diff --git a/.github/ISSUE_TEMPLATE/blank.yaml b/.github/ISSUE_TEMPLATE/blank.yaml
index 3560f736c83..5186fb931f3 100644
--- a/.github/ISSUE_TEMPLATE/blank.yaml
+++ b/.github/ISSUE_TEMPLATE/blank.yaml
@@ -82,6 +82,7 @@ body:
       - mimir.rules.kubernetes
       - otelcol.auth.basic
       - otelcol.auth.bearer
+      - otelcol.auth.google
       - otelcol.auth.headers
       - otelcol.auth.oauth2
       - otelcol.auth.sigv4
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yaml b/.github/ISSUE_TEMPLATE/bug_report.yaml
index 4b416afef53..0525c228972 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yaml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yaml
@@ -82,6 +82,7 @@ body:
       - mimir.rules.kubernetes
       - otelcol.auth.basic
       - otelcol.auth.bearer
+      - otelcol.auth.google
       - otelcol.auth.headers
       - otelcol.auth.oauth2
       - otelcol.auth.sigv4
diff --git a/.github/ISSUE_TEMPLATE/docs.yaml b/.github/ISSUE_TEMPLATE/docs.yaml
index 49edbb49d58..6d9e749085c 100644
--- a/.github/ISSUE_TEMPLATE/docs.yaml
+++ b/.github/ISSUE_TEMPLATE/docs.yaml
@@ -85,6 +85,7 @@ body:
       - mimir.rules.kubernetes
       - otelcol.auth.basic
       - otelcol.auth.bearer
+      - otelcol.auth.google
       - otelcol.auth.headers
       - otelcol.auth.oauth2
       - otelcol.auth.sigv4
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yaml b/.github/ISSUE_TEMPLATE/feature_request.yaml
index 4bab64a6bd6..7507309976c 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.yaml
+++ b/.github/ISSUE_TEMPLATE/feature_request.yaml
@@ -82,6 +82,7 @@ body:
       - mimir.rules.kubernetes
       - otelcol.auth.basic
       - otelcol.auth.bearer
+      - otelcol.auth.google
       - otelcol.auth.headers
       - otelcol.auth.oauth2
       - otelcol.auth.sigv4
diff --git a/.github/ISSUE_TEMPLATE/proposal.yaml b/.github/ISSUE_TEMPLATE/proposal.yaml
index df4e4506521..c75421d50ea 100644
--- a/.github/ISSUE_TEMPLATE/proposal.yaml
+++ b/.github/ISSUE_TEMPLATE/proposal.yaml
@@ -82,6 +82,7 @@ body:
       - mimir.rules.kubernetes
       - otelcol.auth.basic
       - otelcol.auth.bearer
+      - otelcol.auth.google
       - otelcol.auth.headers
       - otelcol.auth.oauth2
       - otelcol.auth.sigv4
diff --git a/collector/go.mod b/collector/go.mod
index 66d9c283cb2..dd2a1c4fc6b 100644
--- a/collector/go.mod
+++ b/collector/go.mod
@@ -268,6 +268,7 @@ require (
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/collector v0.55.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/IBM/sarama v1.46.3 // indirect
 	github.com/KimMachineGun/automemlimit v0.7.5 // indirect
@@ -710,6 +711,7 @@ require (
 	github.com/open-telemetry/opentelemetry-collector-contrib/exporter/datadogexporter v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/ackextension v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding v0.147.0 // indirect
+	github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/internal/credentialsfile v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/k8sleaderelector v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/opampcustommessages v0.147.0 // indirect
diff --git a/collector/go.sum b/collector/go.sum
index 9ac54d2494c..7b4d8b0ef78 100644
--- a/collector/go.sum
+++ b/collector/go.sum
@@ -419,6 +419,8 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0/go.mod h1:l9rva3ApbBpEJxSNYnwT9N4CDLrWgtq3u8736C5hyJw=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0 h1:xQMhkBXPOKe/GzC6TctwlK2aNF+9k5VwFgdE83rBK2Y=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0/go.mod h1:VLoD5cAsRQXsAFXpOZrrTGzbuMsntlspIZno4xor5Zg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0 h1:rKcEaxSnVUpmhFNVjRuls5w/6KZrVZNw4kWbYeK3xH4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0/go.mod h1:K8wtUZ/GzRhA21Dy6XDQJZTbpcMF0Kb6FSaJN+rBLJ0=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
@@ -1845,6 +1847,8 @@ github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding v0.
