google-auth-library

  • Version 7.10.3
  • Published
  • 411 kB
  • 9 dependencies
  • Apache-2.0 license

Install

npm i google-auth-library
yarn add google-auth-library
pnpm add google-auth-library

Overview

Google APIs Authentication Client Library for Node.js

Index

Variables

Classes

Interfaces

Enums

Type Aliases

Variables

variable auth

const auth: GoogleAuth;

    Classes

    class AwsClient

    class AwsClient extends BaseExternalAccountClient {}
    • AWS external account client. This is used for AWS workloads, where AWS STS GetCallerIdentity serialized signed requests are exchanged for GCP access token.

    constructor

    constructor(options: AwsClientOptions, additionalOptions?: RefreshOptions);
    • Instantiates an AwsClient instance using the provided JSON object loaded from an external account credentials file. An error is thrown if the credential is not a valid AWS credential.

      Parameter options

      The external account options object typically loaded from the external account JSON credential file.

      Parameter additionalOptions

      Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors.

    method retrieveSubjectToken

    retrieveSubjectToken: () => Promise<string>;
    • Triggered when an external subject token is needed to be exchanged for a GCP access token via GCP STS endpoint. This uses the options.credential_source object to figure out how to retrieve the token using the current environment. In this case, this uses a serialized AWS signed request to the STS GetCallerIdentity endpoint. The logic is summarized as: 1. Retrieve AWS region from availability-zone. 2a. Check AWS credentials in environment variables. If not found, get from security-credentials endpoint. 2b. Get AWS credentials from security-credentials endpoint. In order to retrieve this, the AWS role needs to be determined by calling security-credentials endpoint without any argument. Then the credentials can be retrieved via: security-credentials/role_name 3. Generate the signed request to AWS STS GetCallerIdentity action. 4. Inject x-goog-cloud-target-resource into header and serialize the signed request. This will be the subject-token to pass to GCP STS. A promise that resolves with the external subject token.

    class BaseExternalAccountClient

    abstract class BaseExternalAccountClient extends AuthClient {}
    • Base external account client. This is used to instantiate AuthClients for exchanging external account credentials for GCP access token and authorizing requests to GCP APIs. The base class implements common logic for exchanging various type of external credentials for GCP access token. The logic of determining and retrieving the external credential based on the environment and credential_source will be left for the subclasses.

    constructor

    constructor(
    options: BaseExternalAccountClientOptions,
    additionalOptions?: RefreshOptions
    );
    • Instantiate a BaseExternalAccountClient instance using the provided JSON object loaded from an external account credentials file.

      Parameter options

      The external account options object typically loaded from the external account JSON credential file.

      Parameter additionalOptions

      Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors.

    property audience

    protected readonly audience: string;

      property eagerRefreshThresholdMillis

      readonly eagerRefreshThresholdMillis: number;

        property forceRefreshOnFailure

        readonly forceRefreshOnFailure: boolean;

          property projectId

          projectId: string;

            property projectNumber

            projectNumber: string;

              property scopes

              scopes?: string | string[];
              • OAuth scopes for the GCP access token to use. When not provided, the default https://www.googleapis.com/auth/cloud-platform is used.

              method getAccessToken

              getAccessToken: () => Promise<GetAccessTokenResponse>;
              • A promise that resolves with the current GCP access token response. If the current credential is expired, a new one is retrieved.

              method getProjectId

              getProjectId: () => Promise<string | null>;
              • A promise that resolves with the project ID corresponding to the current workload identity pool or current workforce pool if determinable. For workforce pool credential, it returns the project ID corresponding to the workforcePoolUserProject. This is introduced to match the current pattern of using the Auth library: const projectId = await auth.getProjectId(); const url = https://dns.googleapis.com/dns/v1/projects/${projectId}; const res = await client.request({ url }); The resource may not have permission (resourcemanager.projects.get) to call this API or the required scopes may not be selected: https://cloud.google.com/resource-manager/reference/rest/v1/projects/get#authorization-scopes

              method getRequestHeaders

              getRequestHeaders: () => Promise<Headers>;
              • The main authentication interface. It takes an optional url which when present is the endpoint being accessed, and returns a Promise which resolves with authorization header fields.

                The result has the form: { Authorization: 'Bearer <access_token_value>' }

              method getServiceAccountEmail

              getServiceAccountEmail: () => string | null;
              • The service account email to be impersonated, if available.

              method refreshAccessTokenAsync

              protected refreshAccessTokenAsync: () => Promise<CredentialsWithResponse>;
              • Forces token refresh, even if unexpired tokens are currently cached. External credentials are exchanged for GCP access tokens via the token exchange endpoint and other settings provided in the client options object. If the service_account_impersonation_url is provided, an additional step to exchange the external account GCP access token for a service account impersonated token is performed. A promise that resolves with the fresh GCP access tokens.

              method request

              request: {
              <T>(opts: any): any;
              <T>(opts: any, callback: BodyResponseCallback<T>): void;
              };
              • Provides a request implementation with OAuth 2.0 flow. In cases of HTTP 401 and 403 responses, it automatically asks for a new access token and replays the unsuccessful request.

                Parameter opts

                Request options.

                Parameter callback

                callback. A promise that resolves with the HTTP response when no callback is provided.

              method requestAsync

              protected requestAsync: <T>(
              opts: any,
              retry?: boolean
              ) => Promise<GaxiosResponse<T>>;
              • Authenticates the provided HTTP request, processes it and resolves with the returned response.

                Parameter opts

                The HTTP request options.

                Parameter retry

                Whether the current attempt is a retry after a failed attempt. A promise that resolves with the successful response.

              method retrieveSubjectToken

              abstract retrieveSubjectToken: () => Promise<string>;
              • Triggered when a external subject token is needed to be exchanged for a GCP access token via GCP STS endpoint. This abstract method needs to be implemented by subclasses depending on the type of external credential used. A promise that resolves with the external subject token.

              method setCredentials

              setCredentials: (credentials: Credentials) => void;
              • Provides a mechanism to inject GCP access tokens directly. When the provided credential expires, a new credential, using the external account options, is retrieved.

                Parameter credentials

                The Credentials object to set on the current client.

              class Compute

              class Compute extends OAuth2Client {}

                constructor

                constructor(options?: ComputeOptions);
                • Google Compute Engine service account credentials.

