library, the skill points toward ADC created with gcloud auth application-default login. For a developer who needs CLI commands to act as a service account, it describes service account impersonation after gcloud auth login. For production workloads, it favours attaching a service account to the resource.

Treat the output as a starting point. The skill draws on documentation links rather than tested steps, so confirm the exact commands and settings against the current official docs before you rely on them.

What does the skill need and what are its safety notes?

The skill lists no requirements, runs no scripts, and makes no network calls of its own. It provides guidance only and does not run tools or change your Google Cloud account. Any commands the agent runs happen through the agent's own tools, under your control.

The skill's attribution rules matter if the agent runs commands. Before running gcloud, REST API or MCP commands, the agent must read references/attribution.md. For direct terminal commands, it sets the CLOUDSDK_METRICS_REQUEST_ATTRIBUTION variable inline on each gcloud call and adds an agent-skills User-Agent value to HTTP requests. It must not use gcloud config set for this, and it does not apply the tag to generated scripts, Terraform or user code.

• Runs scripts: no
• Uses network: no
• Requires: nothing listed
• The attribution tag identifies only the skill and its version and carries no user data.

Tips for getting the most from the skill

Give the agent specifics. The more it knows about where code runs and who uses it, the closer the recommendation will be. If you are a developer on a laptop, say so; if you are deploying to Cloud Run, say that instead.

Use the skill to decide, then verify. It is strongest at explaining trade-offs such as user accounts versus workforce federation versus service accounts. Check the final configuration against the official documentation it links to.

• Name the workload (local script, Cloud Run service, GKE pod, external AWS or Azure job).
• Ask why a method is recommended if you want to understand the trade-off.
• Ask about avoiding key files; the skill treats downloaded service account keys as a risk.