Cloud OAuth API overview

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This document describes the Cloud OAuth API (cloudoauth.googleapis.com), which provides OAuth 2.0 and OpenID Connect (OIDC) token exchange and authentication for Workforce Identity Federation.

The Cloud OAuth API authenticates Google Cloud users. Applications can exchange external credentials or authorization codes for short-lived OAuth 2.0 access tokens.

The API is based on the OAuth 2.0 Token Exchange (RFC 8693) and OAuth 2.0 Authorization Framework (RFC 6749) specifications.

Comparison with Security Token Service

Historically, Google Cloud's Security Token Service (sts.googleapis.com) handled token exchange for both Workforce Identity Federation and Workload Identity Federation.

The Cloud OAuth API supports the same token exchanges as Security Token Service but is dedicated to Workforce Identity Federation traffic. This separation isolates workforce token exchanges from workload traffic, helping prevent cross-service disruptions and allowing workforce capacity to scale independently of Security Token Service. Depending on your integration status, follow these guidelines:

• New integrations: Use the Cloud OAuth API (cloudoauth.googleapis.com).
• Existing integrations: If you use Security Token Service (sts.googleapis.com/v1/oauthtoken or sts.googleapis.com/v1/token), transition to cloudoauth.googleapis.com.

Organization-scoped endpoint

The Cloud OAuth API provides the organization-scoped (single-tenant) endpoint: https://cloudoauth.googleapis.com/v1/organizations/ORGANIZATION_ID/token

Use this endpoint when your application and resources are restricted to a single Google Cloud organization, providing isolated key management and discovery. Replace ORGANIZATION_ID with your numeric Google Cloud organization ID.

Supported endpoints

The Cloud OAuth API provides the following endpoints:

Endpoint	Method	Path	Description
Token exchange	POST	/v1/organizations/ORGANIZATION_ID/token	Exchanges authorization codes or refresh tokens for OAuth 2.0 access tokens and ID tokens.
User info	GET	/v1/organizations/ORGANIZATION_ID/userinfo	Retrieves OIDC standard claims for the authenticated user.
Enterprise groups	GET	/v1/common/groups	Retrieves paginated enterprise group memberships for the authenticated user.

Important: The /userinfo and /groups endpoints are available only for Looker.

What's next

• Exchange tokens with the Cloud OAuth API
• Retrieve user info with the Cloud OAuth API
• Retrieve enterprise groups with the Cloud OAuth API
• Manage OAuth applications for Workforce Identity Federation
• Cloud OAuth REST API reference