                  Retrieve access token from the metadata server. See: https://developers.google.com/compute/docs/authentication

                property scopes

                scopes: string[];

                  method fetchIdToken

                  fetchIdToken: (targetAudience: string) => Promise<string>;
                  • Fetches an ID token.

                    Parameter targetAudience

                    the audience for the fetched ID token.

                  method refreshTokenNoCache

                  protected refreshTokenNoCache: (
                  refreshToken?: string | null
                  ) => Promise<GetTokenResponse>;
                  • Refreshes the access token.

                    Parameter refreshToken

                    Unused parameter

                  method wrapError

                  protected wrapError: (e: any) => void;

                    class DefaultTransporter

                    class DefaultTransporter {}

                      property USER_AGENT

                      static readonly USER_AGENT: string;
                      • Default user agent.

                      method configure

                      configure: (opts?: any) => any;
                      • Configures request options before making a request.

                        Parameter opts

                        GaxiosOptions options. Configured options.

                      method request

                      request: {
                      <T>(opts: any): any;
                      <T>(opts: any, callback?: BodyResponseCallback<T>): void;
                      };
                      • Makes a request using Gaxios with given options.

                        Parameter opts

                        GaxiosOptions options.

                        Parameter callback

                        optional callback that contains GaxiosResponse object. GaxiosPromise, assuming no callback is passed.

                      class DownscopedClient

                      class DownscopedClient extends AuthClient {}
                      • Defines a set of Google credentials that are downscoped from an existing set of Google OAuth2 credentials. This is useful to restrict the Identity and Access Management (IAM) permissions that a short-lived credential can use. The common pattern of usage is to have a token broker with elevated access generate these downscoped credentials from higher access source credentials and pass the downscoped short-lived access tokens to a token consumer via some secure authenticated channel for limited access to Google Cloud Storage resources.

                      constructor

                      constructor(
                      authClient: AuthClient,
                      credentialAccessBoundary: CredentialAccessBoundary,
                      additionalOptions?: RefreshOptions,
                      quotaProjectId?: string
                      );
                      • Instantiates a downscoped client object using the provided source AuthClient and credential access boundary rules. To downscope permissions of a source AuthClient, a Credential Access Boundary that specifies which resources the new credential can access, as well as an upper bound on the permissions that are available on each resource, has to be defined. A downscoped client can then be instantiated using the source AuthClient and the Credential Access Boundary.

                        Parameter authClient

                        The source AuthClient to be downscoped based on the provided Credential Access Boundary rules.

                        Parameter credentialAccessBoundary

                        The Credential Access Boundary which contains a list of access boundary rules. Each rule contains information on the resource that the rule applies to, the upper bound of the permissions that are available on that resource and an optional condition to further restrict permissions.

                        Parameter additionalOptions

                        Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors.

                        Parameter quotaProjectId

                        Optional quota project id for setting up in the x-goog-user-project header.

                      property eagerRefreshThresholdMillis

                      readonly eagerRefreshThresholdMillis: number;

                        property forceRefreshOnFailure

                        readonly forceRefreshOnFailure: boolean;

                          method getAccessToken

                          getAccessToken: () => Promise<DownscopedAccessTokenResponse>;

                            method getRequestHeaders

                            getRequestHeaders: () => Promise<Headers>;
                            • The main authentication interface. It takes an optional url which when present is the endpoint being accessed, and returns a Promise which resolves with authorization header fields.

                              The result has the form: { Authorization: 'Bearer <access_token_value>' }

                            method refreshAccessTokenAsync

                            protected refreshAccessTokenAsync: () => Promise<CredentialsWithResponse>;
                            • Forces token refresh, even if unexpired tokens are currently cached. GCP access tokens are retrieved from authclient object/source credential. Then GCP access tokens are exchanged for downscoped access tokens via the token exchange endpoint. A promise that resolves with the fresh downscoped access token.

                            method request

                            request: {
                            <T>(opts: any): any;
                            <T>(opts: any, callback: BodyResponseCallback<T>): void;
                            };
                            • Provides a request implementation with OAuth 2.0 flow. In cases of HTTP 401 and 403 responses, it automatically asks for a new access token and replays the unsuccessful request.

                              Parameter opts

                              Request options.

                              Parameter callback

                              callback. A promise that resolves with the HTTP response when no callback is provided.

                            method requestAsync

                            protected requestAsync: <T>(
                            opts: any,
                            retry?: boolean
                            ) => Promise<GaxiosResponse<T>>;
                            • Authenticates the provided HTTP request, processes it and resolves with the returned response.

                              Parameter opts

                              The HTTP request options.

                              Parameter retry

                              Whether the current attempt is a retry after a failed attempt. A promise that resolves with the successful response.

                            method setCredentials

                            setCredentials: (credentials: Credentials) => void;
                            • Provides a mechanism to inject Downscoped access tokens directly. The expiry_date field is required to facilitate determination of the token expiration which would make it easier for the token consumer to handle.

                              Parameter credentials

                              The Credentials object to set on the current client.

                            class ExternalAccountClient

                            class ExternalAccountClient {}
                            • Dummy class with no constructor. Developers are expected to use fromJSON.

                            constructor

                            constructor();

                              method fromJSON

                              static fromJSON: (
                              options: ExternalAccountClientOptions,
                              additionalOptions?: RefreshOptions
                              ) => BaseExternalAccountClient | null;
                              • This static method will instantiate the corresponding type of external account credential depending on the underlying credential source.

                                Parameter options

                                The external account options object typically loaded from the external account JSON credential file.

                                Parameter additionalOptions

                                Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors. A BaseExternalAccountClient instance or null if the options provided do not correspond to an external account credential.

                              class GoogleAuth

                              class GoogleAuth {}

                                constructor

                                constructor(opts?: GoogleAuthOptions);

                                  property cachedCredential

                                  cachedCredential: JSONClient | Compute;

                                    property defaultScopes

                                    defaultScopes?: string | string[];
                                    • Scopes populated by the client library by default. We differentiate between these and user defined scopes when deciding whether to use a self-signed JWT.

