This page shows you how to use the [Google Cloud `signBlob` method](https://docs.cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob.md.txt)
to create a [signature](https://docs.cloud.google.com/storage/docs/authentication/signatures.md.txt) from a string-to-sign or policy document. Signatures
are used as credentials in certains requests, such as [signed URLs](https://docs.cloud.google.com/storage/docs/access-control/signed-urls.md.txt). This
guide uses RSA keys for creating signatures.

> [!IMPORTANT]
> **Important:** The [Google-managed service account keys](https://docs.cloud.google.com/iam/docs/service-account-creds.md.txt#google-managed-keys) used by the `signBlob` method are rotated regularly. If you set an expiration time for a signature that is greater than 12 hours and generate the signature using the `signBlob` method, the signature is usable for at least 12 hours, but might stop working prior to the expiration time due to key rotation. Signatures generated using the `signBlob` method are best used for short-lived access to resources.

## Before you begin

1.


   Enable the Service Account Credentials API, if it is not already enabled.


   **Roles required to enable APIs**


   To enable APIs, you need the `serviceusage.services.enable` permission. If you
   created the project, then you likely already have this permission through the
   Owner role (`roles/owner`). Otherwise, you can get this permission through the
   Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
   [Learn how to grant roles](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

   [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=iamcredentials.googleapis.com&redirect=https://console.cloud.google.com)

   <br />

2. You must have the `iam.serviceAccounts.signBlob` permission for the service
   account that you use in this guide. The `iam.serviceAccounts.signBlob`
   permission is included in the `roles/iam.serviceAccountTokenCreator` role.

3. The service account that you use in this guide must have permission to
   perform the request encoded within the signature. For example, if the
   signature will be used to read object data from a bucket, the service
   account must have permission to read the object data.

## Create a signature

1. Have gcloud CLI [installed and initialized](https://docs.cloud.google.com/sdk/docs/install), which lets
   you generate an access token for the `Authorization` header.

2. Create a JSON file that contains the following information:

   ```json
   {
     "payload": "REQUEST_INFORMATION"
   }
   ```

   Where:
   - `REQUEST_INFORMATION` is a [string-to-sign](https://docs.cloud.google.com/storage/docs/authentication/signatures.md.txt#string-to-sign) or a [policy document](https://docs.cloud.google.com/storage/docs/authentication/signatures.md.txt#policy-document). For both, content must be base64-encoded.
3. Use [`cURL`](http://curl.haxx.se/) to call the IAM API with a
   [`signBlob`](https://docs.cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob.md.txt) request:

   ```
   curl -X POST --data-binary @JSON_FILE_NAME \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/SERVICE_ACCOUNT_EMAIL:signBlob"
   ```

   Where:
   - `JSON_FILE_NAME` is the name of the file you created
     in Step 2.

   - `SERVICE_ACCOUNT_EMAIL` is the email address of the
     service account you want to use to create the signature. For example,
     `example-service-account@my-pet-project.iam.gserviceaccount.com`.

   If successful, a *message digest* is returned in the `signedBlob` field in
   the response, which is base64 encoded.
4. To complete the signature, ensure the message digest is base64 decoded, and
   then hex-encode the message digest.

## What's next

- See the reference page for signing blobs with the [Google Cloud CLI](https://docs.cloud.google.com/sdk/gcloud/reference/iam/service-accounts/sign-blob).
- [Create a signed URL manually](https://docs.cloud.google.com/storage/docs/access-control/signing-urls-manually.md.txt), using the signature you created.
- [Create a signed URL with Google Cloud tools](https://docs.cloud.google.com/storage/docs/access-control/signing-urls-with-helpers.md.txt).
- Learn more about [signatures](https://docs.cloud.google.com/storage/docs/authentication/signatures.md.txt).