Connect Google Cloud STS to Your AI Agent

Request a token for an established identity federation connection and check its lifetime before use.

1 tools Federated

Try a Google Cloud STS Task

Copy a prompt into your agent with the oo Skill installed. Add your page links and source notes before running it.

oo Skill Google Cloud STS

Request a Short-Lived Token

Obtain a federated access token and inspect its expiry and account context.

/oo Google Cloud STS: Use my configured Google Cloud STS federated connection to obtain an access token with scopes [OAuth scopes]. If impersonation is needed, use service account [service account email]. Show the expiry, scopes, and account context; keep the token out of the written summary.

Start Working with Google Cloud STS

Install OOMOL

Set up oo CLI and the oo Skill in your agent.
Install OOMOL →
Connect Google Cloud STS

Configure a Google Cloud Workload Identity Provider that trusts the OOMOL OIDC identity.
Connect Google Cloud STS →
Give Your Agent a Task

Use /oo with the pages to read, the changes to make, and where to save the result.
Connection Guide →

Choose Your Agent

Codex Claude Code Cursor Hermes

A workload identity provider resource, appropriate IAM permissions, and an OOMOL product capable of federated authentication.
If using service account impersonation, supply the authorized service account email. OAuth scopes do not replace IAM permissions.

Google Cloud STS Tools

The connection exchanges OOMOL OIDC identity through Google Cloud Workload Identity Federation. It can use direct federation or an authorized service account and returns a temporary access token.

Issue Federated Access Tokens

Retrieve a temporary Google Cloud token and its expiry, scope, and service account information.

1 tools

Get Federated Access Token

Exchange the connected OOMOL OIDC token with Google Cloud Workload Identity Federation and return a Google Cloud access token.

gcloud_sts.get_federated_access_token

Frequently Asked Questions

Do I need a service account key file?

This connection uses workload identity federation rather than a long-lived service account key file. The trust and permissions must be configured in Google Cloud.

Can I use a service account?

Yes, when the federation is allowed to impersonate it. Save its email on the connection or supply it when needed.

How do I know when access ends?

The result includes token expiration and scope information. Obtain another token through the federated connection when the current one expires.