                                    property defaultServicePath

                                    defaultServicePath?: string;

                                      property DefaultTransporter

                                      static DefaultTransporter: typeof DefaultTransporter;
                                      • Export DefaultTransporter as a static property of the class.

                                      property isGCE

                                      readonly isGCE: boolean;

                                        property jsonContent

                                        jsonContent: ExternalAccountClientOptions | JWTInput;

                                          property transporter

                                          transporter?: Transporter;

                                            property useJWTAccessWithScope

                                            useJWTAccessWithScope?: boolean;

                                              method authorizeRequest

                                              authorizeRequest: (opts: {
                                              url?: string;
                                              uri?: string;
                                              headers?: Headers;
                                              }) => Promise<{
                                              url?: string | undefined;
                                              uri?: string | undefined;
                                              headers?: Headers | undefined;
                                              }>;
                                              • Obtain credentials for a request, then attach the appropriate headers to the request options.

                                                Parameter opts

                                                Axios or Request options on which to attach the headers

                                              method fromAPIKey

                                              fromAPIKey: (apiKey: string, options?: RefreshOptions) => JWT;
                                              • Create a credentials instance using the given API key string.

                                                Parameter apiKey

                                                The API key string

                                                Parameter options

                                                An optional options object.

                                                Returns

                                                A JWT loaded from the key

                                              method fromJSON

                                              fromJSON: (json: JWTInput, options?: RefreshOptions) => JSONClient;
                                              • Create a credentials instance using the given input options.

                                                Parameter json

                                                The input object.

                                                Parameter options

                                                The JWT or UserRefresh options for the client

                                                Returns

                                                JWT or UserRefresh Client with data

                                              method fromStream

                                              fromStream: {
                                              (inputStream: any): Promise<JSONClient>;
                                              (inputStream: any, callback: CredentialCallback): void;
                                              (inputStream: any, options: RefreshOptions): Promise<JSONClient>;
                                              (
                                              inputStream: any,
                                              options: RefreshOptions,
                                              callback: CredentialCallback
                                              ): void;
                                              };
                                              • Create a credentials instance using the given input stream.

                                                Parameter inputStream

                                                The input stream.

                                                Parameter callback

                                                Optional callback.

                                              method getAccessToken

                                              getAccessToken: () => Promise<string | null | undefined>;
                                              • Automatically obtain application default credentials, and return an access token for making requests.

                                              method getApplicationDefault

                                              getApplicationDefault: {
                                              (): Promise<ADCResponse>;
                                              (callback: ADCCallback): void;
                                              (options: RefreshOptions): Promise<ADCResponse>;
                                              (options: RefreshOptions, callback: ADCCallback): void;
                                              };
                                              • Obtains the default service-level credentials for the application.

                                                Parameter callback

                                                Optional callback.

                                                Returns

                                                Promise that resolves with the ADCResponse (if no callback was passed).

                                              method getClient

                                              getClient: (
                                              options?: DeprecatedGetClientOptions
                                              ) => Promise<
                                              Compute | JWT | UserRefreshClient | Impersonated | BaseExternalAccountClient
                                              >;
                                              • Automatically obtain a client based on the provided configuration. If no options were passed, use Application Default Credentials.

                                              method getCredentials

                                              getCredentials: {
                                              (): Promise<CredentialBody>;
                                              (callback: (err: Error, credentials?: CredentialBody) => void): void;
                                              };
                                              • The callback function handles a credential object that contains the client_email and private_key (if exists). getCredentials checks for these values from the user JSON at first. If it doesn't exist, and the environment is on GCE, it gets the client_email from the cloud metadata server.

                                                Parameter callback

                                                Callback that handles the credential object that contains a client_email and optional private key, or the error. returned

                                              method getEnv

                                              getEnv: () => Promise<GCPEnv>;
                                              • Determine the compute environment in which the code is running.

                                              method getIdTokenClient

                                              getIdTokenClient: (targetAudience: string) => Promise<IdTokenClient>;
                                              • Creates a client which will fetch an ID token for authorization.

                                                Parameter targetAudience

                                                the audience for the fetched ID token.

                                                Returns

                                                IdTokenClient for making HTTP calls authenticated with ID tokens.

                                              method getProjectId

                                              getProjectId: { (): Promise<string>; (callback: ProjectIdCallback): void };
                                              • Obtains the default project ID for the application.

                                                Parameter callback

                                                Optional callback

                                                Returns

                                                Promise that resolves with project Id (if used without callback)

                                              method getRequestHeaders

                                              getRequestHeaders: (url?: string) => Promise<Headers>;
                                              • Obtain the HTTP headers that will provide authorization for a given request.

                                              method request

                                              request: <T = any>(opts: any) => Promise<GaxiosResponse<T>>;
                                              • Automatically obtain application default credentials, and make an HTTP request using the given options.

                                                Parameter opts

                                                Axios request options for the HTTP request.

                                              method setGapicJWTValues

                                              setGapicJWTValues: (client: JWT) => void;

                                                method sign

                                                sign: (data: string) => Promise<string>;
                                                • Sign the given data with the current private key, or go out to the IAM API to sign it.

                                                  Parameter data

                                                  The data to be signed.

                                                class IAMAuth

                                                class IAMAuth {}

                                                  constructor

                                                  constructor(selector: string, token: string);
                                                  • IAM credentials.

                                                    Parameter selector

                                                    the iam authority selector

                                                    Parameter token

                                                    the token

                                                  property selector

                                                  selector: string;

                                                    property token

                                                    token: string;

                                                      method getRequestHeaders

                                                      getRequestHeaders: () => {
                                                      'x-goog-iam-authority-selector': string;
                                                      'x-goog-iam-authorization-token': string;
                                                      };
                                                      • Acquire the HTTP headers required to make an authenticated request.

                                                      class IdentityPoolClient

                                                      class IdentityPoolClient extends BaseExternalAccountClient {}
                                                      • Defines the Url-sourced and file-sourced external account clients mainly used for K8s and Azure workloads.

                                                      constructor

                                                      constructor(
                                                      options: IdentityPoolClientOptions,
                                                      additionalOptions?: RefreshOptions
                                                      );
                                                      • Instantiate an IdentityPoolClient instance using the provided JSON object loaded from an external account credentials file. An error is thrown if the credential is not a valid file-sourced or url-sourced credential or a workforce pool user project is provided with a non workforce audience.

