Google Auth Library Client - Class ExternalAccountCredentials (1.52.0)

Reference documentation and code samples for the Google Auth Library Client class ExternalAccountCredentials.

IMPORTANT: This class does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used.

When the credential configuration is accepted from an untrusted source, you should validate it before creating this class.

Namespace

Google \ Auth \ Credentials

Implements

Methods

__construct

Parameters
Name Description
scope string|string[]

The scope of the access request, expressed either as an array or as a space-delimited string.
jsonKey array

JSON credentials as an associative array.
enableRegionalAccessBoundary bool

Lookup and include the regional access boundary header.

fetchAuthToken

Fetches the auth tokens based on the current state.

Parameters
Name Description
httpHandler callable|null
headers array

[optional] Metrics headers to be inserted into the token endpoint request present.
Returns
Type Description
array { A set of auth related metadata, containing the following @type string $access_token @type int $expires_at (impersonated service accounts only) @type int $expires_in (identity pool only) @type string $issued_token_type (identity pool only) @type string $token_type (identity pool only) }

updateMetadata

Updates metadata with the authorization token.

Parameters
Name Description
metadata array

metadata hashmap
authUri string

optional auth uri
httpHandler callable|null

callback which delivers psr7 request
Returns
Type Description
array updated metadata hashmap

getCacheKey

Get the cache token key for the credentials.

The cache token key format depends on the type of source The format for the cache key one of the following: FetcherCacheKey.Scope.[ServiceAccount].[TokenType].[WorkforcePoolUserProject] FetcherCacheKey.Audience.[ServiceAccount].[TokenType].[WorkforcePoolUserProject]

getLastReceivedToken

Returns an associative array with the token and expiration time.

getQuotaProject

Get the quota project used for this API request

Returns
Type Description
string|null

getUniverseDomain

Get the universe domain used for this API request

Returns
Type Description
string

getProjectId

Get the project ID.

Parameters
Name Description
httpHandler callable|null

Callback which delivers psr7 request
accessToken string|null

The access token to use to sign the blob. If provided, saves a call to the metadata server for a new access token. Defaults to null.
Returns
Type Description
string|null