# Google Cloud Serverless Authentication Service Account

## Summary

**Google Cloud Serverless Authentication Service Account** allows you to manually specify the service account credentials to support GCP's [Authorization Header](https://cloud.google.com/run/docs/authenticating/service-to-service) format.

If unspecified, the service account credentials will default to ambient credentials in the default locations searched by the Google SDK. This includes GCE metadata server tokens.

## How to configure

**Core:**

| **Config file keys** | **Environment variables** | **Type** | **Usage** |
| :-- | :-- | :-- | :-- |
| `google_cloud_serverless_authentication_service_account` | `GOOGLE_CLOUD_SERVERLESS_AUTHENTICATION_SERVICE_ACCOUNT` | `string` ([base64 encoded](https://en.wikipedia.org/wiki/Base64)) | **optional** |

See [Enable Google Cloud Serverless Authentication](https://www.pomerium.com/docs/reference/routes/enable-google-cloud-serverless-authentication.md) for more information.

### Examples

```yaml
google_cloud_serverless_authentication_service_account: base64-encoded-service-account-credentials
```

```bash
GOOGLE_CLOUD_SERVERLESS_AUTHENTICATION_SERVICE_ACCOUNT=base64-encoded-service-account-credentials
```

**Enterprise:**

**Kubernetes:**

Kubernetes does not support `google_cloud_serverless_authentication_service_account`