                                                        Parameter options

                                                        The external account options object typically loaded from the external account JSON credential file.

                                                        Parameter additionalOptions

                                                        Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors.

                                                      method retrieveSubjectToken

                                                      retrieveSubjectToken: () => Promise<string>;
                                                      • Triggered when a external subject token is needed to be exchanged for a GCP access token via GCP STS endpoint. This uses the options.credential_source object to figure out how to retrieve the token using the current environment. In this case, this either retrieves the local credential from a file location (k8s workload) or by sending a GET request to a local metadata server (Azure workloads). A promise that resolves with the external subject token.

                                                      class IdTokenClient

                                                      class IdTokenClient extends OAuth2Client {}

                                                        constructor

                                                        constructor(options: IdTokenOptions);
                                                        • Google ID Token client

                                                          Retrieve access token from the metadata server. See: https://developers.google.com/compute/docs/authentication

                                                        property idTokenProvider

                                                        idTokenProvider: IdTokenProvider;

                                                          property targetAudience

                                                          targetAudience: string;

                                                            method getRequestMetadataAsync

                                                            protected getRequestMetadataAsync: (
                                                            url?: string | null
                                                            ) => Promise<RequestMetadataResponse>;

                                                              class Impersonated

                                                              class Impersonated extends OAuth2Client {}

                                                                constructor

                                                                constructor(options?: ImpersonatedOptions);
                                                                • Impersonated service account credentials.

                                                                  Create a new access token by impersonating another service account.

                                                                  Impersonated Credentials allowing credentials issued to a user or service account to impersonate another. The source project using Impersonated Credentials must enable the "IAMCredentials" API. Also, the target service account must grant the orginating principal the "Service Account Token Creator" IAM role.

                                                                  Parameter options

                                                                  The configuration object.

                                                                  Parameter

                                                                  {object} [options.sourceClient] the source credential used as to acquire the impersonated credentials.

                                                                  Parameter

                                                                  {string} [options.targetPrincipal] the service account to impersonate.

                                                                  Parameter

                                                                  {string[]} [options.delegates] the chained list of delegates required to grant the final access_token. If set, the sequence of identities must have "Service Account Token Creator" capability granted to the preceding identity. For example, if set to [serviceAccountB, serviceAccountC], the sourceCredential must have the Token Creator role on serviceAccountB. serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token Creator on target_principal. If left unset, sourceCredential must have that role on targetPrincipal.

                                                                  Parameter

                                                                  {string[]} [options.targetScopes] scopes to request during the authorization grant.

                                                                  Parameter

                                                                  {number} [options.lifetime] number of seconds the delegated credential should be valid for up to 3600 seconds by default, or 43,200 seconds by extending the token's lifetime, see: https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth

                                                                  Parameter

                                                                  {string} [options.endpoint] api endpoint override.

                                                                method refreshToken

                                                                protected refreshToken: (
                                                                refreshToken?: string | null
                                                                ) => Promise<GetTokenResponse>;
                                                                • Refreshes the access token.

                                                                  Parameter refreshToken

                                                                  Unused parameter

                                                                class JWT

                                                                class JWT extends OAuth2Client implements IdTokenProvider {}

                                                                  constructor

                                                                  constructor(options: JWTOptions);
                                                                  • JWT service account credentials.

                                                                    Retrieve access token using gtoken.

                                                                    Parameter email

                                                                    service account email address.

                                                                    Parameter keyFile

                                                                    path to private key file.

                                                                    Parameter key

                                                                    value of key

                                                                    Parameter scopes

                                                                    list of requested scopes or a single scope.

                                                                    Parameter subject

                                                                    impersonated account's email address.

                                                                    Parameter key_id

                                                                    the ID of the key

                                                                  constructor

                                                                  constructor(
                                                                  email?: string,
                                                                  keyFile?: string,
                                                                  key?: string,
                                                                  scopes?: string | string[],
                                                                  subject?: string,
                                                                  keyId?: string
                                                                  );

                                                                    property additionalClaims

                                                                    additionalClaims?: {};

                                                                      property defaultScopes

                                                                      defaultScopes?: string | string[];

                                                                        property defaultServicePath

                                                                        defaultServicePath?: string;

                                                                          property email

                                                                          email?: string;

                                                                            property gtoken

                                                                            gtoken?: any;

                                                                              property key

                                                                              key?: string;

                                                                                property keyFile

                                                                                keyFile?: string;

                                                                                  property keyId

                                                                                  keyId?: string;

                                                                                    property scope

                                                                                    scope?: string;

                                                                                      property scopes

                                                                                      scopes?: string | string[];

                                                                                        property subject

                                                                                        subject?: string;

                                                                                          property useJWTAccessWithScope

                                                                                          useJWTAccessWithScope?: boolean;

                                                                                            method authorize

                                                                                            authorize: {
                                                                                            (): Promise<Credentials>;
                                                                                            (callback: (err: Error, result?: Credentials) => void): void;
                                                                                            };
                                                                                            • Get the initial access token using gToken.

                                                                                              Parameter callback

                                                                                              Optional callback.

                                                                                              Returns

                                                                                              Promise that resolves with credentials

                                                                                            method createScoped

                                                                                            createScoped: (scopes?: string | string[]) => JWT;
                                                                                            • Creates a copy of the credential with the specified scopes.

                                                                                              Parameter scopes

                                                                                              List of requested scopes or a single scope. The cloned instance.

                                                                                            method fetchIdToken

                                                                                            fetchIdToken: (targetAudience: string) => Promise<string>;
                                                                                            • Fetches an ID token.

                                                                                              Parameter targetAudience

                                                                                              the audience for the fetched ID token.

                                                                                            method fromAPIKey

                                                                                            fromAPIKey: (apiKey: string) => void;
                                                                                            • Creates a JWT credentials instance using an API Key for authentication.

                                                                                              Parameter apiKey

                                                                                              The API Key in string form.

                                                                                            method fromJSON

                                                                                            fromJSON: (json: JWTInput) => void;
                                                                                            • Create a JWT credentials instance using the given input options.

                                                                                              Parameter json

                                                                                              The input object.

