gcloud iam workforce-pools providers keys create (KEY : --location=LOCATION --provider=PROVIDER --workforce-pool=WORKFORCE_POOL) --spec=SPEC --use=USE [--async] [GCLOUD_WIDE_FLAG …]
my-keygcloud iam workforce-pools providers keys create my-key --location="global" --workforce-pool="my-workforce-pool" --provider="my-provider" --use="ENCRYPTION" --spec="RSA_4096"KEY
To set the key attribute:
key on the command line.
--location=LOCATIONlocation attribute:
key on the command line with a fully specified
name;
--location on the command line.
--provider=PROVIDERgcp- is reserved for use by Google, and may not be specified.
To set the provider attribute:
key on the command line with a fully specified
name;
--provider on the command line.
--workforce-pool=WORKFORCE_POOLgcp- is reserved for use by Google, and
may not be specified.
To set the workforce-pool attribute:
key on the command line with a fully specified
name;
--workforce-pool on the command line.
--spec=SPECSPEC must be one of:
key-spec-unspecified, rsa-2048, rsa-3072,
rsa-4096.
--use=USEUSE must be one of:
encryption, key-use-unspecified, signing.
--async--access-token-file,
--account, --billing-project,
--configuration,
--flags-file,
--flatten, --format, --help, --impersonate-service-account,
--log-http,
--project, --quiet, --trace-token, --user-output-enabled,
--verbosity.
Run $ gcloud help for details.
iam/v1 API. The full documentation for this
API can be found at: https://cloud.google.com/iam/
gcloud alpha iam workforce-pools providers keys creategcloud beta iam workforce-pools providers keys create
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-05-27 UTC.