Skip to main content
Monk needs a service account JSON key to provision and manage infrastructure in your Google Cloud project. This page walks you through creating one with the right permissions.

​
What you need

  • Service account JSON key file
  • Optional: project ID (auto-extracted from the key)
  • Optional: default region (e.g., us-central1)

​
Create credentials

1

Open the Service Accounts page

Log into GCP Console → IAM & Admin → Service Accounts.
2

Create a service account

Click Create Service Account. Name it something like monk-deployment.
3

Grant roles

For a quick start, grant Compute Admin and Service Account User. For production, create a custom role with the minimum permissions listed below.
4

Create a JSON key

Click the service account name → Keys tab → Add Key → Create new key → JSON. Download the file.
5

Provide to Monk

When you deploy to GCP, Monk asks for the key file through a secure form. Select the downloaded JSON. You can also tell your agent:

​
Required permissions

Predefined roles (simpler, broader):
  • roles/compute.admin (Compute Admin)
  • roles/iam.serviceAccountUser (Service Account User)
For production, use a custom role with only the permissions Monk needs. Scope summary: Compute Engine instances, images, and instance groups. Disks, snapshots, and resource policies (backups). VPC networks, subnets, firewalls, and external IPs. Load balancing: health checks, forwarding rules, backend services, proxies, URL maps. Operations and regions metadata.

​
How credentials are stored

You enter credentials in a form in the local dashboard, never in chat. Monk keeps them in your OS keychain (or an encrypted file where there is no keychain) on your computer and pushes them to your cluster when a deployment needs them. The coding agent never sees the values. See Security.

​
Troubleshooting

Service account disabled: check the service account status in IAM & Admin. JSON key file malformed: re-download the key. Make sure you selected JSON format, not P12. Missing roles: if Monk reports permission errors, verify the custom role or predefined roles are bound to the service account. Ask your agent for help:

Deploy your first app

Credentials ready? Deploy your app