[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[],[],null,["# Accessing the API\n\nWe recommend that you access Cloud Key Management Service via our high performance\n[Google API Client Libraries](/kms/docs/reference/libraries). These libraries,\nwhich connect to the Cloud KMS gRPC API, are provided in several\npopular programming languages.\n\nYou may also access Cloud KMS via our [REST\nAPI](/kms/docs/reference/rest). Thus, any language that supports sending HTTP\nrequests can access the API. However, most users will prefer a more idiomatic\nclient library.\n\nThere is also a web-based interface for\n[Cloud KMS on the Google Cloud console](https://console.cloud.google.com/security/kms), which allows for\nkey management operations. Encrypt and decrypt operations cannot be performed\nfrom the web interface.\n\nWe want to make accessing Cloud KMS a joy from every language and\nplatform, and work on that will be ongoing. If we're falling short in any way,\n[let us know](/kms/docs/support).\n\nPlatforms\n---------\n\nHow clients access the API may vary a bit depending on the platform on which the\ncode is running, particularly with respect to authentication.\n[Google Application Default Credentials](/docs/authentication/provide-credentials-adc) abstract away many of\nthe differences, but there are still some things to keep in mind. For more\ninformation about authentication, see the\n[authentication overview](/docs/authentication).\n\n### Compute Engine and Google Kubernetes Engine\n\nSoftware running on [Compute Engine](/compute), including Google Kubernetes Engine nodes,\ntypically authenticates using credentials automatically provisioned into the\nenvironment using the [attached service account](/compute/docs/access/create-enable-service-accounts-for-instances). The\nsame is true for Cloud KMS. Ensure that when you create an\ninstance, you give it access to the `https://www.googleapis.com/auth/cloudkms`\n(preferred because it supports the principle of least privilege) or\n`https://www.googleapis.com/auth/cloud-platform` OAuth scope.\n\nFor example: \n\n```\ngcloud compute instances create \"instance-1\" \\\n --zone \"us-east1-b\" \\\n --scopes \"https://www.googleapis.com/auth/cloudkms\"\n```\n\nFor more information, refer to the\n[Compute Engine documentation](/compute/docs/access/create-enable-service-accounts-for-instances#using) or the\n[GKE documentation](/kubernetes-engine/docs/how-to/role-based-access-control).\n\n### App Engine\n\nTo use Cloud KMS with App Engine:\n\n1. Give your App Engine service account (\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`@appspot.gserviceaccount.com`) [Identity and Access Management permissions](/kms/docs/iam) to manage and/or use your keys.\n2. Use the [Application Default Credentials](/docs/authentication/provide-credentials-adc), and specify the scope `https://www.googleapis.com/auth/cloudkms`. You can also specify the scope `https://www.googleapis.com/auth/cloud-platform`, but it includes broader scopes than just Cloud KMS.\n\nFor more information, refer to\n[Accessing the API](/appengine/docs/admin-api/accessing-the-api) and\n[Controlling access](/appengine/docs/admin-api/access-control)\nin the App Engine documentation.\n\n### Client authentication\n\nIf your application needs to authenticate your users directly, you can obtain\nand use credentials on their behalf. To learn more, see\n[User accounts](https://cloud.google.com/docs/authentication/use-cases#app-users)."]]
