GCP

Cloud Service account key Windmill docs

Call Google Cloud services from any Windmill script, flow or app with a service account.

Set up in 2 steps

Create a service account and a key

In the Google Cloud console, open IAM & Admin, then Service Accounts. Create one, grant it the roles your scripts need, then add a key and download the JSON.

Add the resource in Windmill

Open Resources, add a resource of type gcp_service_account, and paste the JSON — its fields map one to one.

Resource type

The shape of the credential every script on this page expects.

gcp_service_account

View raw schema →

Field	Type	Required
auth_provider_x509_cert_url	string	No
auth_uri	string	No
client_email	string	No
client_id	string	No
client_x509_cert_url	string	No
private_key	string	No
private_key_id	string	No
project_id	string	No
token_uri	string	No
type	string	No

Questions

Which roles should I grant?

Only what the scripts call. A service account key does not expire, so its blast radius is whatever you granted it, indefinitely.

Are my credentials stored on the hub?

Never. They live only in your own Windmill workspace, encrypted at rest.