> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/google-cloud/gcp-wif.md).

# GCP Workload Identity Federation

The **GCP Workload Identity Federation** integration lets P0 grant and revoke Google Cloud access for OIDC-authenticated agents. It creates a Workload Identity Pool and OIDC provider in your Google Cloud project, so an agent reaching Google Cloud through the [P0 AI Gateway](/readme/agentic-control-plane.md) gets short-lived, policy-scoped access with no long-lived credentials.

This component exists specifically to enable **agentic access to Google Cloud through the gateway**. The OIDC provider you register here is the gateway's own identity: the gateway signs a token, and Google Cloud trusts it through the Workload Identity Pool and provider this component creates.

{% hint style="info" %}
This component is in **preview**. It supports agentic access via the P0 AI Gateway and is a prerequisite for exposing Google Cloud to agents behind the gateway.
{% endhint %}

## Prerequisites

* The base [Google Cloud integration](/integrations/resource-integrations/google-cloud.md) with **IAM management** installed on the same project. GCP Workload Identity Federation builds on that integration's IAM-write access, and the project picker only lists projects where it's already installed.
* A deployed P0 AI Gateway. The **OIDC provider URL** you enter in the following fields comes from your gateway deployment. See [Deploying the P0 AI Gateway](/getting-started/deploying-the-p0-mcp-gateway.md).
* Permission to apply Terraform (or run the equivalent `gcloud` commands) in the target Google Cloud project, to create a Workload Identity Pool and provider.

## Install the Workload Identity Federation component

1. Navigate to **Integrations** on [p0.app](https://p0.app), select **GCP Workload Identity Federation**, and choose the **Workload Identity Federation** component.
2. Click **Add identity provider**.
3. Fill in the identity provider details, then click **Next**:

   * **Identifier**: a name for this identity provider within P0 (for example, the name of the gateway environment it serves). P0 derives the Workload Identity Pool and provider IDs from this name.
   * **GCP project ID**: the project to install into. The dropdown lists the projects where the base Google Cloud integration's IAM management is installed.
   * **OIDC provider URL**: the issuer (`iss`) URL of your OIDC provider. For the P0 AI Gateway, this is the gateway's OIDC issuer URL.

   P0 derives the **Audience** automatically from the Workload Identity Pool provider it creates, so you don't enter it.
4. P0 generates a Terraform configuration. Copy it into your Terraform project, `apply` it, then click **Next**.

   The generated configuration creates the Workload Identity Pool and OIDC provider that Google Cloud uses to trust the gateway's tokens:

   ```hcl
   resource "google_iam_workload_identity_pool" "p0_wif_pool" {
     project                   = local.project_id
     workload_identity_pool_id = "p0-wif-pool-<identifier>"
   }

   resource "google_iam_workload_identity_pool_provider" "p0_wif_provider" {
     project                            = local.project_id
     workload_identity_pool_id          = google_iam_workload_identity_pool.p0_wif_pool.workload_identity_pool_id
     workload_identity_pool_provider_id = "p0-wif-provider-<identifier>"

     attribute_mapping = {
       "google.subject" = "assertion.sub"
     }

     oidc {
       issuer_uri = local.oidc_provider_url
     }
   }
   ```

   The provider doesn't set `allowed_audiences`, so Google Cloud accepts tokens whose `aud` claim is the provider's own full resource name. P0 uses that resource name as the audience automatically.
5. Review the read-only summary and click **Finish**.
6. The identity provider now appears with the state **Installed**.

## How it works

When an agent requests Google Cloud access through the gateway, P0 adds the federated principal as an IAM member on the target resources, scoped to the agent's identity (`sub`). The gateway signs an OIDC token, and Google Cloud trusts it through the Workload Identity Pool and provider this component creates. P0 never issues long-lived Google Cloud credentials to the agent, and removes the IAM binding when the session ends or the agent relinquishes it.

## Next steps

* Configure an [MCP server](/integrations/resource-integrations/agentic-gateway/mcp-server.md) to expose Google Cloud to agents behind the gateway, using this Workload Identity Federation identity as its credential provider.