                                                                                            method fromStream

                                                                                            fromStream: {
                                                                                            (inputStream: any): Promise<void>;
                                                                                            (inputStream: any, callback: (err?: Error) => void): void;
                                                                                            };
                                                                                            • Create a JWT credentials instance using the given input stream.

                                                                                              Parameter inputStream

                                                                                              The input stream.

                                                                                              Parameter callback

                                                                                              Optional callback.

                                                                                            method getCredentials

                                                                                            getCredentials: () => Promise<CredentialBody>;
                                                                                            • Using the key or keyFile on the JWT client, obtain an object that contains the key and the client email.

                                                                                            method getRequestMetadataAsync

                                                                                            protected getRequestMetadataAsync: (
                                                                                            url?: string | null
                                                                                            ) => Promise<RequestMetadataResponse>;
                                                                                            • Obtains the metadata to be sent with the request.

                                                                                              Parameter url

                                                                                              the URI being authorized.

                                                                                            method refreshTokenNoCache

                                                                                            protected refreshTokenNoCache: (
                                                                                            refreshToken?: string | null
                                                                                            ) => Promise<GetTokenResponse>;
                                                                                            • Refreshes the access token.

                                                                                              Parameter refreshToken

                                                                                              ignored

                                                                                            class JWTAccess

                                                                                            class JWTAccess {}

                                                                                              constructor

                                                                                              constructor(
                                                                                              email?: string,
                                                                                              key?: string,
                                                                                              keyId?: string,
                                                                                              eagerRefreshThresholdMillis?: number
                                                                                              );
                                                                                              • JWTAccess service account credentials.

                                                                                                Create a new access token by using the credential to create a new JWT token that's recognized as the access token.

                                                                                                Parameter email

                                                                                                the service account email address.

                                                                                                Parameter key

                                                                                                the private key that will be used to sign the token.

                                                                                                Parameter keyId

                                                                                                the ID of the private key used to sign the token.

                                                                                              property eagerRefreshThresholdMillis

                                                                                              eagerRefreshThresholdMillis: number;

                                                                                                property email

                                                                                                email?: string;

                                                                                                  property key

                                                                                                  key?: string;

                                                                                                    property keyId

                                                                                                    keyId?: string;

                                                                                                      property projectId

                                                                                                      projectId?: string;

                                                                                                        method fromJSON

                                                                                                        fromJSON: (json: JWTInput) => void;
                                                                                                        • Create a JWTAccess credentials instance using the given input options.

                                                                                                          Parameter json

                                                                                                          The input object.

                                                                                                        method fromStream

                                                                                                        fromStream: {
                                                                                                        (inputStream: any): Promise<void>;
                                                                                                        (inputStream: any, callback: (err?: Error) => void): void;
                                                                                                        };
                                                                                                        • Create a JWTAccess credentials instance using the given input stream.

                                                                                                          Parameter inputStream

                                                                                                          The input stream.

                                                                                                          Parameter callback

                                                                                                          Optional callback.

                                                                                                        method getCachedKey

                                                                                                        getCachedKey: (url?: string, scopes?: string | string[]) => string;
                                                                                                        • Ensures that we're caching a key appropriately, giving precedence to scopes vs. url

                                                                                                          Parameter url

                                                                                                          The URI being authorized.

                                                                                                          Parameter scopes

                                                                                                          The scope or scopes being authorized

                                                                                                          Returns

                                                                                                          A string that returns the cached key.

                                                                                                        method getRequestHeaders

                                                                                                        getRequestHeaders: (
                                                                                                        url?: string,
                                                                                                        additionalClaims?: Claims,
                                                                                                        scopes?: string | string[]
                                                                                                        ) => Headers;
                                                                                                        • Get a non-expired access token, after refreshing if necessary.

                                                                                                          Parameter url

                                                                                                          The URI being authorized.

                                                                                                          Parameter additionalClaims

                                                                                                          An object with a set of additional claims to include in the payload.

                                                                                                          Returns

                                                                                                          An object that includes the authorization header.

                                                                                                        class LoginTicket

                                                                                                        class LoginTicket {}

                                                                                                          constructor

                                                                                                          constructor(env?: string, pay?: TokenPayload);
                                                                                                          • Create a simple class to extract user ID from an ID Token

                                                                                                            Parameter env

                                                                                                            Envelope of the jwt

                                                                                                            Parameter pay

                                                                                                            Payload of the jwt

                                                                                                          method getAttributes

                                                                                                          getAttributes: () => {
                                                                                                          envelope: string | undefined;
                                                                                                          payload: TokenPayload | undefined;
                                                                                                          };
                                                                                                          • Returns attributes from the login ticket. This can contain various information about the user session.

                                                                                                            The envelope and payload

                                                                                                          method getEnvelope

                                                                                                          getEnvelope: () => string | undefined;

                                                                                                            method getPayload

                                                                                                            getPayload: () => TokenPayload | undefined;

                                                                                                              method getUserId

                                                                                                              getUserId: () => string | null;
                                                                                                              • Create a simple class to extract user ID from an ID Token

                                                                                                                The user ID

                                                                                                              class OAuth2Client

                                                                                                              class OAuth2Client extends AuthClient {}

                                                                                                                constructor

                                                                                                                constructor(options?: OAuth2ClientOptions);
                                                                                                                • Handles OAuth2 flow for Google APIs.

                                                                                                                  Parameter clientId

                                                                                                                  The authentication client ID.

                                                                                                                  Parameter clientSecret

                                                                                                                  The authentication client secret.

                                                                                                                  Parameter redirectUri

                                                                                                                  The URI to redirect to after completing the auth request.

                                                                                                                  Parameter opts

                                                                                                                  optional options for overriding the given parameters.

                                                                                                                constructor

                                                                                                                constructor(clientId?: string, clientSecret?: string, redirectUri?: string);

                                                                                                                  property apiKey

                                                                                                                  apiKey?: string;

                                                                                                                    property eagerRefreshThresholdMillis

                                                                                                                    eagerRefreshThresholdMillis: number;

                                                                                                                      property forceRefreshOnFailure

                                                                                                                      forceRefreshOnFailure: boolean;

                                                                                                                        property GOOGLE_TOKEN_INFO_URL

                                                                                                                        protected static readonly GOOGLE_TOKEN_INFO_URL: string;

                                                                                                                          property projectId

                                                                                                                          projectId?: string;

                                                                                                                            property refreshHandler

                                                                                                                            refreshHandler?: GetRefreshHandlerCallback;

                                                                                                                              property refreshTokenPromises

                                                                                                                              protected refreshTokenPromises: Map<string, Promise<GetTokenResponse>>;

                                                                                                                                method generateAuthUrl

                                                                                                                                generateAuthUrl: (opts?: GenerateAuthUrlOpts) => string;
                                                                                                                                • Generates URL for consent page landing.