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding v0.147.0/go.mod h1:iCPJltPdOSvckw3kgl3DifMvYasNdOYvDvsJ4fi8lOU=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding/otlpencodingextension v0.147.0 h1:Cx7WcJQKLO/BFaHCwnpH/bbbt8paLQTMxq1fGu5Skzk=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding/otlpencodingextension v0.147.0/go.mod h1:utV5S9gEUzWqIuyPYoecuW346TM/52t6xes7YEQWLCY=
+github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0 h1:FmzmUcx/wn8zlKgPfmSaIp8zrom9FCTcLlqZJiZgcb8=
+github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0/go.mod h1:UUgldOqz0qDW8xgULBjQLOiKdYuOgDSu6wS/t+eLlvg=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/headerssetterextension v0.147.0 h1:jqYiMiW3Eg9kLnKvKgRbWxGcLEWU9PsfyXqTkD1wo9c=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/headerssetterextension v0.147.0/go.mod h1:vxTpEw1jQEzx3wjEtXU+p0cfOv5s3f/ULsYRKzu5vYI=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/healthcheckextension v0.147.0 h1:pfSn3AhNXu+YWDPidCVWRAZcjAk0rPImioBF9P/Uv7M=
diff --git a/docs/sources/reference/components/otelcol/otelcol.auth.google.md b/docs/sources/reference/components/otelcol/otelcol.auth.google.md
new file mode 100644
index 00000000000..ef2c3fa4117
--- /dev/null
+++ b/docs/sources/reference/components/otelcol/otelcol.auth.google.md
@@ -0,0 +1,101 @@
+---
+canonical: https://grafana.com/docs/alloy/latest/reference/components/otelcol/otelcol.auth.google/
+description: Learn about otelcol.auth.google
+labels:
+  stage: public-preview
+  products:
+    - oss
+title: otelcol.auth.google
+---
+
+# `otelcol.auth.google`
+
+{{< docs/shared lookup="stability/public_preview.md" source="alloy" version="<ALLOY_VERSION>" >}}
+
+`otelcol.auth.google` exposes a `handler` that other `otelcol` components can use to authenticate requests using Google Application Default Credentials.
+
+This component only supports client authentication.
+
+The authorization tokens can be used by HTTP and gRPC based OpenTelemetry exporters.
+This component can fetch and refresh expired tokens automatically.
+Refer to the [Google Cloud Documentation](https://docs.cloud.google.com/docs/authentication/application-default-credentials) for more information about Application Default Credentials.
+
+{{< admonition type="note" >}}
+`otelcol.auth.google` is a wrapper over the upstream OpenTelemetry Collector [`googleclientauth`][] extension.
+Bug reports or feature requests will be redirected to the upstream repository, if necessary.
+
+[`googleclientauth`]: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/{{< param "OTEL_VERSION" >}}/extension/googleclientauthextension
+{{< /admonition >}}
+
+You can specify multiple `otelcol.auth.google` components by giving them different labels.
+
+## Usage
+
+```alloy
+otelcol.auth.google "<LABEL>" {
+    project     = "<PROJECT_ID>"
+}
+```
+
+## Arguments
+
+You can use the following arguments with `otelcol.auth.google`:
+
+| Name            | Type           | Description                                                        | Default        | Required |
+| --------------- | -------------- | ------------------------------------------------------------------ | -------------- | -------- |
+| `audience`      | `string`       | The audience claim used for generating an ID token.                |                | no       |
+| `project`       | `string`       | The project telemetry is sent to.                                  |                | no       |
+| `quota_project` | `string`       | A project for quota and billing purposes.                          |                | no       |
+| `scopes`        | `list(string)` | Requested permissions associated with the client.                  | `[]`           | no       |
+| `token_type`    | `string`       | The type of token to generate. One of `access_token` or `id_token` | `access_token` | no       |
+
+If `project` isn't set, {{< param "PRODUCT_NAME" >}} uses the project from the Application Default Credentials.
