diff --git a/scripts/expose/configure_iap.sh b/scripts/expose/configure_iap.sh
index edd5be8..c4f6bb5 100755
--- a/scripts/expose/configure_iap.sh
+++ b/scripts/expose/configure_iap.sh
@@ -20,6 +20,7 @@ if [ $EXISTING_SECRET_NAME == 'null' ]; then
   read -p 'Enter your OAuth credentials Client ID: ' CLIENT_ID
   read -p 'Enter your OAuth credentials Client secret: ' CLIENT_SECRET
 
+  if [[ ($CONFIGURE_SPIN_CLI=="YES")||(-z "$CONFIGURE_SPIN_CLI") ]]; then
   cat >~/.spin/config <<EOL
 gate:
   endpoint: https://$DOMAIN_NAME/gate
@@ -35,10 +36,10 @@ EOL
     --filter="displayName:$SERVICE_ACCOUNT_NAME" \
     --format='value(email)')
 
-  gcloud iam service-accounts keys create ~/.spin/key.json \
-    --iam-account $SA_EMAIL \
-    --project $PROJECT_ID
-
+    gcloud iam service-accounts keys create ~/.spin/key.json \
+      --iam-account $SA_EMAIL \
+      --project $PROJECT_ID
+  fi
   kubectl create secret generic $SECRET_NAME -n spinnaker --from-literal=client_id=$CLIENT_ID \
     --from-literal=client_secret=$CLIENT_SECRET
 else
diff --git a/scripts/install/setup_properties.sh b/scripts/install/setup_properties.sh
index 040e495..6d261d0 100755
--- a/scripts/install/setup_properties.sh
+++ b/scripts/install/setup_properties.sh
@@ -190,6 +190,8 @@ export PUBSUB_NOTIFICATION_TOPIC=\$DEPLOYMENT_NAME-notifications-topic
 export STATIC_IP_NAME=\$DEPLOYMENT_NAME-external-ip
 export MANAGED_CERT=\$DEPLOYMENT_NAME-managed-cert
 export SECRET_NAME=\$DEPLOYMENT_NAME-oauth-client-secret
+# Configure spin cli for access through IAP
+export CONFIGURE_SPIN_CLI=YES
 
 # If you own a domain name and want to use that instead of this automatically-assigned one,
 # specify it here (you must be able to configure the dns settings).
diff --git a/scripts/manage/add_missing_properties.sh b/scripts/manage/add_missing_properties.sh
index bc41499..3bb1f9d 100755
--- a/scripts/manage/add_missing_properties.sh
+++ b/scripts/manage/add_missing_properties.sh
@@ -28,3 +28,5 @@ add_property_if_missing CONFIG_CSR_REPO "$CSR_PROPERTY_DECLARATION"
 add_property_if_missing NETWORK_PROJECT "export NETWORK_PROJECT=\$PROJECT_ID"
 add_property_if_missing NETWORK_REFERENCE "export NETWORK_REFERENCE=projects/\$NETWORK_PROJECT/global/networks/\$NETWORK"
 add_property_if_missing SUBNET_REFERENCE "export SUBNET_REFERENCE=projects/\$NETWORK_PROJECT/regions/\$REGION/subnetworks/\$SUBNET"
+
+add_property_if_missing CONFIGURE_SPIN_CLI "export CONFIGURE_SPIN_CLI=YES"