---
title: "Start Google Cloud sign-in"
method: POST
path: "/v1/cloud-google-authorizations"
tags: ["Cloud observation"]
---

# Start Google Cloud sign-in

`POST /v1/cloud-google-authorizations`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/v1/cloud-google-authorizations`
- Auth: HTTP bearer

Requires a current team administrator. This browser consent flow is completed by the hosted Nodus console. It creates a one-time state and PKCE challenge. The console opens authorization_url in a new window and Google redirects to /clouds/google/callback/ on the configured Nodus console origin. The callback sends state and code only to that same-origin console through postMessage or BroadcastChannel. The console verifies the pending state and calls the authorize endpoint as the same administrator. Keep the console tab open during consent. External applications and CLI clients cannot supply a custom callback URL or receive these credentials. Direct customers to the Compute page at https://console.nodus-compute.ai/console/?view=compute to connect, then list their cloud connections through the API. Requests online cloud-platform access for temporary project setup. No offline refresh token is requested.

## Response `201`

Start Google Cloud sign-in

- GoogleCloudAuthorizationResponse
  - `authorization` GoogleCloudAuthorization, required: Temporary setup authorization owned by the consenting team administrator. No Google tokens or private federation configuration are returned.
    - `id` string, required
    - `state` 'consent' | 'exchanging' | 'authorized' | 'connecting' | 'completed' | 'cancelled', required
    - `expires_at` string, date-time, required
    - `session_id` string
    - `step` integer, required
    - `billing_status` 'not_requested' | 'preparing' | 'ready' | 'needs_setup', required
  - `authorization_url` string, uri
  - `projects` GoogleCloudProject[]
    - `id` string, required
    - `name` string, required
  - `next_page_token` string
  - `message` string
  - `session` CloudOnboardingSession: Setup expires after 24 hours. Expired pending records remain readable with their original expiry and cannot complete. Only unexpired pending records appear in the active list.
    - `id` string, required: Opaque server-generated setup identity.
    - `provider` 'aws' | 'gcp', required
    - `name` string, required
    - `regions` string[], required: AWS enabled account regions when empty. Always an array and empty for Google Cloud.
    - `role_name` string, required: Prepared AWS role name. Empty for Google Cloud.
    - `state` 'pending' | 'completed' | 'cancelled', required
    - `expires_at` string, date-time, required
    - `connection_id` string: Present after completion. A later disconnect does not remove this completion receipt.
    - `revision` integer, required
    - `created_at` string, date-time, required
    - `project_id` string: Google Cloud project ID. Required for GCP and omitted for AWS.
    - `billing_location` 'US' | 'EU': Location of the dedicated Google Cloud billing dataset. Defaults to US for GCP and is omitted for AWS.
    - `project_number` string: Google Cloud project number verified for this connection.
  - `connection` CloudObservationConnection
    - `id` string, required
    - `provider` 'aws' | 'gcp' | 'azure', required
    - `scope` string, required
    - `config` CloudObservationConfig, required: Account identity and read scope. Fields depend on the provider. Credentials are never returned.
      - `provider` 'aws' | 'gcp' | 'azure', required
      - `name` string, required
      - `role_arn` string
      - `project_id` string
      - `billing_table` string
      - `billing_location` string
      - `billing_scope` string
      - `directory_id` string
      - `subscription_id` string
      - `client_id` string
      - `regions` string[]
    - `state` 'pending' | 'collecting' | 'ready' | 'partial' | 'error', required
    - `last_attempt_at` string, date-time, nullable, required
    - `last_success_at` string, date-time, nullable, required
    - `created_at` string, date-time, required
  - `next_action` CloudOnboardingAction
    - `type` 'open_provider' | 'unavailable' | 'expired' | 'completed' | 'cancelled', required
    - `url` string, uri: Prepared AWS CloudFormation approval or Google Cloud Shell URL, present for open_provider.
    - `message` string: Explanation when guided setup is unavailable.
    - `setup_command` string: Reviewable Google Cloud Shell setup command. Present only for pending GCP setup. Does not contain credentials.

## Other responses

- `default`: Stable Nodus error and message fields.

---

[API](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api.md) - [All operations](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nodus-compute/apis/nodus-infrastructure-execution-api/revisions/a59210899d95?raw)