+
+## Blocks
+
+You can use the following blocks with `otelcol.auth.google`:
+
+| Block                            | Description                                                                | Required |
+| -------------------------------- | -------------------------------------------------------------------------- | -------- |
+| [`debug_metrics`][debug_metrics] | Configures the metrics that this component generates to monitor its state. | no       |
+
+[debug_metrics]: #debug_metrics
+
+### `debug_metrics`
+
+{{< docs/shared lookup="reference/components/otelcol-debug-metrics-block.md" source="alloy" version="<ALLOY_VERSION>" >}}
+
+## Exported fields
+
+The following fields are exported and can be referenced by other components:
+
+| Name      | Type                       | Description                                                     |
+| --------- | -------------------------- | --------------------------------------------------------------- |
+| `handler` | `capsule(otelcol.Handler)` | A value that other components can use to authenticate requests. |
+
+## Component health
+
+`otelcol.auth.google` is only reported as unhealthy if given an invalid configuration.
+
+## Debug information
+
+`otelcol.auth.google` doesn't expose any component-specific debug information.
+
+## Example
+
+This example configures [`otelcol.exporter.otlp`][otelcol.exporter.otlp] to use `otelcol.auth.google` for authentication:
+
+```alloy
+otelcol.exporter.otlp "google" {
+  client {
+    endpoint = "telemetry.googleapis.com"
+    auth     = otelcol.auth.google.creds.handler
+  }
+}
+
+otelcol.auth.google "creds" {
+    project = "myproject"
+}
+```
+
+[otelcol.exporter.otlp]: ../otelcol.exporter.otlp/
diff --git a/extension/alloyengine/go.mod b/extension/alloyengine/go.mod
index 49ba1e9300a..a9af1f6d007 100644
--- a/extension/alloyengine/go.mod
+++ b/extension/alloyengine/go.mod
@@ -186,6 +186,7 @@ require (
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/collector v0.55.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/IBM/sarama v1.46.3 // indirect
 	github.com/KimMachineGun/automemlimit v0.7.5 // indirect
@@ -640,6 +641,7 @@ require (
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/basicauthextension v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding v0.147.0 // indirect
+	github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/headerssetterextension v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/internal/credentialsfile v0.147.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/extension/jaegerremotesampling v0.147.0 // indirect
diff --git a/extension/alloyengine/go.sum b/extension/alloyengine/go.sum
index 9bbf7a7c595..cb0cb3191b6 100644
--- a/extension/alloyengine/go.sum
+++ b/extension/alloyengine/go.sum
@@ -419,6 +419,8 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0/go.mod h1:l9rva3ApbBpEJxSNYnwT9N4CDLrWgtq3u8736C5hyJw=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0 h1:xQMhkBXPOKe/GzC6TctwlK2aNF+9k5VwFgdE83rBK2Y=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0/go.mod h1:VLoD5cAsRQXsAFXpOZrrTGzbuMsntlspIZno4xor5Zg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0 h1:rKcEaxSnVUpmhFNVjRuls5w/6KZrVZNw4kWbYeK3xH4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0/go.mod h1:K8wtUZ/GzRhA21Dy6XDQJZTbpcMF0Kb6FSaJN+rBLJ0=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
@@ -1868,6 +1870,8 @@ github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding v0.
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding v0.147.0/go.mod h1:iCPJltPdOSvckw3kgl3DifMvYasNdOYvDvsJ4fi8lOU=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding/otlpencodingextension v0.147.0 h1:Cx7WcJQKLO/BFaHCwnpH/bbbt8paLQTMxq1fGu5Skzk=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding/otlpencodingextension v0.147.0/go.mod h1:utV5S9gEUzWqIuyPYoecuW346TM/52t6xes7YEQWLCY=
+github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0 h1:FmzmUcx/wn8zlKgPfmSaIp8zrom9FCTcLlqZJiZgcb8=
+github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0/go.mod h1:UUgldOqz0qDW8xgULBjQLOiKdYuOgDSu6wS/t+eLlvg=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/headerssetterextension v0.147.0 h1:jqYiMiW3Eg9kLnKvKgRbWxGcLEWU9PsfyXqTkD1wo9c=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/headerssetterextension v0.147.0/go.mod h1:vxTpEw1jQEzx3wjEtXU+p0cfOv5s3f/ULsYRKzu5vYI=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/internal/credentialsfile v0.147.0 h1:BlP9xxHe4BAbABEIS8TuHr3qDfpyv81n7Bu/sQuVlps=
diff --git a/go.mod b/go.mod
index 7f221f13bca..926625fb829 100644
--- a/go.mod
+++ b/go.mod
@@ -1005,6 +1005,8 @@ require (
