Long-lived API keys for AI agents just got a clearer replacement path on Google Cloud.
In a November 4, 2026 blog post tied to Google’s Security Summit, Sandra Joyce, vice president of Google Threat Intelligence, detailed Auth Manager for Agent Identity going generally available. The service centralizes credential management in a Google-managed vault governed by IAM, and automates OAuth 2.0 with PKCE plus refreshes of user-delegated tokens.
Cross-cloud agent tokens
Google also previewed Agent Identity JWT support. The feature issues standard OIDC tokens so agents can authenticate across AWS, Azure, on-premises systems and MCP servers without static, long-lived API keys.
Other updates include identity-based VPC Service Controls for ingress and egress with IAM roles going generally available, and Workload Identity Federation for GKE in preview. Model Armor’s custom topic detector entered preview. CodeMender preview updates add secure isolation for vulnerability verification and flexible scanning modes; Google noted customers including Wiz and Thales among those using related capabilities.
The agentic security frame
The post frames the moment as an agentic era of build, secure and defend — treating machine identities with the same rigor enterprises already apply to human accounts. For security architects, the combination of a managed vault, automated OAuth refresh and portable JWTs is meant to retire the habit of pasting static keys into agent configs.
That matters as teams wire agents into MCP servers and multi-cloud tools, where a single leaked key can span far more than one SaaS tenant.
Why it matters
Replacing long-lived agent keys with governed tokens is a concrete upgrade path. Cloud and identity vendors should highlight cross-cloud agent auth in security RFPs.
If your buyers are standing up MCP servers or multi-cloud agents, expect Auth Manager–style vaulting and short-lived JWTs to show up as checklist items next to SSO.
Source: Google Cloud. Written by the xRapid Media LLP team.
About xRapid Media
xRapid Media LLP is a High Tech B2B Marketing company for technology businesses: software and SaaS companies, IT services and managed service providers, and hardware and IT product vendors. Our team combines positioning and content, account-based marketing, paid ads funnels, verified B2B data, intent signals, email and LinkedIn outreach and appointment setting to help you reach the right buyers and turn their attention into qualified leads and meetings.
Want help putting ideas like these into practice? Email [email protected] or book a time with our team.