Deploy Claude Desktop on 3P with Google Cloud's Agent Platform changedthird-party/claude-desktop/vertex
Nearest release: v2.1.322, published 16 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 10 Nov 2026 18:30 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 10 Nov 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+7added
Lines−9removed
From line
22
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits21to this page, all time
The whole hunk
from line 22, old and new numbered
/
from line 22
2222
2323## How the two sign-in flows compare
2424
25The [in-app Google sign-in](#in-app-google-sign-in) and [in-app Workforce Identity sign-in](#in-app-workforce-identity-sign-in) approaches both open the system browser for a one-time consent and then renew in the background (or, for Workforce Identity, re-prompt in the browser when your IdP does not issue a refresh token). They differ in which party issues the refresh token, whether Google's Security Token Service is involved, and whether an Application Default Credentials file is written. The diagrams below show each flow end to end, and the table that follows summarizes the differences.
25The [in-app Google sign-in](#in-app-google-sign-in) and [in-app Workforce Identity sign-in](#in-app-workforce-identity-sign-in) approaches both open the system browser for a one-time consent and then renew in the background (or, for Workforce Identity, re-prompt in the browser when your IdP does not issue a refresh token). They differ in which party issues the refresh token and whether Google's Security Token Service is involved. The diagrams below show each flow end to end, and the table that follows summarizes the differences.
2626
2727### Workforce Identity sign-in
2828
from line 69
6969
7070### Google sign-in (OAuth)
7171
72Claude Desktop runs authorization code with PKCE against **Google's** OAuth endpoints. Google issues the refresh token, and the app writes it to an `authorized_user` Application Default Credentials file that the Google Cloud client library consumes. Your corporate IdP may appear inside Google's sign-in page (if Cloud Identity is federated via SAML), but the app never talks to it directly.
72Claude Desktop runs authorization code with PKCE against **Google's** OAuth endpoints. Google issues the refresh token, and only the app holds it. The app exchanges it at Google for short-lived access tokens and gives each session an access token. Your corporate IdP may appear inside Google's sign-in page (if Cloud Identity is federated via SAML), but the app never talks to it directly.
7373
7474```mermaid theme={null}
7575sequenceDiagram
from line 96
9696 end
9797 App->>App: Store authorized_user ADC<br/>{client_id, client_secret, refresh_token}<br/>encrypted with the operating system's secure storage<br/>(Keychain on macOS, DPAPI on Windows)
9898
99 Note over App,Vertex: At each session start
99 Note over App,Vertex: When a session starts and the app holds no fresh access token
100100
101 App->>App: Write the ADC JSON to a per-session file,<br/>set GOOGLE_APPLICATION_CREDENTIALS
102 App->>Goog: google-auth-library reads ADC and<br/>POSTs oauth2.googleapis.com/token (grant_type=refresh_token)
101 App->>Goog: POST oauth2.googleapis.com/token<br/>(grant_type=refresh_token)
103102 Goog-->>App: Fresh access_token
104103 App->>Vertex: Vertex AI request (Authorization: Bearer access_token)
105104 Vertex-->>App: Model response
106105
107 Note over App,Vertex: Silent renewal: google-auth-library refreshes against Google using the ADC file.<br/>Your corporate IdP is not contacted on renewal.
106 Note over App,Vertex: No ADC file is written. Silent renewal: the app repeats the exchange before the access token expires.<br/>Your corporate IdP is not contacted on renewal.
108107```
109108
110109### Side by side
from line 114
115114| Where your corporate IdP appears | Directly (the app opens it) | Inside Google's sign-in page, via Cloud Identity SAML federation (optional) |
116115| Refresh token issued by | Your IdP (when the Refresh Token grant is enabled on the client) | Google |
117116| Google STS (`sts.googleapis.com`) involved | Yes, on every access-token renewal | No |
118| ADC file written | No | Yes (`authorized_user` JSON, pointed to by `GOOGLE_APPLICATION_CREDENTIALS`) |
119117| Registered on the Google side | Workforce pool and OIDC provider (IAM & Admin) | Desktop-app OAuth 2.0 client (APIs & Services → Credentials) |
120118| Per-user prerequisite | An account at your IdP | A Google Workspace or Cloud Identity account |
121119| Client registered at your IdP | Public (native) OAuth client, PKCE required, loopback redirect URI | None (your IdP is federated to Cloud Identity, not to the app) |
from line 168
170168
171169When `inferenceVertexOAuthClientId` and `inferenceVertexOAuthClientSecret` are both set, the app shows a **Sign in with Google Cloud** page at first launch. Clicking the button opens the system browser for a standard Google consent flow, and the app listens on a loopback address for the redirect. On success, the app stores the user's Google refresh token encrypted with the operating system's secure storage (Keychain on macOS, DPAPI on Windows) and returns to Cowork.
172170
173At the start of each Cowork session, the app writes an `authorized_user` Application Default Credentials file (the same format produced by `gcloud auth application-default login`) and points `GOOGLE_APPLICATION_CREDENTIALS` at it. The Google Cloud client library handles access-token minting and refresh automatically.
171The refresh token stays in the app. For each session, the app exchanges it at Google for a short-lived access token, gives the session that token, and renews it in the background. The app writes no credentials file and doesn't set `GOOGLE_APPLICATION_CREDENTIALS`. Hooks and MCP servers that run on the device, and commands in Code sessions, use the user's own `gcloud` credentials, if there are any, and not this sign-in. Before Claude Desktop 5.1231.0, the app wrote the refresh token to a `.gcp-credentials.json` file in each session's folder, and from that version on it deletes those files at launch.
174172
175173If the stored refresh token is revoked or expires, the app shows a **Sign in again** prompt; clicking it reopens the Google consent flow in the browser. If you deploy a new OAuth client ID, the app clears the stored token and shows the sign-in page on next launch.
176174
No line in this hunk matches that.