Security Token Service API

The Security Token Service exchanges Google or third-party credentials for a short-lived access token to Google Cloud resources.

• REST Resource: v1beta
• REST Resource: v1
• REST Resource: v1.organizations.locations.workloadIdentityPools.openid
• REST Resource: v1.organizations.locations.workloadIdentityPools.well-known
• REST Resource: v1.projects.locations.workloadIdentityPools.openid
• REST Resource: v1.projects.locations.workloadIdentityPools.well-known

Service: sts.googleapis.com

Discovery document

A Discovery Document is a machine-readable specification for describing and consuming REST APIs. It is used to build client libraries, IDE plugins, and other tools that interact with Google APIs. One service may provide multiple discovery documents. This service provides the following discovery documents:

• https://sts.googleapis.com/$discovery/rest?version=v1
• https://sts.googleapis.com/$discovery/rest?version=v1beta

Service endpoint

A service endpoint is a base URL that specifies the network address of an API service. One service might have multiple service endpoints. This service has the following service endpoint and all URIs below are relative to this service endpoint:

• https://sts.googleapis.com

Regional service endpoint

A regional service endpoint is a base URL that specifies the network address of an API service in a single region. A service that is available in multiple regions might have multiple regional endpoints. Select a location to see its regional service endpoint for this service.

global africa-south1 asia-east1 asia-east2 asia-northeast1 asia-northeast2 asia-northeast3 asia-south1 asia-south2 asia-southeast1 asia-southeast2 asia-southeast3 asia-southeast4 australia-southeast1 australia-southeast2 europe-central2 europe-north1 europe-north2 europe-southwest1 europe-west1 europe-west10 europe-west12 europe-west15 europe-west2 europe-west3 europe-west4 europe-west6 europe-west8 europe-west9 me-central1 me-central2 me-west1 northamerica-northeast1 northamerica-northeast2 northamerica-south1 southamerica-east1 southamerica-west1 us-central1 us-central2 us-east1 us-east4 us-east5 us-east7 us-south1 us-west1 us-west2 us-west3 us-west4 us-west8

https://sts.googleapis.com

REST Resource: v1beta

Methods
token	POST /v1beta/token Exchanges a credential for a Google OAuth 2.0 access token.

REST Resource: v1

Methods
token	POST /v1/token Exchanges a credential for a Google OAuth 2.0 access token.

REST Resource: v1.organizations.locations.workloadIdentityPools.openid

Methods
getJwks	GET /v1/{name=organizations/*/locations/*/workloadIdentityPools/*}/openid/jwks Fetches the signing keys for an agentic or managed workload identity pool and returns them in JWK Set format, defined in RFC 7517.

REST Resource: v1.organizations.locations.workloadIdentityPools.well-known

Methods
getOpenid-configuration	GET /v1/{name=organizations/*/locations/*/workloadIdentityPools/*}/.well-known/openid-configuration Gets the OIDC provider configuration for an agentic or managed workload identity pool following the OIDC 1.0 discovery specification.

REST Resource: v1.projects.locations.workloadIdentityPools.openid

Methods
getJwks	GET /v1/{name=projects/*/locations/*/workloadIdentityPools/*}/openid/jwks Fetches the signing keys for an agentic or managed workload identity pool and returns them in JWK Set format, defined in RFC 7517.

REST Resource: v1.projects.locations.workloadIdentityPools.well-known

Methods
getOpenid-configuration	GET /v1/{name=projects/*/locations/*/workloadIdentityPools/*}/.well-known/openid-configuration Gets the OIDC provider configuration for an agentic or managed workload identity pool following the OIDC 1.0 discovery specification.