Key Takeaways

• GCP KeyJSON (also called a service account key file) is a JSON-formatted credential that authenticates applications to Google Cloud services without human interaction.
• Each key contains a private key, client email, project ID, and certificate URL — enabling programmatic access to APIs and cloud resources.
• Security risk is the primary drawback: if a KeyJSON file is leaked, any attacker with the file can impersonate the service account until the key is deleted.
• Best practice is to rotate keys regularly, store them in secret managers (not source control), and prefer Workload Identity over static keys whenever possible.
• Google is actively pushing teams toward Workload Identity Federation as a replacement for static KeyJSON files, especially on GKE, Cloud Run, and Compute Engine.

What Is a GCP KeyJSON File?

Definition and Structure

A GCP KeyJSON file is a privately-held JSON credential associated with a Google Cloud service account. It is the standard mechanism for non-interactive authentication — allowing applications, CI/CD pipelines, and background services to prove their identity to Google Cloud APIs.

The file contains the following fields:

• type — Always "service_account"
• project_id — The Google Cloud project identifier
• private_key_id — Unique identifier for the key
• private_key — The RSA private key (PEM-encoded)
• client_email — The service account email address
• client_id — Numeric client ID of the service account
• auth_uri, token_uri, auth_provider_x509_cert_url, client_x509_cert_url — OAuth2 endpoint URLs

How It Works

When your application loads a KeyJSON file, the Google Cloud client libraries use the embedded private key to create a signed JWT (JSON Web Token). This JWT is exchanged at Google's token endpoint for an access token, which is then attached to API requests. The entire flow happens without any interactive login or human involvement.

This makes KeyJSON ideal for:

• Server-side applications running on virtual machines or containers
• CI/CD pipelines (Cloud Build, GitHub Actions, Jenkins)
• Background workers and cron jobs
• Local development environments

How to Create a GCP Service Account KeyJSON

Step-by-Step Process

1. Navigate to IAM > Service Accounts in the Google Cloud Console.
2. Create a new service account with a descriptive name and minimal required roles.
3. Add the "Key" tab to the service account and click "Add Key" → "Create new key."
4. Select JSON format and confirm creation. The file downloads automatically.
5. Store the file securely — never commit it to a public repository.

Creating via gcloud CLI

gcloud iam service-accounts create my-service-account \
  --display-name="My Service Account"

gcloud iam service-accounts keys create key.json \
  --iam-account=my-service-account@my-project.iam.gserviceaccount.com

Creating via Terraform

resource "google_service_account" "my_sa" {
  account_id   = "my-service-account"
  display_name = "My Service Account"
}

resource "google_service_account_key" "my_key" {
  service_account_id = google_service_account.my_sa.id
  rotation_period    = "31500s"  # 10 months
}

Advantages and Drawbacks: Industry Analysis

Advantages of GCP KeyJSON

Drawbacks and Security Concerns