gcloud iam workload-identity-pools providers keys create (KEY : --location=LOCATION --provider=PROVIDER --workload-identity-pool=WORKLOAD_IDENTITY_POOL) --spec=SPEC --use=USE [--async] [GCLOUD_WIDE_FLAG …]
my-keygcloud iam workload-identity-pools providers keys create my-key --location="global" --workload-identity-pool="my-workload-identity-pool" --provider="my-provider" --use="ENCRYPTION" --spec="RSA_4096"
To set the project attribute:
key on the command line with a fully specified
name;
--project on the command line;
core/project.
KEY
To set the key attribute:
key on the command line.
--location=LOCATIONlocation attribute:
key on the command line with a fully specified
name;
--location on the command line.
--provider=PROVIDERgcp- is reserved for use by Google, and may not be
specified.
To set the provider attribute:
key on the command line with a fully specified
name;
--provider on the command line.
--workload-identity-pool=WORKLOAD_IDENTITY_POOLgcp- is reserved for use by Google, and may
not be specified.
To set the workload-identity-pool attribute:
key on the command line with a fully specified
name;
--workload-identity-pool on the command line.
--spec=SPECSPEC must be one of:
key-spec-unspecified, rsa-2048, rsa-3072,
rsa-4096.
--use=USEUSE must be one of:
encryption, key-use-unspecified.
--async--access-token-file,
--account, --billing-project,
--configuration,
--flags-file,
--flatten, --format, --help, --impersonate-service-account,
--log-http,
--project, --quiet, --trace-token, --user-output-enabled,
--verbosity.
Run $ gcloud help for details.
iam/v1 API. The full documentation for this
API can be found at: https://cloud.google.com/iam/
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-05-27 UTC.