Device Certificate Authorization (DCA) enables Context-aware access to identify devices by their X.509 certificates. DCA for Google Cloud APIs is the second in a series of releases that provides administrators the capability to protect access to their Google Cloud resources with device certificates. This feature builds on top of the existing Context-aware access suite (Endpoint Verification, Access Context Manager, and VPC Service Controls) and ensures that only users on trusted devices with a Google-generated certificate are able to access Google Cloud APIs. This provides a stronger signal of device identity (device certificate verification), and protects users from credential theft to accidental loss by only granting access when credentials and the original device certificate are presented.
To use this feature, organizations can follow the instructions below to install an endpoint verification agent to devices:
enterprise-certificate-proxy can be installed by running $ gcloud components install
enterprise-certificate-proxy.
In order to use enterprise-certificate-proxy it must first be configured. By
default the configuration should be written to
~/.config/gcloud/certificate_config.json.
The enterprise-certificate-proxy schema is documented on the GitHub project page. Each operating system that gcloud supports uses a different key store. The certificate_config may contain multiple OS configurations.
Provisioning the key stores is not in scope for this document.
Run $ gcloud config
set context_aware/use_client_certificate True
See https://cloud.google.com/sdk/gcloud/reference/topic/client-certificate for the support list for the latest version of the gcloud CLI. Please upgrade the gcloud command-line tool if necessary.
Note: iap_tunnel is a special service gcloud CLI uses to create the IAP tunnel.
For example, gcloud compute
start-iap-tunnelgcloud alpha topic client-certificategcloud beta topic client-certificate
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-05-27 UTC.
