Google says Auth Manager automates OAuth sign-in and token refresh for AI agents; JWT support for Agent Identity, a Model Armor topic detector and CodeMender sandboxing are in preview.
- Google Cloud says Auth Manager became generally available on 5 November 2026; it automates OAuth 2.0 and PKCE flows and refreshes user-delegated tokens for AI agents.
- Google says Agent Identity JWT support, in preview, issues OIDC tokens so agents can authenticate across AWS, Azure, on-premises backends and MCP servers without static, long-lived API keys.
- Also in preview: Workload Identity Federation for GKE in VPC Service Controls, Cloud Armor exploit-protection rules, a Model Armor custom topic detector and sandboxed CodeMender verification.
If you build or buy agents that act on a user's behalf in Google Cloud, Auth Manager is the part of this release Google says is generally available, and it handles the sign-in and token refresh work that Google says otherwise causes consent fatigue and credential theft. The Agent Identity JWT support, Model Armor detector and CodeMender sandboxing are previews, so they are worth testing but not yet worth building production on. Check which of your agents authenticate with static, long-lived API keys today, and list which of those flows the preview JWT support would replace. Read on →