                                                                                                                                  Parameter opts

                                                                                                                                  Options. URL to consent page.

                                                                                                                                method generateCodeVerifier

                                                                                                                                generateCodeVerifier: () => void;

                                                                                                                                  method generateCodeVerifierAsync

                                                                                                                                  generateCodeVerifierAsync: () => Promise<CodeVerifierResults>;
                                                                                                                                  • Convenience method to automatically generate a code_verifier, and its resulting SHA256. If used, this must be paired with a S256 code_challenge_method.

                                                                                                                                    For a full example see: https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/oauth2-codeVerifier.js

                                                                                                                                  method getAccessToken

                                                                                                                                  getAccessToken: {
                                                                                                                                  (): Promise<GetAccessTokenResponse>;
                                                                                                                                  (callback: GetAccessTokenCallback): void;
                                                                                                                                  };
                                                                                                                                  • Get a non-expired access token, after refreshing if necessary

                                                                                                                                    Parameter callback

                                                                                                                                    Callback to call with the access token

                                                                                                                                  method getFederatedSignonCerts

                                                                                                                                  getFederatedSignonCerts: {
                                                                                                                                  (): Promise<FederatedSignonCertsResponse>;
                                                                                                                                  (callback: GetFederatedSignonCertsCallback): void;
                                                                                                                                  };
                                                                                                                                  • Gets federated sign-on certificates to use for verifying identity tokens. Returns certs as array structure, where keys are key ids, and values are certificates in either PEM or JWK format.

                                                                                                                                    Parameter callback

                                                                                                                                    Callback supplying the certificates

                                                                                                                                  method getFederatedSignonCertsAsync

                                                                                                                                  getFederatedSignonCertsAsync: () => Promise<FederatedSignonCertsResponse>;

                                                                                                                                    method getIapPublicKeys

                                                                                                                                    getIapPublicKeys: {
                                                                                                                                    (): Promise<IapPublicKeysResponse>;
                                                                                                                                    (callback: GetIapPublicKeysCallback): void;
                                                                                                                                    };
                                                                                                                                    • Gets federated sign-on certificates to use for verifying identity tokens. Returns certs as array structure, where keys are key ids, and values are certificates in either PEM or JWK format.

                                                                                                                                      Parameter callback

                                                                                                                                      Callback supplying the certificates

                                                                                                                                    method getIapPublicKeysAsync

                                                                                                                                    getIapPublicKeysAsync: () => Promise<IapPublicKeysResponse>;

                                                                                                                                      method getRequestHeaders

                                                                                                                                      getRequestHeaders: (url?: string) => Promise<Headers>;
                                                                                                                                      • The main authentication interface. It takes an optional url which when present is the endpoint being accessed, and returns a Promise which resolves with authorization header fields.

                                                                                                                                        In OAuth2Client, the result has the form: { Authorization: 'Bearer <access_token_value>' }

                                                                                                                                        Parameter url

                                                                                                                                        The optional url being authorized

                                                                                                                                      method getRequestMetadataAsync

                                                                                                                                      protected getRequestMetadataAsync: (
                                                                                                                                      url?: string | null
                                                                                                                                      ) => Promise<RequestMetadataResponse>;

                                                                                                                                        method getRevokeTokenUrl

                                                                                                                                        static getRevokeTokenUrl: (token: string) => string;
                                                                                                                                        • Generates an URL to revoke the given token.

                                                                                                                                          Parameter token

                                                                                                                                          The existing token to be revoked.

                                                                                                                                        method getToken

                                                                                                                                        getToken: {
                                                                                                                                        (code: string): Promise<GetTokenResponse>;
                                                                                                                                        (options: GetTokenOptions): Promise<GetTokenResponse>;
                                                                                                                                        (code: string, callback: GetTokenCallback): void;
                                                                                                                                        (options: GetTokenOptions, callback: GetTokenCallback): void;
                                                                                                                                        };
                                                                                                                                        • Gets the access token for the given code.

                                                                                                                                          Parameter code

                                                                                                                                          The authorization code.

                                                                                                                                          Parameter callback

                                                                                                                                          Optional callback fn.

                                                                                                                                        method getTokenInfo

                                                                                                                                        getTokenInfo: (accessToken: string) => Promise<TokenInfo>;
                                                                                                                                        • Obtains information about the provisioned access token. Especially useful if you want to check the scopes that were provisioned to a given token.

                                                                                                                                          Parameter accessToken

                                                                                                                                          Required. The Access Token for which you want to get user info.

                                                                                                                                        method isTokenExpiring

                                                                                                                                        protected isTokenExpiring: () => boolean;
                                                                                                                                        • Returns true if a token is expired or will expire within eagerRefreshThresholdMillismilliseconds. If there is no expiry time, assumes the token is not expired or expiring.

                                                                                                                                        method refreshAccessToken

                                                                                                                                        refreshAccessToken: {
                                                                                                                                        (): Promise<RefreshAccessTokenResponse>;
                                                                                                                                        (callback: RefreshAccessTokenCallback): void;
                                                                                                                                        };
                                                                                                                                        • Retrieves the access token using refresh token

                                                                                                                                          Parameter callback

                                                                                                                                          callback

                                                                                                                                          Deprecated

                                                                                                                                          use getRequestHeaders instead.

                                                                                                                                        method refreshToken

                                                                                                                                        protected refreshToken: (
                                                                                                                                        refreshToken?: string | null
                                                                                                                                        ) => Promise<GetTokenResponse>;
                                                                                                                                        • Refreshes the access token.

                                                                                                                                          Parameter refresh_token

                                                                                                                                          Existing refresh token.

