【n8n系列|初稿】 02. 使用 Google Agent Stdio 取得 LLM Keys
透過 Google Agent Stdio 使用 GCP 的適用額度 (300 美金) 存取與使用大語言模型，這樣可以節省大量的開發與學習 n8n 的成本。
1. 建立 Google Agent Stdio 服務與帳號
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 export PROJECT_ID=$(gcloud config get-value project)export ORG_ID=$(gcloud organizations list --format="value(ID)" )gcloud services enable \ agentregistry.googleapis.com \ aiplatform.googleapis.com \ apphub.googleapis.com \ apptopology.googleapis.com \ apihub.googleapis.com \ cloudapiregistry.googleapis.com \ cloudtrace.googleapis.com \ compute.googleapis.com \ dataform.googleapis.com \ iam.googleapis.com \ iamconnectors.googleapis.com \ iap.googleapis.com \ logging.googleapis.com \ modelarmor.googleapis.com \ monitoring.googleapis.com \ networksecurity.googleapis.com \ networkservices.googleapis.com \ notebooks.googleapis.com \ observability.googleapis.com \ securitycenter.googleapis.com gcloud services enable \ storage.googleapis.com \ telemetry.googleapis.com \ texttospeech.googleapis.com \ saasservicemgmt.googleapis.com
執行結果 1 2 3 Your active configuration is: [cloudshell-26249] Operation "operations/acf.p2-1062574671018-62059c76-dd5f-4d86-828e-0d544fe8ad03" finished successfully. Operation "operations/acat.p2-1062574671018-ec30afea-a8d7-45e2-a10f-874eaadb8dd6" finished successfully.
注意 gcloud sercvices enable 指令最多一次可執行 20 個服務，因此需要分批次啟用所需服務。
1 2 3 gcloud organizations add-iam-policy-binding $ORG_ID \ --member="<your_email_id>" \ --role="roles/orgpolicy.policyAdmin"
1 gcloud org-policies delete iam.disableServiceAccountKeyCreation --organization=$ORG_ID
看到以下提示訊息後， 按下 y 後 Enter 繼續執行
1 2 3 API [orgpolicy.googleapis.com] not enabled on project [sixth-embassy-502516-c3]. Would you like to enable and retry (this will take a few minutes)? (y/N)?
執行結果 1 2 3 4 API [orgpolicy.googleapis.com] not enabled on project [sixth-embassy-502516-c3]. Would you like to enable and retry (this will take a few minutes)? (y/N)? y Enabling service [orgpolicy.googleapis.com] on project [sixth-embassy-502516-c3]... Deleted policy [organizations/298416275372/policies/iam.disableServiceAccountKeyCreation]. {}
1 gcloud org-policies delete iam.disableServiceAccountKeyUpload --organization=$ORG_ID
執行結果 1 2 Deleted policy [organizations/298416275372/policies/iam.disableServiceAccountKeyUpload]. {}
建立政策 yaml
1 2 3 4 5 6 cat > allow-service-account-api-key.yaml <<EOF name: projects/$(gcloud projects describe $(gcloud config get-value project) --format="value(projectNumber)")/policies/iam.managed.disableServiceAccountApiKeyCreation spec: rules: - enforce: false EOF
部署政策
1 gcloud org-policies set-policy allow-service-account-api-key.yaml
執行結果 1 2 3 4 5 6 7 8 Created policy [projects/1062574671018/policies/iam.managed.disableServiceAccountApiKeyCreation]. etag: CPX83tIGEIiD8tUC- name: projects/1062574671018/policies/iam.managed.disableServiceAccountApiKeyCreation spec: etag: CPX83tIGEIiD8tUC rules: - enforce: false updateTime: '2026-07-15T17:08:05.716997Z'
1 2 gcloud services enable apikeys.googleapis.com \ --project=$PROJECT_ID
執行結果 1 Operation "operations/acat.p2-1062574671018-58814351-a24c-440a-87e6-acfb8ce752c9" finished successfully.
1 2 3 gcloud iam service-accounts create n8n-agent \ --display-name="n8n Agent Service Account" \ --description="Service Account for n8n Google Cloud Integration"
執行結果 1 Created service account [n8n-agent].
1 2 3 gcloud projects add-iam-policy-binding "$PROJECT_ID " \ --member="serviceAccount:n8n-agent@${PROJECT_ID} .iam.gserviceaccount.com" \ --role="roles/aiplatform.user"
執行結果 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 Updated IAM policy for project [sixth-embassy-502516-c3]. bindings: - members: - serviceAccount:n8n-agent@sixth-embassy-502516-c3.iam.gserviceaccount.com role: roles/aiplatform.user - members: - serviceAccount:1062574671018@cloudservices.gserviceaccount.com role: roles/compute.instanceGroupManagerServiceAgent - members: - serviceAccount:service-1062574671018@compute-system.iam.gserviceaccount.com role: roles/compute.serviceAgent - members: - serviceAccount:service-1062574671018@gcp-sa-notebooks.iam.gserviceaccount.com role: roles/notebooks.serviceAgent - members: - user:cw2630487@gmail.com role: roles/owner etag: BwZWqZDlgGo= version: 1
1 2 gcloud iam service-accounts keys create n8n-agent-key.json \ --iam-account=n8n-agent@${PROJECT_ID} .iam.gserviceaccount.com
執行結果 1 created key [f3fe40dff04d8991568a93901f9ce57798408c9c] of type [json] as [n8n-agent-key.json] for [n8n-agent@sixth-embassy-502516-c3.iam.gserviceaccount.com]
印出金鑰
1 grep "private_key" n8n-agent-key.json | sed 's/.*"private_key": "//;s/".*//'
1 2 3 -----BEGIN PRIVATE KEY-----\nMIIEvQIQEFAASCBKcwggSjAgEAAoIBAQD aNaozVyUm14k... (略)...+oLIhtRK hkJ7S72g8=\n-----END PRIVATE KEY-----\n
注意
請將 -----BEGIN PRIVATE KEY----- 到 -----END PRIVATE KEY-----\n 另存在記事本上，且字串包含 \n 都要儲存起來。 這段文字是存取 Service Account 的金鑰等同於密碼，請妥善保管好。 移除 n8n-agent-key.json
注意
一般來說我們會把金鑰儲存後，除伺服器上移除，避免金鑰洩漏。 移除後金鑰就找不回來，只能重新產生，因此執行此步驟時請確認金鑰已經另存新檔。 1 2 gcloud services enable cloudresourcemanager.googleapis.com \ --project=$PROJECT_ID
執行結果 1 Operation "operations/acat.p2-1062574671018-5ec1351a-3877-4f30-9a41-94ae385d0ce9" finished successfully.
1 echo n8n-agent@${PROJECT_ID} .iam.gserviceaccount.com
執行結果 1 n8n-agent@sixth-embassy-502516-c3.iam.gserviceaccount.com
請把輸出結果儲存起來，這將會是透過 n8n 登入 Google 服務的帳號
2. 從 n8n 登入 Google 服務
在 Select an app or service to connect to 欄位輸入 Google Service Account API，Continue 下一步。
輸入完整 Credential 資訊後，點擊 Save 按鈕
提示
Region: 不要更動Service Account Email: 輸入 n8n 服務帳號 (來自上一節的步驟 13 )，不是自己的 Google 帳號。Private Key: 輸入金鑰包含 \n (來自上一節的步驟 11)按下 Save 後，n8n 會測試 Credential 是否能夠向目標服務進行連線。
留言