 require (
 	buf.build/gen/go/parca-dev/parca/grpc/go v1.6.1-20260206050007-a47b093e4fe5.1
 	buf.build/gen/go/parca-dev/parca/protocolbuffers/go v1.36.11-20260206050007-a47b093e4fe5.1
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0
+	github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/splunk v0.147.0
 	github.com/spf13/viper v1.21.0
 	github.com/zricethezav/gitleaks/v8 v8.30.0
diff --git a/go.sum b/go.sum
index 7e17e4423d7..fc70f6d554c 100644
--- a/go.sum
+++ b/go.sum
@@ -421,6 +421,8 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0/go.mod h1:l9rva3ApbBpEJxSNYnwT9N4CDLrWgtq3u8736C5hyJw=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0 h1:xQMhkBXPOKe/GzC6TctwlK2aNF+9k5VwFgdE83rBK2Y=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.31.0/go.mod h1:VLoD5cAsRQXsAFXpOZrrTGzbuMsntlspIZno4xor5Zg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0 h1:rKcEaxSnVUpmhFNVjRuls5w/6KZrVZNw4kWbYeK3xH4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension v0.55.0/go.mod h1:K8wtUZ/GzRhA21Dy6XDQJZTbpcMF0Kb6FSaJN+rBLJ0=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
@@ -1883,6 +1885,8 @@ github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding v0.
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding v0.147.0/go.mod h1:iCPJltPdOSvckw3kgl3DifMvYasNdOYvDvsJ4fi8lOU=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding/otlpencodingextension v0.147.0 h1:Cx7WcJQKLO/BFaHCwnpH/bbbt8paLQTMxq1fGu5Skzk=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/encoding/otlpencodingextension v0.147.0/go.mod h1:utV5S9gEUzWqIuyPYoecuW346TM/52t6xes7YEQWLCY=
+github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0 h1:FmzmUcx/wn8zlKgPfmSaIp8zrom9FCTcLlqZJiZgcb8=
+github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension v0.147.0/go.mod h1:UUgldOqz0qDW8xgULBjQLOiKdYuOgDSu6wS/t+eLlvg=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/headerssetterextension v0.147.0 h1:jqYiMiW3Eg9kLnKvKgRbWxGcLEWU9PsfyXqTkD1wo9c=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/headerssetterextension v0.147.0/go.mod h1:vxTpEw1jQEzx3wjEtXU+p0cfOv5s3f/ULsYRKzu5vYI=
 github.com/open-telemetry/opentelemetry-collector-contrib/extension/internal/credentialsfile v0.147.0 h1:BlP9xxHe4BAbABEIS8TuHr3qDfpyv81n7Bu/sQuVlps=
diff --git a/internal/component/all/all.go b/internal/component/all/all.go
index eb563bf72e4..b909348772a 100644
--- a/internal/component/all/all.go
+++ b/internal/component/all/all.go
@@ -65,6 +65,7 @@ import (
 	_ "github.com/grafana/alloy/internal/component/mimir/rules/kubernetes"                   // Import mimir.rules.kubernetes
 	_ "github.com/grafana/alloy/internal/component/otelcol/auth/basic"                       // Import otelcol.auth.basic
 	_ "github.com/grafana/alloy/internal/component/otelcol/auth/bearer"                      // Import otelcol.auth.bearer
+	_ "github.com/grafana/alloy/internal/component/otelcol/auth/google"                      // Import otelcol.auth.google
 	_ "github.com/grafana/alloy/internal/component/otelcol/auth/headers"                     // Import otelcol.auth.headers
 	_ "github.com/grafana/alloy/internal/component/otelcol/auth/oauth2"                      // Import otelcol.auth.oauth2
 	_ "github.com/grafana/alloy/internal/component/otelcol/auth/sigv4"                       // Import otelcol.auth.sigv4
diff --git a/internal/component/otelcol/auth/google/google.go b/internal/component/otelcol/auth/google/google.go
new file mode 100644
index 00000000000..830093ba2f7
--- /dev/null
+++ b/internal/component/otelcol/auth/google/google.go
@@ -0,0 +1,116 @@
+package google
+
+import (
+	"github.com/GoogleCloudPlatform/opentelemetry-operations-go/extension/googleclientauthextension"
+	"github.com/grafana/alloy/internal/component"
+	"github.com/grafana/alloy/internal/component/otelcol/auth"
+	otelcolCfg "github.com/grafana/alloy/internal/component/otelcol/config"
+	"github.com/grafana/alloy/internal/featuregate"
+	collectorgoogleauth "github.com/open-telemetry/opentelemetry-collector-contrib/extension/googleclientauthextension"
+	otelcomponent "go.opentelemetry.io/collector/component"
+	"go.opentelemetry.io/collector/pipeline"
+)
+
+func init() {
+	component.Register(component.Registration{
+		Name:      "otelcol.auth.google",
+		Stability: featuregate.StabilityPublicPreview,
+		Args:      Arguments{},
+		Exports:   auth.Exports{},
+
+		Build: func(opts component.Options, args component.Arguments) (component.Component, error) {
+			return auth.New(opts, collectorgoogleauth.NewFactory(), args.(Arguments))
+		},
+	})
+}
+
+// Arguments configures the otelcol.auth.google component.
