Connect Google Cloud

Use your Google account to let commands, coding agents, and applications on your devboxes access Google Cloud. After signing in, you'll choose a Google Cloud project for each boxes.dev project. boxes.dev will keep that access available to gcloud and the Google Cloud client libraries, without a separate gcloud auth login on every devbox.

Google Cloud is currently available only to boxes.dev's internal pilot accounts. If Google Cloud doesn't appear under Integrations, your account hasn't been enabled for the pilot.

Connect your project

1. Select your project. In the desktop app, open Integrations → Google Cloud; in the mobile app, open Project settings → Google Cloud.
2. Choose Connect Google Cloud and sign in to Google in your browser. Keep the Google Cloud permission selected on the consent screen; boxes.dev can't connect without it. The app will receive the result automatically.
3. Choose one of your Google Cloud projects. On desktop, then choose Use this project.

You'll need the desktop or mobile app to sign in. The web app shows whether Google Cloud is connected, but it can't start the sign-in.

If the list is empty or is missing a project you expect, ask an admin of that Google Cloud project to give your Google account access, then choose Refresh. You won't need to sign in again.

Check your Google Cloud identity

Open a new terminal on the project's Template box or a devbox and run:

gcloud auth list
gcloud config list

The first command should show your Google account, and the second should show the project you selected. Google Cloud client libraries for Python, Node.js, Go and other languages will find the same account and project automatically.

Existing Codex and Claude threads will finish their current work and pick up Google Cloud before their next turn. Already-open shells keep their original environment, so open a new terminal after connecting or changing projects.

Another project can reuse your saved sign-in and choose a different Google Cloud project. No Template box snapshot or repository change is required.

Reconnect or remove access

If Google ends your sign-in, the desktop and mobile apps will show a Google Cloud sign-in expired. warning. Choose the warning's reconnect action, or Reconnect on the Google Cloud page, and sign in again. If you sign in with the same Google account, your project choices will be kept; with a different account, you'll need to choose each project again.

In a terminal, gcloud commands will also explain that the sign-in needs to be renewed. gcloud may keep working for up to an hour on a token it already holds before that message appears.

Google decides when you'll need to sign in again. Your sign-in can end if you remove boxes.dev's access in your Google account settings, or if your Google Workspace admin restricts the app or requires Google Cloud users to sign in again after a set time.

The Google Cloud page offers these actions in its options menu on desktop and its Options section on mobile:

• Change project will switch this boxes.dev project to a different Google Cloud project.
• Remove from this project will stop new Google Cloud credentials for this project while leaving other projects connected.
• Sign out of Google Cloud everywhere will delete your saved sign-in, disconnect every boxes.dev project using it, and remove boxes.dev's access from your Google account.

A tool that already received an access token can keep using it until the token expires, usually within an hour.

Check credential precedence

boxes.dev's Google identity is a default with the lowest priority. If a command uses an unexpected Google identity, check for an account added with gcloud auth login, application default credentials from gcloud auth application-default login, a key file named in GOOGLE_APPLICATION_CREDENTIALS, or credentials selected in application code. Each of these takes priority over boxes.dev's identity under Google's normal rules.

boxes.dev serves credentials on each devbox the way a Google Cloud virtual machine does, so tools request a short-lived access token when they need one. Your renewable Google sign-in stays encrypted in boxes.dev. It is not copied into devboxes or snapshots, and no credentials file is written.

Containers and current limits

Containers don't automatically receive Google Cloud access from the devbox. Configure Google Cloud access inside containers separately, and don't copy your boxes.dev sign-in into them.

boxes.dev provides access tokens only. Commands that need an identity token for a specific audience, such as gcloud auth print-identity-token for a private Cloud Run service, need an account added with gcloud auth login.

Each person has one Google sign-in in boxes.dev, and each boxes.dev project uses one Google Cloud project for that person.