Programmatically creating OAuth clients for IAP

This page describes how to programmatically create OAuth clients for use with IAP, enabling you to set up IAP programmatically end-to-end for internal applications.

Known limitations

There are a few limitations for OAuth clients created programmatically using this API:

  • OAuth clients created by the API can only be modified by using the API. You cannot modify an OAuth client via the Google Cloud console if it was created by using the API.
  • The OAuth clients created by the API are locked for IAP usage only, and therefore the API does not allow any updates to the redirect URI or other attributes.
  • The API does not operate on the OAuth clients that were created using the Google Cloud console.
  • Only 500 OAuth clients are allowed per project when using the API.
  • API-created OAuth consent screen brands have specific limitations. See the section below for more information.

Understanding brands and branding state

The OAuth consent screen, which contains branding information for users, is known as a brand. Brands can be limited to internal users or public users. An internal brand makes the OAuth flow accessible to someone who belongs to the same Google Workspace organization as the project. A public brand makes the OAuth flow available to anyone on the internet.

Brands can be created manually or programmatically via an API. API-created brands are automatically configured with different settings:

  • They're set to internal and must be manually set to public if desired
  • They're set to an "unreviewed" state and a brand review must be triggered

To manually set an internal brand to public:

  1. Open the OAuth consent screen.
  2. Select your desired project from the drop-down menu.
  3. On the OAuth consent screen page, note that the User Type is automatically set to Internal. To set it to Public, click Edit App. More configuration options become available.
  4. Under Application type, click Public.

To trigger a brand review for an unreviewed API-created brand:

  1. Open the OAuth consent screen.
  2. Select your desired project from the drop-down menu.
  3. On the OAuth consent screen page, enter any required information, and then click Submit for verification.

The verification process may take up to several weeks, and you will receive email updates as it progresses. Learn more about verification. While the verification process is ongoing, you can still use the application within your Google Workspace organization.