Hi @kapa.ai, how do I use Google Service account JWT to authenticate within airbyte.

Airbyte doesn’t describe a generic “Google Service Account JWT” flow in the docs, but it does support Google service accounts via JSON key files for many Google connectors, and it supports JWT-based auth for custom connectors. There are two main cases: ------------------------- 1. Using Google Service Accounts with built‑in Google connectors For standard Google sources/destinations (BigQuery, Google Drive, Google Sheets, Google Search Console, etc.), you don’t manually build a JWT. Instead, you provide the service account JSON key, and the connector handles the auth flow. Examples: • BigQuery source – configure with: ◦ `Credentials JSON`: contents of your service account key JSON file. [BigQuery source] • Google Drive source – for Airbyte Open Source, choose Service Account Key Authentication and paste the JSON key. [Google Drive source] • Google Sheets source – for Airbyte Open Source, use Service Account Key Authentication and paste the JSON key. [Google Sheets source] • Google Sheets destination – for Airbyte Open Source, choose GCP Service Account and paste the JSON key. [Google Sheets destination] • Google Search Console source – choose “Google service account with JSON key file” and provide that JSON. [Search Console source] In all these, the “JWT” part is handled internally by Google libraries / the connector; you just supply the JSON key. ------------------------- 2. Using JWT explicitly in a custom connector (non‑Google API) If you’re building your own connector (Connector Builder UI or low‑code CDK) and the API requires JWT: Connector Builder UI Use the JWT authentication method in the Authentication section: You configure: [Connector Builder JWT] • Secret Key (your signing key) • Algorithm (e.g. RS256, HS256) • Header Prefix (e.g.

Bearer

) • Optional: ◦ JWT headers (e.g.

kid

,

cty

) ◦ JWT payload fields (e.g.

iss

,

sub

,

aud

) ◦ Token duration ◦ Base64‑encode secret key (if required by the API) The connector then automatically generates and sends:

Authorization: Bearer <jwt-token>

on each request. Low‑code CDK (YAML) Use the

JwtAuthenticator

in your

spec.yaml

/ manifest: [JWT Authenticator]

authenticator:
  type: JwtAuthenticator
  secret_key: "{{ config['secret_key'] }}"
  base64_encode_secret_key: True
  algorithm: RS256
  token_duration: 3600
  header_prefix: Bearer
  jwt_headers:
    kid: "{{ config['kid'] }}"
    cty: "JWT"
  additional_jwt_headers:
    test: "{{ config['test'] }}"
  jwt_payload:
    iss: "{{ config['iss'] }}"
    sub: "sub value"
    aud: "aud value"
  additional_jwt_payload:
    test: "test custom payload"

You then expose

secret_key

,

kid

,

iss

, etc. as config fields for the user. ------------------------- If you tell me which Google product or which API you’re targeting (e.g. “BigQuery as source”, “custom REST API with JWT”), I can point to the exact place in the UI / config where you should put the service account or JWT settings, based only on the docs. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.