Google Cloud's Auth Manager for AI agents is now generally available
Illustration made with AI for ai notisGoogle says Auth Manager automates OAuth sign-in and token refresh for AI agents; JWT support for Agent Identity, a Model Armor topic detector and CodeMender sandboxing are in preview.
- Google Cloud says Auth Manager became generally available on 5 November 2026; it automates OAuth 2.0 and PKCE flows and refreshes user-delegated tokens for AI agents.
- Google says Agent Identity JWT support, in preview, issues OIDC tokens so agents can authenticate across AWS, Azure, on-premises backends and MCP servers without static, long-lived API keys.
- Also in preview: Workload Identity Federation for GKE in VPC Service Controls, Cloud Armor exploit-protection rules, a Model Armor custom topic detector and sandboxed CodeMender verification.
Google Cloud made Auth Manager generally available on 5 November 2026. It automates OAuth 2.0 and PKCE flows and refreshes user-delegated tokens for AI agents, which Google says reduces consent fatigue and the theft of credentials.
The release comes in a Google Cloud security blog post of the same date. Alongside Auth Manager, Agent Identity JWT support is in preview. Google says it issues standard OIDC tokens so agents can authenticate across AWS, Azure, on-premises backends and MCP servers without static, long-lived API keys.
Two network controls are generally available: IAM roles in VPC Service Controls ingress and egress rules, and the Cloud NGFW advanced malware sandbox, which Google says is enabled by Palo Alto Networks WildFire. In preview are Workload Identity Federation for GKE in VPC Service Controls, Cloud Armor managed rules for exploit protection, and a Model Armor custom topic detector that lets teams enforce topic adherence for agents.
Google also lists new CodeMender capabilities in preview. CodeMender can now run vulnerability verification and exploit simulation inside an operating-system-level sandbox or an isolated virtual machine, and can scan a folder, a whole repository or only files changed since the last scan.
What it means for you Our view
If you build or buy agents that act on a user's behalf in Google Cloud, Auth Manager is the part of this release Google says is generally available, and it handles the sign-in and token refresh work that Google says otherwise causes consent fatigue and credential theft. The Agent Identity JWT support, Model Armor detector and CodeMender sandboxing are previews, so they are worth testing but not yet worth building production on. Check which of your agents authenticate with static, long-lived API keys today, and list which of those flows the preview JWT support would replace.