+type Arguments struct {
+	// Project is the project telemetry is sent to if the gcp.project.id
+	// resource attribute is not set. If unspecified, this is determined using
+	// application default credentials.
+	Project string `alloy:"project,attr,optional"`
+
+	// QuotaProject specifies a project for quota and billing purposes. The
+	// caller must have serviceusage.services.use permission on the project.
+	//
+	// For more information please read:
+	// https://cloud.google.com/apis/docs/system-parameters
+	QuotaProject string `alloy:"quota_project,attr,optional"`
+
+	// TokenType specifies which type of token will be generated.
+	// default: access_token
+	TokenType string `alloy:"token_type,attr,optional"`
+
+	// Audience specifies the audience claim used for generating ID token.
+	Audience string `alloy:"audience,attr,optional"`
+
+	// Scope specifies optional requested permissions.
+	// See https://datatracker.ietf.org/doc/html/rfc6749#section-3.3
+	Scopes []string `alloy:"scopes,attr,optional"`
+
+	// DebugMetrics configures component internal metrics. Optional.
+	DebugMetrics otelcolCfg.DebugMetricsArguments `alloy:"debug_metrics,block,optional"`
+}
+
+var _ auth.Arguments = Arguments{}
+
+// SetToDefault implements syntax.Defaulter.
+func (args *Arguments) SetToDefault() {
+	upstreamDefault := googleclientauthextension.CreateDefaultConfig().(*googleclientauthextension.Config)
+	// TODO: The upstream default config currently reuses a pointer to scopes.
+	// Fix this in the upstream repo and then change this to
+	// upstreamDefault.Scopes.
+	args.Scopes = []string{
+		"https://www.googleapis.com/auth/cloud-platform",
+		"https://www.googleapis.com/auth/logging.write",
+		"https://www.googleapis.com/auth/monitoring.write",
+		"https://www.googleapis.com/auth/trace.append",
+	}
+	args.TokenType = upstreamDefault.TokenType
+	args.DebugMetrics.SetToDefault()
+}
+
+// Validate implements syntax.Validator
+func (args Arguments) Validate() error {
+	converted, _ := args.ConvertClient()
+	return converted.(*collectorgoogleauth.Config).Validate()
+}
+
+// ConvertClient implements auth.Arguments.
+func (args Arguments) ConvertClient() (otelcomponent.Config, error) {
+	return &collectorgoogleauth.Config{
+		Config: googleclientauthextension.Config{
+			Project:      args.Project,
+			QuotaProject: args.QuotaProject,
+			TokenType:    args.TokenType,
+			Audience:     args.Audience,
+			Scopes:       args.Scopes,
+		},
+	}, nil
+}
+
+// ConvertServer returns nil since the ouath2 client extension does not support server auth.
+func (args Arguments) ConvertServer() (otelcomponent.Config, error) {
+	return nil, nil
+}
+
+// Extensions implements auth.Arguments.
+func (args Arguments) Extensions() map[otelcomponent.ID]otelcomponent.Component {
+	return nil
+}
+
+// Exporters implements auth.Arguments.
+func (args Arguments) Exporters() map[pipeline.Signal]map[otelcomponent.ID]otelcomponent.Component {
+	return nil
+}
+
+// AuthFeatures implements auth.Arguments.
+func (args Arguments) AuthFeatures() auth.AuthFeature {
+	return auth.ClientAuthSupported
+}
+
+// DebugMetricsConfig implements auth.Arguments.
