> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dodopayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workload Identity for Google Cloud

> Call the Dodo Payments API from Cloud Run, Compute Engine, or GKE with a Google-signed identity token for the service account of the workload.

A workload on Google Cloud can get a Google-signed identity token for its service account from the metadata server. Dodo Payments trusts this token through a `gcp` provider.

## Provider Settings

| Setting | Value |
| - | - |
| Provider type | `gcp` |
| Issuer | `https://accounts.google.com` (fixed) |
| Audience | Must be `https://live.dodopayments.com` or `https://test.dodopayments.com` |
| Replay protection | Not enforced. The audience and the `sub` pin replace it. |
| JWT lifetime | 1 hour or less. |

## Required Claims

The mapping must pin `sub` with the numeric unique id of the service account. Do not use the email of the service account. To find the unique id, run:

```bash theme={null}
gcloud iam service-accounts describe billing@my-project.iam.gserviceaccount.com \
  --format='value(uniqueId)'
```

```json theme={null}
[
  { "claim": "sub", "value": "112233445566778899000" }
]
```

## Get the Token

Cloud Run, Compute Engine, and GKE with Workload Identity have a metadata server. The `gcp()` helper requests the token from it with the Dodo Payments audience. To get the token yourself:

```bash theme={null}
PLATFORM_JWT=$(curl -sS -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=https://live.dodopayments.com")
```

## SDK Usage

```typescript TypeScript theme={null}
import DodoPayments from 'dodopayments';

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.gcp(),
  },
});
```

```python Python theme={null}
import os
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, gcp

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=gcp(),
    ),
)
```

```go Go theme={null}
client := dodopayments.NewClient(
	option.WithEnvironmentLiveMode(),
	option.WithWorkloadIdentity(option.WorkloadIdentity{
		IdentityProviderID: os.Getenv("DODO_PAYMENTS_IDENTITY_PROVIDER_ID"),
		Provider:           workloadidentity.GCP(""),
	}),
)
```

Set `DODO_PAYMENTS_IDENTITY_PROVIDER_ID` on the Cloud Run service or the instance:

```bash theme={null}
gcloud run services update billing-api \
  --service-account billing@my-project.iam.gserviceaccount.com \
  --set-env-vars DODO_PAYMENTS_IDENTITY_PROVIDER_ID=wip_...
```

The SDK refreshes the Dodo token before it expires, thus a long-running service needs no stored secret. Refer to [SDK Usage](https://docs.dodopayments.com/developer-resources/workload-identity/sdk-usage.md) for the other languages.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.