Reach Google Cloud VMs with no public IP

Identity-Aware Proxy tunnels SSH to a Compute Engine instance that has no internet-facing address at all. There is no open port to find, and no static SSH key stored on the phone.

Why this is the interesting case

The strongest thing you can do for a server's security is not give it a public address. That normally makes it unreachable from a phone without a VPN. IAP solves it from the other direction: Google's proxy reaches the instance from inside its own network, and authorises you by IAM identity rather than by network location.

Two ways to authenticate

You can choose the authentication method that best fits your workflow:

• Browser Login (Google Account): Sign in with your Google account through your browser using the official Google Cloud SDK OAuth 2.0 PKCE flow. No service account private keys to create, download, or copy to your phone.
• Service Account (JSON): Import a private key JSON from the Google Cloud Console for dedicated machine accounts or automation setups.

Both methods support manual code/redirect URL verification for cross-device, emulator, or remote setups where a loopback redirect cannot complete automatically.

How a connection goes

1. The app uses your authenticated OAuth token or mints a short-lived token from your service account key.
2. It generates an ephemeral, throwaway SSH keypair in memory.
3. It publishes the public half through Google OS Login, valid for a few minutes.
4. It opens the IAP tunnel and connects through it.

All four happen per connection. Nothing is cached: the key is valid for minutes by design, and both halves are discarded when the session ends.

The username is decided for you

OS Login derives a POSIX username from the IAM identity — for example, your Google email or a service account identity. The app reads the derived username directly from Google's OS Login response and connects automatically. Leave the username field blank.

Multiple Google Cloud profiles

Keep multiple Google Cloud accounts and projects side by side (e.g. personal, client, staging, and production). Each profile can independently use either Browser Login or Service Account JSON, and you choose which profile each host uses directly from the host editor.

Permissions it needs

Two roles on the project, neither of which allows changing, stopping or reading the instance:

roles/iap.tunnelResourceAccessor
roles/compute.osLogin

Setup guide, including Google sign-in and test environment instructions.