+func (args Arguments) DebugMetricsConfig() otelcolCfg.DebugMetricsArguments {
+	return args.DebugMetrics
+}
diff --git a/internal/component/otelcol/auth/google/google_test.go b/internal/component/otelcol/auth/google/google_test.go
new file mode 100644
index 00000000000..5d2e760781e
--- /dev/null
+++ b/internal/component/otelcol/auth/google/google_test.go
@@ -0,0 +1,109 @@
+package google_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/grafana/alloy/internal/component"
+	"github.com/grafana/alloy/internal/component/otelcol/auth"
+	"github.com/grafana/alloy/internal/component/otelcol/auth/google"
+	"github.com/grafana/alloy/internal/runtime/componenttest"
+	"github.com/grafana/alloy/internal/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	extauth "go.opentelemetry.io/collector/extension/extensionauth"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	// Make sure metadata.OnGCE always returns true, since the result is
+	// cached.
+	os.Setenv("GCE_METADATA_HOST", "127.0.0.1")
+}
+
+func TestRoundTripper(t *testing.T) {
+	// Mimic metadata server, and return the fake access token.
+	fakeToken := oauth2.Token{
+		AccessToken:  "accessToken",
+		TokenType:    "tokenType",
+		RefreshToken: "refreshToken",
+		ExpiresIn:    1,
+	}
+	b, err := json.Marshal(fakeToken)
+	require.NoError(t, err)
+	tokenString := string(b)
+	srvProvidingTokens := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprint(w, tokenString)
+	}))
+	defer srvProvidingTokens.Close()
+	t.Setenv("GCE_METADATA_HOST", srvProvidingTokens.Listener.Addr().String())
+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "")
+	t.Setenv("HOME", t.TempDir()) // Prevent picking up user's application default credentials
+
+	// Create and run our component
+	l := util.TestLogger(t)
+	ctrl, err := componenttest.NewControllerFromID(l, "otelcol.auth.google")
+	require.NoError(t, err)
+
+	args := google.Arguments{
+		Project:      "my-project",
+		QuotaProject: "other-project",
+		TokenType:    "access_token",
+	}
+
+	go func() {
+		err := ctrl.Run(t.Context(), args)
+		require.NoError(t, err)
+	}()
+
+	require.NoError(t, ctrl.WaitRunning(time.Second), "component never started")
+	require.NoError(t, ctrl.WaitExports(time.Second), "component never exported anything")
+
+	startedComponent, err := ctrl.GetComponent()
+	require.NoError(t, err, "no component added in controller.")
+	require.Eventually(t, func() bool {
+		return startedComponent.(component.HealthComponent).CurrentHealth().Health == component.HealthTypeHealthy
+	}, time.Second, 10*time.Millisecond, "timed out waiting for component to be healthy")
+
+	// Get the authentication extension from our component and use it to make a
+	// request to our test server.
+	exports, ok := ctrl.Exports().(auth.Exports)
+	require.True(t, ok, "extension doesn't export auth exports struct")
+	require.NotNil(t, exports.Handler)
+
+	ext, err := exports.Handler.GetExtension(auth.Client)
+	require.NoError(t, err)
+	require.NotNil(t, ext.Extension, "handler extension is nil")
+
+	clientAuth, ok := ext.Extension.(extauth.HTTPClient)
+	require.True(t, ok, "handler does not implement configauth.ClientAuthenticator")
+
+	// Validate that the request has the required headers.
+	rt, err := clientAuth.RoundTripper(roundTripperFunc(func(r *http.Request) (*http.Response, error) {
+		assert.Equal(t, r.Header.Get("X-Goog-User-Project"), "other-project")
+		assert.Equal(t, r.Header.Get("X-Goog-Project-ID"), "my-project")
+		assert.Equal(t, r.Header.Get("foo"), "bar")
+		if r.Header.Get("Authorization") != "tokenType accessToken" {
+			// Don't print this out in-case it is a real access token.
+			t.Error("Authorization header was incorrect. FindDefaultCredentials may have found real credentials.")
+		}
+		return &http.Response{}, nil
+	}))
+	require.NoError(t, err)
+	header := make(http.Header)
+	header.Set("foo", "bar")
+	_, err = rt.(*oauth2.Transport).RoundTrip(&http.Request{Header: header})
+	require.NoError(t, err)
+}
+
+type roundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (fn roundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) {
+	return fn(r)
+}