This page documents production updates to IAP. You can periodically check this page for announcements about new or updated features, bug fixes, known issues, and deprecated functionality.
Current version: release
You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.
To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.
June 24, 2026
Identity-Aware Proxy (IAP) supports securing agent-to-anywhere egress for Agent Gateway. The feature generally available GA. To learn more about IAP support for Agent Gateway, see IAP for agents overview.
April 22, 2026
Identity-Aware Proxy (IAP) supports securing agent-to-anywhere egress for Agent Gateway. The feature is in Preview. To learn more about IAP support for Agent Gateway, see IAP for agents overview.
March 13, 2026
You can configure custom OAuth clients in Identity-Aware Proxy by using the Google Cloud console; the feature is generally available (GA). You must use custom OAuth clients to do the following:
Configure IAP for users who are outside of an organization.
Customize the OAuth consent screen with custom branding.
Provide default OAuth clients for inherited applications across all IAP-protected resources at the organization or project level.
For more information, see Use custom OAuth clients with IAP.
September 20, 2024
Preview: You can now use authorization policies to delegate authorization to Identity-Aware Proxy (IAP) and Identity and Access Management (IAM). For more information, see Use authorization policies to delegate authorization to IAP and IAM.
May 29, 2020
The ability to authenticate users with external identities is now generally available.
February 12, 2020
API for OAuth clients now generally available
You can now programmatically create OAuth clients in IAP via REST or gcloud. See this topic for more information.
August 31, 2017
Welcome to the Cloud IAP general release for App Engine standard environment, Compute Engine, and GKE!
Java code samples were updated with security enhancements on August 15, 2017. If you're using the Java signed headers code sample, please update your application per the current samples.
AJAX requests with missing or expired credentials will now get an HTTP 401 response instead of being served a Google login page.
Cloud IAP now supports Cloud Audit Logging. Learn about enabling Cloud Audit Logging.
When you use the programmatic authentication feature, the aud claim in the JWT must now be the Cloud IAP client ID. Previously, it could also be the application URL. For applications that used programmatic authentication recently, we placed this feature on our whitelist. We will remove the functionality on November 15, 2017. For details and updated code samples, refer to programmatic authentication.
Cloud IAP now supports desktop and command-line applications. Learn about authenticating from a desktop app.
Cloud IAP for App Engine flexible environment is still in beta. This feature is not covered by any SLA or deprecation policy and may be subject to backward-incompatible changes for App Engine flexible environment.
Due to internal security enhancements, App Engine standard environment apps no longer require login: required in app.yaml (or security-constraint for Java).
Forseti Security is now available and strongly encouraged for Compute Engine apps. If you have any questions or require assistance, please post to discuss@forsetisecurity.org.
August 07, 2017
Cloud IAP can once again be enabled for App Engine flexible environment apps.
July 20, 2017
Cloud IAP now supports special URLs to help you enhance and personalize your app.
July 14, 2017
Cloud IAP now uses the following values when you secure your app with signed headers:
- The JWT is now in the HTTP request header
x-goog-iap-jwt-assertioninstead ofx-goog-authenticated-user-jwt. - When you verify the ID token payload, the
audvalue should now be a string with client ID details instead of a URL.
July 11, 2017
Added best practices for caching.