在创建应用后，您可以选择要使用的身份验证选项。默认情况下，您的应用将使用 Google 账号进行身份验证。如需选择其他选项（如 Google Workspace 网域），请在 Google Cloud 控制台中前往项目的设置页面，然后点击修改。在“Google 身份验证”下拉菜单中，选择所需的身份验证类型，然后点击保存。
登录和退出登录
应用可以检测用户是否已使用应用所选的身份验证选项来登录应用。如果用户没有登录，则应用可以将用户定向到 Google 账号进行登录或者创建新的 Google 账号。应用通过调用 Users API 的方法获取登录页面的网址。当用户访问需要进行身份验证的页面时，应用可以将此网址显示为链接，也可以发出到此网址的 HTTP 重定向。
如果您的应用使用 Google 账号或 Google Workspace 进行身份验证，则应用的名称会在用户登录您的应用时显示在登录页面。所显示的名称是您在注册应用时指定的应用名称。您可以在 Google Cloud 控制台凭证页面的应用名称字段中更改此名称。
用户登录或创建 Google 账号后，会被重定向回您的应用。应用提供了指向生成登录网址的方法的重定向网址。
Users API 还提供一个生成网址供退出应用登录的方法。退出登录网址会从应用中撤消用户的身份验证，然后重定向回应用网址，但不显示任何内容。
用户只有在应用提示登录，并输入其账号的电子邮件地址和密码后，才能登录应用。即使用户已使用 Google 账号登录其他应用，也是如此。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-20。"],[[["\u003cp\u003eThe \u003ccode\u003eREGION_ID\u003c/code\u003e is a code assigned by Google based on the region selected during app creation, which is included in App Engine URLs for apps created after February 2020.\u003c/p\u003e\n"],["\u003cp\u003eThe Users API can detect if a user is signed in, redirect them to the sign-in page, and request the user create a new Google account if they don't have one.\u003c/p\u003e\n"],["\u003cp\u003eAn application can access a signed-in user's email address and determine if the user is an administrator, which allows for the creation of admin-only features.\u003c/p\u003e\n"],["\u003cp\u003eAuthentication can be enforced in the \u003ccode\u003eapp.yaml\u003c/code\u003e file, requiring users to be signed in or be registered administrators with specific roles to access certain pages.\u003c/p\u003e\n"],["\u003cp\u003eApps can authenticate users with a Google Account or an account on a Google Workspace domain, and the development server simulates Google Accounts with a fake sign-in screen for testing purposes.\u003c/p\u003e\n"]]],[],null,["# Users API for legacy bundled services\n\n### Region ID\n\nThe \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e is an abbreviated code that Google assigns\nbased on the region you select when you create your app. The code does not\ncorrespond to a country or province, even though some region IDs may appear\nsimilar to commonly used country and province codes. For apps created after\nFebruary 2020, \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r` is included in\nApp Engine URLs. For existing apps created before this date, the\nregion ID is optional in the URL.\n\nLearn more\n[about region IDs](/appengine/docs/standard/python/how-requests-are-routed#region-id). \nOK \nGo Java PHP Python\n\nThe Users API allows an application to:\n\n- Detect whether the current user has signed in.\n- Redirect the user to the appropriate sign-in page to sign in.\n- Request that your application user create a new Google account if they don't have one already.\n\n| This API is supported for first-generation runtimes and can be used when [upgrading to corresponding second-generation runtimes](/appengine/docs/standard/\n|\n| /services/access). If you are updating to the App Engine runtime, refer to the [Upgrade to second-generation runtimes]() page to learn about your migration options for legacy bundled services.\n\nWhile a user is signed in to the application, the app can access the user's\nemail address.\nThe app can also detect whether the current user is an\nadministrator (also called \"admin user\"),\nmaking it easy to implement admin-only areas of the app.\n| **Note:** An *admin* user is any user that has the Viewer, Editor, Owner, or App Engine Admin [role](/appengine/docs/standard/roles). For more information on setting user roles, see [Roles that Grant Access to App Engine](/appengine/docs/standard/access-control).\n\nUser authentication\n-------------------\n\nThe following example greets a user who has signed in to the app with a\npersonalized message and a link to sign out. If the user is not signed in, the\napp offers a link to the sign-in page for Google Accounts.\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n### Enforcing sign in and admin access with app.yaml\n\nIf you have pages that require the user to be signed in order to\naccess, you can enforce this in your `app.yaml`\nfile.\n\nThe handler configuration can also require that the user be a\nregistered administrator for the application; that is, the user must have the\nViewer, Editor, Owner, or App Engine Admin\n[role](/appengine/docs/standard/roles).\nThis makes it easy to build administrator-only sections of the site, without\nhaving to implement a separate authorization mechanism.