Configure Google Cloud BYOK

Connect a Google service account for Chirp 3 speech and Translation using an approved key file.

Best for: Enterprise Google Cloud administrators and authorized 4All owners/admins.

Before you start

Requires BYOK entitlement/encryption configuration; the Google project must enable required APIs and customer billing/quota applies.

• Sign in with an individual account in the correct organization.
• Confirm your role permits the requested change.
• Record the current state and intended owner before making a production-impacting change.

Configuration

1. Create a dedicated project/service account. Separate production from test and avoid user-owned credentials.
2. Enable services. Enable the required Speech-to-Text v2/Chirp 3 and Translation APIs for the chosen workflow.
3. Grant minimum IAM. Assign only the roles needed to call those services; avoid project owner/editor.
4. Create a service-account key. Generate JSON containing project_id, client_email, and private_key; secure the file immediately.
5. Open Organization → BYOK → Google Cloud. Confirm organization, then import the JSON or enter supported fields.
6. Run live verification. Resolve API, IAM, project, billing, quota, or key-format errors.
7. Save and test. Use a controlled event with Google Chirp 3/Translation, run preflight, and verify output.
8. Secure or destroy the downloaded key file. Follow enterprise secret-handling policy after import.

What success looks like: The requested change is applied to the intended organization, is visible after refresh, and grants no more access than required.

Check your setup

• The dedicated service account validates and a controlled Google speech/translation workflow succeeds without excessive IAM.

Troubleshooting

File rejected

Confirm it is a Google service-account key with project_id, client_email, and private_key.

Permission denied

Enable APIs and grant the exact service-call roles in the correct project.

Quota or billing error

Check project billing, quotas, region/model availability, and organizational policy.

Security and operational notes

• A service-account JSON is a private key; never attach it to support.
• Rotate leaked or orphaned keys immediately.
• Prefer organization-approved secret handling and workload identity patterns where applicable.

Related guides

• Plan and Secure a BYOK Deployment
• Validate, Rotate, or Remove BYOK Credentials
• Google Chirp 3 Settings