What can you do with the Google Cloud IAM integration?

LiveContext exposes 25 operations on Google Cloud IAM, covering service account, custom role, service account key and role. Common uses include automate service account management, automate custom role management and automate service account key management.

Which OAuth scopes does Google Cloud IAM require?

The operations that declare a scope all need https://www.googleapis.com/auth/cloud-platform.

LiveContext

All integrations

Google Cloud IAM integration

Google Cloud IAM API for managing identities and permissions. Create and manage service accounts, keys, custom roles, and grant permissions to control access to Google Cloud resources.

25 toolsOAuthAPI docs

Connect Google Cloud IAM How integrations work

Common Google Cloud IAM use cases

automate service account management
automate custom role management
automate service account key management
automate role management
automate service account iam policy management
get role programmatically
list role programmatically
sign blob programmatically
get custom role programmatically
list custom role programmatically

What you can do with Google Cloud IAM

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Service account, 8 operations

POSTcreate_service_account
Create a new service account in a project. Returns the created ServiceAccount resource.
DELETEdelete_service_account
Delete a service account. After deletion, the account's email cannot be reused for 30 days.
POSTdisable_service_account
Disable a service account so it can no longer authenticate. The account and its keys remain but all API calls using it will fail.
POSTenable_service_account
Re-enable a previously disabled service account so it can authenticate again.
GETget_service_account
Get details of a specific service account by its unique ID or email address.
GETlist_service_accounts
List all service accounts in a project. Returns a paginated list of ServiceAccount resources belonging to the specified project.
POSTundelete_service_account
Restore a soft-deleted service account within the 30-day recovery window after deletion.
PATCHupdate_service_account
Update an existing service account. Only displayName and description fields can be updated.

Custom role, 6 operations

POSTcreate_custom_role
Create a new custom role at the project level with a specific set of permissions.
DELETEdelete_custom_role
Soft-delete a custom role at the project level. The role enters a deleted state and can be undeleted within 7 days.
GETget_custom_role
Get the full definition of a custom role at the project level, including its permissions list.
GETlist_custom_roles
List all custom roles defined at the project level.
POSTundelete_custom_role
Restore a soft-deleted custom role at the project level. Must be done within 7 days of deletion.
PATCHupdate_custom_role
Update a custom role at the project level. Provide an updateMask to specify which fields to update.

Service account key, 4 operations

POSTcreate_service_account_key
Create a new key pair for a service account. The private key data is returned only once and cannot be retrieved again.
DELETEdelete_service_account_key
Delete a service account key. After deletion, the key can no longer be used to authenticate.
GETget_service_account_key
Get a specific key for a service account, optionally returning the public key data in PEM or RSA format.
GETlist_service_account_keys
List all keys for a service account, including both user-managed and system-managed keys.

Role, 2 operations

GETget_role
Get the definition of a predefined or custom role, including its title, description, and list of permissions.
GETlist_roles
List all predefined roles available in Google Cloud IAM, with optional filters for parent resource, deleted roles, and view level.

Service account iam policy, 2 operations

POSTget_service_account_iam_policy
Get the IAM access control policy for a service account resource. Returns the bindings and etag.
POSTset_service_account_iam_policy
Set the IAM access control policy for a service account resource. Replaces any existing policy.

Blob, 1 operation

POSTsign_blob
Sign arbitrary bytes using a service account's private key. Returns the signature as base64-encoded bytes.

Grantable role, 1 operation

POSTquery_grantable_roles
Query the roles that can be granted on a specific resource. Useful for discovering which roles are applicable to a resource type.

Testable permission, 1 operation

POSTquery_testable_permissions
Query the permissions that can be tested on a specific resource. Useful to discover all permissions applicable to a resource type.

OAuth scopes Google Cloud IAM requires

Each operation declares the scopes Google Cloud IAM requires for it.

https://www.googleapis.com/auth/cloud-platformneeded by create_custom_role, create_service_account, create_service_account_key and 22 more

Use Google Cloud IAM from Claude Code, Cursor or Codex

Connect Google Cloud IAM in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Google Cloud IAM operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Google Cloud IAM

Create your workspace
Sign up free. Nothing to install.
Connect Google Cloud IAM once
Add your Google Cloud IAM connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Google Cloud IAM integration FAQ

What can you do with the Google Cloud IAM integration?: LiveContext exposes 25 operations on Google Cloud IAM, covering service account, custom role, service account key and role. Common uses include automate service account management, automate custom role management and automate service account key management.
Which OAuth scopes does Google Cloud IAM require?: The operations that declare a scope all need https://www.googleapis.com/auth/cloud-platform.