Introduction
In this example we authenticate against the Google AI Platform API using a service account, reading the account's private key from a file. This isn't the best way to authenticate against the AI platform; see the oauth-default example.
Creating a service account
Create a service account using the IAM and admin
section of the Google Cloud console. This service account needs to have the following roles:
- Project:
viewer
- Storage Object:
Admin
- ML Engine:
Admin
Once you've created the service account, download the key JSON file.
Getting an OAuth client in Go
The Google OAuth client is documented here. Here's the general idea:
import (
"google.golang.org/api/ml/v1"
"log"
"net/http"
"golang.org/x/oauth2"
"golang.org/x/oauth2/jwt"
"golang.org/x/oauth2/google"
)
...
conf := &jwt.Config{
Email: "<your service account>@<your project name>.iam.gserviceaccount.com",
PrivateKey: []byte("-----BEGIN PRIVATE KEY-----\n......\n-----END PRIVATE KEY-----\n"),
Scopes: []string{"https://www.googleapis.com/auth/cloud-platform"},
TokenURL: google.JWTTokenURL,
}
client := conf.Client(oauth2.NoContext)
Email
needs to match the address of your service account
- The private key is the base-64 encoded private key for the service account. Obviously, you should load this from an environment variable or file. Never hard-code private keys and never add them to version control
- The
cloud-platform
scope is required - see https://developers.google.com/identity/protocols/googlescopes#mlv1