Update google-cloud-batch.md

Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>

Author: justinegeffen

platform-enterprise_docs/compute-envs/google-cloud-batch.md

@@ -102,18 +102,32 @@ You can manage your key from the **Service Accounts** page.
 
 Workload Identity Federation (WIF) is the recommended authentication method for production and regulated environments because it eliminates the need for long-lived service account keys. WIF uses short-lived OIDC tokens for authentication, which are generated by Seqera Platform.
 
-:::note
-If you have not generated and set an RSA keypair as part of your Enterprise deployment, any authentication will fail with the message `WIF credentials require the OIDC provider to be configured (tower.oidc.pem.path)`.
-:::
+To authenticate using Workload Identity Federation, you must first configure a [Workload Identity Pool and Provider](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers) in your Google Cloud project. 
+
+WIF requires an OIDC signng key and for Seqera Platform's OIDC provider to  be configured. See [Cryptographic options](https://docs.seqera.io/platform-enterprise/enterprise/configuration/overview#cryptographic-options).
+
+**Generate the OIDC signing key**
+
+Generate a PEM keypair and configure Platform to use it:
 
-To authenticate using Workload Identity Federation, you must first configure a [Workload Identity Pool and Provider](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers) in your Google Cloud project. After setting up WIF in Google Cloud, you need the following information to create a credential in Seqera:
+```bash
+openssl genrsa -out private.pem 4096
+openssl rsa -in private.pem -outform PEM -pubout -out public.pem
+cat private.pem public.pem > oidc.pem
+```
+
+Set `TOWER_OIDC_PEM_PATH` to the path of the `oidc.pem` file in your Platform deployment. For example:
+
+`TOWER_OIDC_PEM_PATH=/path/to/oidc.pem`.
+
+If you have not generated and set an RSA keypair as part of your Enterprise deployment, any authentication will fail with the message `WIF credentials require the OIDC provider to be configured (tower.oidc.pem.path)`. 
+
+After setting up WIF in Google Cloud, you need the following information to create a credential in Seqera:
 
 * **Service Account Email**: The email address of the Google Cloud service account that WIF will impersonate.
 * **Workload Identity Provider**: The full resource path of the Workload Identity Provider (e.g., `projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID`).
 * **Token Audience** (optional): The intended audience for the OIDC token. Configure this if your Workload Identity Provider requires a specific audience value.
 
-In the context of Seqera Platform, WIF is supported as a credential for GCP Batch, Google Cloud, and GKE.
-
 :::caution
 If WIF authentication fails, verify that the Workload Identity Provider path is correctly formatted, the service account has the required permissions, and the Kubernetes service account is properly annotated for your deployment environment. Check the Seqera Platform logs for specific error details — a `400` error typically indicates an invalid provider format, while a `401` error indicates a token exchange failure.
 :::