Workload Identity for Google Cloud - Dodo Payments Documentation

A workload on Google Cloud can get a Google-signed identity token for its service account from the metadata server. Dodo Payments trusts this token through a gcp provider.

Provider Settings

Setting	Value
Provider type	`gcp`
Issuer	`https://accounts.google.com` (fixed)
Audience	Must be `https://live.dodopayments.com` or `https://test.dodopayments.com`
Replay protection	Not enforced. The audience and the `sub` pin replace it.
JWT lifetime	1 hour or less.

Required Claims

The mapping must pin sub with the numeric unique id of the service account. Do not use the email of the service account. To find the unique id, run:

gcloud iam service-accounts describe billing@my-project.iam.gserviceaccount.com \
  --format='value(uniqueId)'

[
  { "claim": "sub", "value": "112233445566778899000" }
]

Get the Token

Cloud Run, Compute Engine, and GKE with Workload Identity have a metadata server. The gcp() helper requests the token from it with the Dodo Payments audience. To get the token yourself:

PLATFORM_JWT=$(curl -sS -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=https://live.dodopayments.com")

SDK Usage

import DodoPayments from 'dodopayments';

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.gcp(),
  },
});

import os
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, gcp

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=gcp(),
    ),
)

client := dodopayments.NewClient(
	option.WithEnvironmentLiveMode(),
	option.WithWorkloadIdentity(option.WorkloadIdentity{
		IdentityProviderID: os.Getenv("DODO_PAYMENTS_IDENTITY_PROVIDER_ID"),
		Provider:           workloadidentity.GCP(""),
	}),
)

Set DODO_PAYMENTS_IDENTITY_PROVIDER_ID on the Cloud Run service or the instance:

gcloud run services update billing-api \
  --service-account billing@my-project.iam.gserviceaccount.com \
  --set-env-vars DODO_PAYMENTS_IDENTITY_PROVIDER_ID=wip_...

The SDK refreshes the Dodo token before it expires, thus a long-running service needs no stored secret. Refer to SDK Usage for the other languages.

Last modified on October 28, 2026