Google Cloud credentials

Under Settings, Google Cloud, choose how the manager authenticates GCP instance roles:

• Manager's environment uses Application Default Credentials (ADC), such as an attached service account or workload identity. This is the default.
• Service account key accepts the JSON key downloaded from Google Cloud. Choose the file or paste its contents. Korta encrypts the key with the vault and never displays it again. Leave the field empty when editing to keep the existing key, or provide a new key to rotate it.

Use Test to check the stored service account can read its project through the Compute Engine API. A successful test does not verify permission to create instances or access every image and subnet. The manager must have the required permissions in the project and any Shared VPC host project.

The connection applies to all GCP roles. Changing it invalidates their pending plans, so plan again before approval. Switching back to the manager's environment removes the stored key from Korta. Deleting or rotating a key in Google Cloud is a separate action.

For ADC, configure credentials for the manager process, not for the browser or CLI. Locally, gcloud auth application-default login can provide ADC. An attached identity avoids managing a long-lived service-account key.