# GCP Identity Token Trust Provider

> This page describes the steps required to configure the GCP Identity Token Trust Provider.

The GCP Identity Token Trust Provider verifies the identities of workloads running within Google Cloud Platform (GCP) by validating identity tokens issued by GCP. These tokens carry metadata, such as the email associated with the service account or user executing the operation, ensuring secure and authenticated access to GCP resources.

To validate the user identity that Google Cloud Identity-Aware Proxy (IAP) asserts for workloads behind IAP, see [GCP IAP JWT Trust Provider](/user-guide/access-policies/trust-providers/gcp-iap-jwt-trust-provider).

## Match rules

The following match rule is available for this Trust Provider type:

| Data  | Description                                               | Example            |
| ----- | --------------------------------------------------------- | ------------------ |
| email | The email associated with the GCP service account or user | <user@example.com> |

For additional information about GCP Identity Tokens, see [Google Cloud Identity](https://cloud.google.com/docs/authentication/get-id-token).