\n\nTo learn how to configure authentication for URLs, see how to require login or\nadministrator status in the\n[`app.yaml` reference](/appengine/docs/standard/reference/app-yaml#handlers_login).\n\n\u003cbr /\u003e\n\nAuthentication options\n----------------------\n\nYour app can authenticate users using one of these options:\n\n- A Google Account\n- An account on your Google Workspace domain\n\n### Choosing an authentication option\n\nAfter you create your app, you can choose the authentication option you want to\nuse. By default, your app will use Google Accounts for authentication. To choose\nanother option, such as Google Workspace domain, go to the\n[settings](https://console.cloud.google.com/appengine/settings) page for your project\nin the Google Cloud console and click **Edit** . In the *Google authentication*\ndropdown menu, select the desired authentication type, and then click **Save**.\n\nSigning in and out\n------------------\n\nAn application can detect whether a user has signed in to the app with your\napp's chosen authentication option. If the user is not signed in, the app can\ndirect the user to Google Accounts to sign in or create a new Google account.\nThe app gets the URL for the sign-in page by calling a method of the Users API.\nThe app can display this URL as a link, or it can issue an HTTP redirect to the\nURL when the user visits a page that requires authentication.\n\nIf your app uses Google Accounts or Google Workspace for authentication,\nthe name of your application appears on the sign-in page when the user signs in\nto your application. The name shown is the application name that you specified\nwhen registering the application. You can change this name in the **Application\nname** field of the Google Cloud console\n[Credentials](https://console.cloud.google.com/apis/credentials/consent) page.\n\nOnce the user has signed in or created a Google account, the user is redirected\nback to your application. The app provides the redirect URL to the method that\ngenerates the sign-in URL.\n\nThe Users API includes a method to generate a URL for signing out of the app.\nThe sign-out URL de-authenticates the user from the app, then redirects back to\nthe app's URL without displaying anything.\n\nA user is not signed in to an application until they are prompted to do so by the\napp and enter their account's email address and password. This is true even if\nthe user has signed in to other applications using their Google Account.\n\nAccessing account information\n-----------------------------\n\nWhile a user is signed in to an app, the app can access the account's email\naddress for every request the user makes to the app. The app can also access a\nuser ID that identifies the user uniquely, even if the user changes the email\naddress for their account.\n\nThe app can also determine whether the current user is an administrator for the\napp. An *admin* user is any user that has the Viewer, Editor, Owner, or App\nEngine Admin [role](/appengine/docs/standard/roles). You can use this feature to\nbuild administrative features for the app, even if you don't authenticate other\nusers. The Go, Java, PHP and Python APIs make it easy to configure URLs as\n\"administrator only\".\n| **Note:** Every user has the same user ID for all App Engine applications. If your app uses the user ID in public data, such as by including it in a URL parameter, you should use a hash algorithm with a \"salt\" value added to obscure the ID. Exposing raw IDs could allow someone to associate a user's activity in one app with that in another, or get the user's email address by coercing the user to sign in to another app.\n\n\u003cbr /\u003e\n\nGoogle accounts and the development server\n------------------------------------------\n\nThe development server simulates the Google Accounts system using a fake\nsign-in screen. When your application calls the Users API to get the URL for the\nsign-in screen, the API returns a special development server URL that prompts\nfor an email address, but no password. You can type any email address into this\nprompt, and the app will behave as if you are signed in with an account with\nthat address.\n\nThe fake sign-in screen also includes a checkbox that indicates whether the\nfake account is an administrator; that is, whether the account has the\nViewer, Editor, Owner, or App Engine Admin [role](/appengine/docs/standard/roles).\nIf you check this box, the app will behave as if you are signed in using an\nadministrator account.\n\nSimilarly, the Users API returns a sign-out URL that cancels the fake sign-in.\n\n\u003cbr /\u003e"]]
