{"id":23803,"library":"google-cloud-iap","title":"Google Cloud IAP","description":"Python client library for Google Cloud Identity-Aware Proxy (IAP). Current version 1.21.0, requires Python >=3.9. Released as part of the google-cloud-python monorepo with regular updates.","status":"active","version":"1.21.0","language":"python","source_language":"en","source_url":"https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-iap","tags":["google-cloud","iap","identity-aware-proxy","gcp","security"],"install":[{"cmd":"pip install google-cloud-iap","lang":"bash","label":"Install via pip"}],"dependencies":[],"imports":[{"note":"Wrong: iap module is not a top-level attribute; use submodule path.","wrong":"from google.cloud import iap","symbol":"IdentityAwareProxyOAuthServiceClient","correct":"from google.cloud.iap import IdentityAwareProxyOAuthServiceClient"}],"quickstart":{"code":"from google.cloud import iap_v1\nfrom google.oauth2 import service_account\n\ncredentials = service_account.Credentials.from_service_account_file('/path/to/key.json')\nclient = iap_v1.IdentityAwareProxyOAuthServiceClient(credentials=credentials)\nprint('Client created successfully')","lang":"python","description":"Initializes the IAP client using service account credentials."},"warnings":[{"fix":"Import from google.cloud.iap_v1 or google.cloud.iap_v1beta1 explicitly.","message":"The library provides multiple subpackages (iap_v1, iap_v1beta1). Import the specific version you need, not the top-level 'iap' (which may not exist).","severity":"gotcha","affected_versions":"all"},{"fix":"Ensure the service account has roles/iap.httpsResourceAccessor on the target IAP resource.","message":"IAP client requires a service account with the 'IAP-secured Web App User' role. Without it, you'll get permission errors even with valid credentials.","severity":"gotcha","affected_versions":"all"},{"fix":"Update dependencies: pip install --upgrade google-cloud-iap googleapis-common-protos google-api-core","message":"The google-cloud-iap library uses googleapis-common-protos and google-api-core; ensure they are up-to-date to avoid import errors.","severity":"deprecated","affected_versions":">=1.0.0"}],"env_vars":null,"last_verified":"2026-05-01T00:00:00.000Z","next_check":"2026-07-30T00:00:00.000Z","problems":[{"fix":"Use 'from google.cloud import iap_v1' or 'from google.cloud.iap_v1 import IdentityAwareProxyOAuthServiceClient'.","cause":"Trying to import 'iap' directly from google.cloud instead of using the versioned subpackage.","error":"ImportError: cannot import name 'iap' from 'google.cloud'"},{"fix":"Grant the service account roles/iap.httpsResourceAccessor on the App Engine or GKE resource, and use ID tokens (not access tokens) for IAP-authenticated requests.","cause":"Service account missing the IAP-secured Web App User role or not using OAuth2 tokens for IAP.","error":"google.api_core.exceptions.PermissionDenied: 403 Request had insufficient authentication scopes."}],"ecosystem":"pypi","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}