                                                                                                                                        method refreshTokenNoCache

                                                                                                                                        protected refreshTokenNoCache: (
                                                                                                                                        refreshToken?: string | null
                                                                                                                                        ) => Promise<GetTokenResponse>;

                                                                                                                                          method request

                                                                                                                                          request: {
                                                                                                                                          <T>(opts: any): any;
                                                                                                                                          <T>(opts: any, callback: BodyResponseCallback<T>): void;
                                                                                                                                          };
                                                                                                                                          • Provides a request implementation with OAuth 2.0 flow. If credentials have a refresh_token, in cases of HTTP 401 and 403 responses, it automatically asks for a new access token and replays the unsuccessful request.

                                                                                                                                            Parameter opts

                                                                                                                                            Request options.

                                                                                                                                            Parameter callback

                                                                                                                                            callback. Request object

                                                                                                                                          method requestAsync

                                                                                                                                          protected requestAsync: <T>(
                                                                                                                                          opts: any,
                                                                                                                                          retry?: boolean
                                                                                                                                          ) => Promise<GaxiosResponse<T>>;

                                                                                                                                            method revokeCredentials

                                                                                                                                            revokeCredentials: {
                                                                                                                                            (): any;
                                                                                                                                            (callback: BodyResponseCallback<RevokeCredentialsResult>): void;
                                                                                                                                            };
                                                                                                                                            • Revokes access token and clears the credentials object

                                                                                                                                              Parameter callback

                                                                                                                                              callback

                                                                                                                                            method revokeToken

                                                                                                                                            revokeToken: {
                                                                                                                                            (token: string): any;
                                                                                                                                            (
                                                                                                                                            token: string,
                                                                                                                                            callback: BodyResponseCallback<RevokeCredentialsResult>
                                                                                                                                            ): void;
                                                                                                                                            };
                                                                                                                                            • Revokes the access given to token.

                                                                                                                                              Parameter token

                                                                                                                                              The existing token to be revoked.

                                                                                                                                              Parameter callback

                                                                                                                                              Optional callback fn.

                                                                                                                                            method verifyIdToken

                                                                                                                                            verifyIdToken: {
                                                                                                                                            (options: VerifyIdTokenOptions): Promise<LoginTicket>;
                                                                                                                                            (
                                                                                                                                            options: VerifyIdTokenOptions,
                                                                                                                                            callback: (err: Error, login?: LoginTicket) => void
                                                                                                                                            ): void;
                                                                                                                                            };
                                                                                                                                            • Verify id token is token by checking the certs and audience

                                                                                                                                              Parameter options

                                                                                                                                              that contains all options.

                                                                                                                                              Parameter callback

                                                                                                                                              Callback supplying GoogleLogin if successful

                                                                                                                                            method verifySignedJwtWithCerts

                                                                                                                                            verifySignedJwtWithCerts: () => void;

                                                                                                                                              method verifySignedJwtWithCertsAsync

                                                                                                                                              verifySignedJwtWithCertsAsync: (
                                                                                                                                              jwt: string,
                                                                                                                                              certs: Certificates | PublicKeys,
                                                                                                                                              requiredAudience?: string | string[],
                                                                                                                                              issuers?: string[],
                                                                                                                                              maxExpiry?: number
                                                                                                                                              ) => Promise<LoginTicket>;
                                                                                                                                              • Verify the id token is signed with the correct certificate and is from the correct audience.

                                                                                                                                                Parameter jwt

                                                                                                                                                The jwt to verify (The ID Token in this case).

                                                                                                                                                Parameter certs

                                                                                                                                                The array of certs to test the jwt against.

                                                                                                                                                Parameter requiredAudience

                                                                                                                                                The audience to test the jwt against.

                                                                                                                                                Parameter issuers

                                                                                                                                                The allowed issuers of the jwt (Optional).

                                                                                                                                                Parameter maxExpiry

                                                                                                                                                The max expiry the certificate can be (Optional). Returns a promise resolving to LoginTicket on verification.

                                                                                                                                              class UserRefreshClient

                                                                                                                                              class UserRefreshClient extends OAuth2Client {}

                                                                                                                                                constructor

                                                                                                                                                constructor(clientId?: string, clientSecret?: string, refreshToken?: string);
                                                                                                                                                • User Refresh Token credentials.

                                                                                                                                                  Parameter clientId

                                                                                                                                                  The authentication client ID.

                                                                                                                                                  Parameter clientSecret

                                                                                                                                                  The authentication client secret.

                                                                                                                                                  Parameter refreshToken

                                                                                                                                                  The authentication refresh token.

                                                                                                                                                constructor

                                                                                                                                                constructor(options: UserRefreshClientOptions);

                                                                                                                                                  constructor

                                                                                                                                                  constructor(clientId?: string, clientSecret?: string, refreshToken?: string);

                                                                                                                                                    method fromJSON

                                                                                                                                                    fromJSON: (json: JWTInput) => void;
                                                                                                                                                    • Create a UserRefreshClient credentials instance using the given input options.

                                                                                                                                                      Parameter json

                                                                                                                                                      The input object.

                                                                                                                                                    method fromStream

                                                                                                                                                    fromStream: {
                                                                                                                                                    (inputStream: any): Promise<void>;
                                                                                                                                                    (inputStream: any, callback: (err?: Error) => void): void;
                                                                                                                                                    };
                                                                                                                                                    • Create a UserRefreshClient credentials instance using the given input stream.

                                                                                                                                                      Parameter inputStream

                                                                                                                                                      The input stream.

                                                                                                                                                      Parameter callback

                                                                                                                                                      Optional callback.

                                                                                                                                                    method refreshTokenNoCache

                                                                                                                                                    protected refreshTokenNoCache: (
                                                                                                                                                    refreshToken?: string | null
                                                                                                                                                    ) => Promise<GetTokenResponse>;
                                                                                                                                                    • Refreshes the access token.

                                                                                                                                                      Parameter refreshToken

                                                                                                                                                      An ignored refreshToken..

                                                                                                                                                      Parameter callback

                                                                                                                                                      Optional callback.

                                                                                                                                                    Interfaces

                                                                                                                                                    interface AwsClientOptions

                                                                                                                                                    interface AwsClientOptions extends BaseExternalAccountClientOptions {}
                                                                                                                                                    • AWS credentials JSON interface. This is used for AWS workloads.

