[[["์ดํดํ๊ธฐ ์ฌ์","easyToUnderstand","thumb-up"],["๋ฌธ์ ๊ฐ ํด๊ฒฐ๋จ","solvedMyProblem","thumb-up"],["๊ธฐํ","otherUp","thumb-up"]],[["์ดํดํ๊ธฐ ์ด๋ ค์","hardToUnderstand","thumb-down"],["์๋ชป๋ ์ ๋ณด ๋๋ ์ํ ์ฝ๋","incorrectInformationOrSampleCode","thumb-down"],["ํ์ํ ์ ๋ณด/์ํ์ด ์์","missingTheInformationSamplesINeed","thumb-down"],["๋ฒ์ญ ๋ฌธ์ ","translationIssue","thumb-down"],["๊ธฐํ","otherDown","thumb-down"]],["์ต์ข ์ ๋ฐ์ดํธ: 2025-08-19(UTC)"],[],[],null,["# Authenticating to the DLP API\n\nYou must authenticate to the DLP API in order to use it. The\nDLP API can handle both API keys and authentication.\nThe main distinction between these two methods is:\n\n- API keys identify the calling project---the app or site---that is making the call to an API.\n- Auth tokens identify a user---the person---that is using the project.\n\nUsing an API key for unauthenticated access\n-------------------------------------------\n\nYou can use a Google Cloud console API key to authenticate to the\nDLP API for some methods, including all\n[`projects.content.*`](/sensitive-data-protection/docs/reference/rest/v2/projects.content)\nand\n[`projects.image.*`](/sensitive-data-protection/docs/reference/rest/v2/projects.image)\nmethods.\n\n1. Follow the instructions to [create an API key\n for your Google Cloud console project](https://support.google.com/cloud/answer/6158862).\n2. When making any DLP API request, pass your key as the value of a `key` parameter. For example: \n\n ```\n curl https://dlp.googleapis.com/v2/infoTypes?key=[YOUR_API_KEY]\n ```\n\nIt's important to protect your API keys against unauthorized use. For advice on\nhow to do this, see [Best practices for securely using API\nkeys](https://support.google.com/cloud/answer/6310037).\n| **Note:** When a Cloud Key Management Service wrapped key is used on [`deidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.content/deidentify) or [`reidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.content/reidentify) requests, API keys can't be used for authentication. Cloud Key Management Service does not support API keys as an authentication method. For more information, see [Accessing the API](/kms/docs/accessing-the-api).\n\nUsing a service account\n-----------------------\n\nTo use a service account to authenticate to the DLP API:\n\n- Follow the instructions to [create a service account](/iam/docs/creating-managing-service-accounts#creating_a_service_account). Select **JSON** as your key type, and grant the user the **DLP User** role (roles/dlp.user).\n\nFor more information about granting roles to service accounts, see\n[Granting Roles to Service Accounts](/iam/docs/granting-roles-to-service-accounts).\n| **Note:** Granting the user the **Owner** role is not necessary.\n\nOnce complete, your service account key is downloaded to your browser's\ndefault location.\n\nNext, decide whether you'll provide your service account authentication as a\n[*bearer token*](#bearer) or using\n[*application default credentials*](#default-creds).\n\n### Bearer tokens using a service account\n\nIf you're calling the DLP API directly, such as by making an\nHTTP request with cURL, you'll pass your authentication as a bearer token in an\nHTTP Authorization request header. To obtain a bearer token using your service\naccount:\n\n1. Install the [Google Cloud CLI](/sdk/downloads#interactive).\n2. Authenticate to your service account, replacing \\[KEY_FILE\\] below with the path to your service account key file: \n\n ```\n gcloud auth activate-service-account --key-file [KEY_FILE]\n ```\n3. Obtain an authorization token using your service account: \n\n ```\n gcloud auth print-access-token\n ```\n The command returns an access token value.\n4. When calling the API, pass the token value as a `bearer` token in an `Authorization` header: \n\n ```\n curl -s -H 'Content-Type: application/json' \\\n -H 'Authorization: Bearer [ACCESS_TOKEN]' \\\n 'https://dlp.googleapis.com/v2/infoTypes'\n ```\n\n### Application default credentials\n\nIf you're using a client library to call the DLP API, use\n[Application Default\nCredentials](https://developers.google.com/identity/protocols/application-default-credentials) (ADC).\n\nServices using ADC look for credentials within a\n`GOOGLE_APPLICATION_CREDENTIALS` environment variable. Unless you specifically\nwant to have ADC use other credentials (for example, user credentials), set\nthis environment variable to point to your service account key file. \n\n```\nexport GOOGLE_APPLICATION_CREDENTIALS=[PATH_TO_KEY_FILE]\n```\n\n### Using Sensitive Data Protection from Compute Engine VMs\n\nIn order to access the DLP API from VM instances, select\n**Allow full access to all Cloud APIs** under the **Identity and API Access**\nsection when creating the VM."]]
