The Deployer documentation
Connecting your accounts

Connect Google Cloud

Google Cloud (GCP) is Google's cloud platform — a place to run servers and other services. In Google Cloud, your work lives inside a project (a named container for everything you build), and apps get access through a service account — a special non-human login meant for software rather than people. You'll create a service account, download its key file, and paste that plus two more details into The Deployer.

Current credential model. The Deployer connects to Google Cloud with a long-lived service-account JSON key, and deploys currently need a broad role. Use a dedicated Google Cloud project for The Deployer's resources, so the key can't reach unrelated production systems, and a service account used by nothing else. Workload identity federation is planned. See Permissions & security.

What you'll collect

  • A Service Account JSON key — a small text file you'll paste the contents of.
  • Project ID — the unique id of your Google Cloud project (not its display name).
  • Region — where your servers physically run (for example us-central1).

Step 1 — Pick or create a project, and find its ID

  1. Go to console.cloud.google.com and sign in.
  2. Use the project picker at the top of the page to select an existing project, or create a new one.
  3. Note the Project ID — you'll see it in the project picker and on the dashboard. It's a lowercase id like my-app-42731, which may differ from the friendly name you chose.

Step 2 — Turn on billing and the APIs

For The Deployer to build things, the project needs billing enabled and a few Google services switched on:

  1. Make sure the project has a billing account attached (Billing in the left menu).
  2. In APIs & Services, enable the Compute Engine, Cloud DNS, Cloud Monitoring, and Cloud Resource Manager APIs. (Enabling an API just switches it on.)

Step 3 — Create a service account

  1. In the left menu open IAM & Admin → Service Accounts.
  2. Click Create service account and give it a name like deployer.
  3. When asked to grant it a role, choose Editor or Owner on the dedicated project. Deploys currently need this broad access to create and manage resources without permission errors. Finish creating it.

A "role" is a bundle of permissions. We don't yet publish a least-privilege role for each architecture, and a role missing a permission a deploy needs is the most common cause of a deploy stopping halfway. Granting the role on a project that holds nothing else is what keeps this contained. See Permissions & security.

Step 4 — Create and download the JSON key

  1. Open the service account you just made and go to its Keys tab.
  2. Click Add key → Create new key, choose JSON, and click Create.
  3. A .json file downloads to your computer. Open it in a plain text editor — it's a block of text starting with { and containing lines like "type": "service_account".

Step 5 — Paste everything into The Deployer

  1. In The Deployer, open Connections from the left sidebar.
  2. Under Cloud providers, click Add provider and choose Google Cloud.
  3. In Label, type a name for yourself, e.g. My Google Cloud.
  4. Fill in the fields:
    • Service Account JSON — open the downloaded .json file, select all of its contents, and paste the whole thing into this box.
    • GCP Project ID — type your project's id from Step 1.
    • Default Region (e.g. us-central1) — type your chosen region code.
  5. Click Connect & verify.

The Deployer signs in with the key to confirm it works. A verified badge means you're set; an error usually means the JSON wasn't pasted in full, the wrong project ID, or the APIs from Step 2 aren't enabled yet.

The JSON key is required

The form marks the Service Account JSON box as optional, but you need to paste a key: a connection without one can't reach your project. If your organization blocks service-account key downloads, ask your administrator for an exception for the dedicated project; keyless workload identity federation is planned but not available yet.

Choosing a region

A region is the physical location of your data center. Pick one near most of your users so the app feels faster; enter the short code, e.g. us-central1, europe-west1, or asia-south1.

Safety notes

  • The JSON key is a credential — treat the file like a password. Don't share it or leave copies lying around.
  • The Deployer encrypts the key before storing it. It's used by the deployment engine and isn't placed in AI prompts.
  • Service-account keys don't expire by default. Rotate the key on a schedule.
  • To rotate a key later, create a new one in Google Cloud and use Replace credentials in The Deployer — see Viewing & replacing your credentials.

The Resources links and video below walk through creating a service account key. Once Google Cloud shows verified, you can create a project.