                                                                                                                                                    property credential_source

                                                                                                                                                    credential_source: {
                                                                                                                                                    environment_id: string;
                                                                                                                                                    region_url?: string;
                                                                                                                                                    url?: string;
                                                                                                                                                    regional_cred_verification_url: string;
                                                                                                                                                    };

                                                                                                                                                      interface BaseExternalAccountClientOptions

                                                                                                                                                      interface BaseExternalAccountClientOptions {}
                                                                                                                                                      • Base external account credentials json interface.

                                                                                                                                                      property audience

                                                                                                                                                      audience: string;

                                                                                                                                                        property client_id

                                                                                                                                                        client_id?: string;

                                                                                                                                                          property client_secret

                                                                                                                                                          client_secret?: string;

                                                                                                                                                            property quota_project_id

                                                                                                                                                            quota_project_id?: string;

                                                                                                                                                              property service_account_impersonation_url

                                                                                                                                                              service_account_impersonation_url?: string;

                                                                                                                                                                property subject_token_type

                                                                                                                                                                subject_token_type: string;

                                                                                                                                                                  property token_info_url

                                                                                                                                                                  token_info_url?: string;

                                                                                                                                                                    property token_url

                                                                                                                                                                    token_url: string;

                                                                                                                                                                      property type

                                                                                                                                                                      type: string;

                                                                                                                                                                        property workforce_pool_user_project

                                                                                                                                                                        workforce_pool_user_project?: string;

                                                                                                                                                                          interface Certificates

                                                                                                                                                                          interface Certificates {}

                                                                                                                                                                            index signature

                                                                                                                                                                            [index: string]: string | JwkCertificate;

                                                                                                                                                                              interface Claims

                                                                                                                                                                              interface Claims {}

                                                                                                                                                                                index signature

                                                                                                                                                                                [index: string]: string;

                                                                                                                                                                                  interface CodeVerifierResults

                                                                                                                                                                                  interface CodeVerifierResults {}
                                                                                                                                                                                  • The results from the generateCodeVerifierAsync method. To learn more, See the sample: https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/oauth2-codeVerifier.js

                                                                                                                                                                                  property codeChallenge

                                                                                                                                                                                  codeChallenge?: string;
                                                                                                                                                                                  • The code_challenge that should be sent with the generateAuthUrl call to obtain a verifiable authentication url.

                                                                                                                                                                                  property codeVerifier

                                                                                                                                                                                  codeVerifier: string;
                                                                                                                                                                                  • The code verifier that will be used when calling getToken to obtain a new access token.

                                                                                                                                                                                  interface ComputeOptions

                                                                                                                                                                                  interface ComputeOptions extends RefreshOptions {}

                                                                                                                                                                                    property scopes

                                                                                                                                                                                    scopes?: string | string[];
                                                                                                                                                                                    • The scopes that will be requested when acquiring service account credentials. Only applicable to modern App Engine and Cloud Function runtimes as of March 2019.

                                                                                                                                                                                    property serviceAccountEmail

                                                                                                                                                                                    serviceAccountEmail?: string;
                                                                                                                                                                                    • The service account email to use, or 'default'. A Compute Engine instance may have multiple service accounts.

                                                                                                                                                                                    interface CredentialAccessBoundary

                                                                                                                                                                                    interface CredentialAccessBoundary {}
                                                                                                                                                                                    • Defines an upper bound of permissions available for a GCP credential.

                                                                                                                                                                                    property accessBoundary

                                                                                                                                                                                    accessBoundary: {
                                                                                                                                                                                    accessBoundaryRules: AccessBoundaryRule[];
                                                                                                                                                                                    };

                                                                                                                                                                                      interface CredentialBody

                                                                                                                                                                                      interface CredentialBody {}

                                                                                                                                                                                        property client_email

                                                                                                                                                                                        client_email?: string;

                                                                                                                                                                                          property private_key

                                                                                                                                                                                          private_key?: string;

                                                                                                                                                                                            interface CredentialRequest

                                                                                                                                                                                            interface CredentialRequest {}

                                                                                                                                                                                              property access_token

                                                                                                                                                                                              access_token?: string;
                                                                                                                                                                                              • A token that can be sent to a Google API.

                                                                                                                                                                                              property expires_in

                                                                                                                                                                                              expires_in?: number;
                                                                                                                                                                                              • The remaining lifetime of the access token in seconds.

                                                                                                                                                                                              property id_token

                                                                                                                                                                                              id_token?: string;
                                                                                                                                                                                              • A JWT that contains identity information about the user that is digitally signed by Google.

                                                                                                                                                                                              property refresh_token

                                                                                                                                                                                              refresh_token?: string;
                                                                                                                                                                                              • This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.

                                                                                                                                                                                              property scope

                                                                                                                                                                                              scope?: string;
                                                                                                                                                                                              • The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.

                                                                                                                                                                                              property token_type

                                                                                                                                                                                              token_type?: string;
                                                                                                                                                                                              • Identifies the type of token returned. At this time, this field always has the value Bearer.

                                                                                                                                                                                              interface Credentials

                                                                                                                                                                                              interface Credentials {}

                                                                                                                                                                                                property access_token

                                                                                                                                                                                                access_token?: string | null;
                                                                                                                                                                                                • A token that can be sent to a Google API.

                                                                                                                                                                                                property expiry_date

                                                                                                                                                                                                expiry_date?: number | null;
                                                                                                                                                                                                • The time in ms at which this token is thought to expire.

                                                                                                                                                                                                property id_token

                                                                                                                                                                                                id_token?: string | null;
                                                                                                                                                                                                • A JWT that contains identity information about the user that is digitally signed by Google.

                                                                                                                                                                                                property refresh_token

                                                                                                                                                                                                refresh_token?: string | null;
                                                                                                                                                                                                • This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.

                                                                                                                                                                                                property scope

                                                                                                                                                                                                scope?: string;
                                                                                                                                                                                                • The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.

                                                                                                                                                                                                property token_type

                                                                                                                                                                                                token_type?: string | null;
                                                                                                                                                                                                • Identifies the type of token returned. At this time, this field always has the value Bearer.

                                                                                                                                                                                                interface GenerateAuthUrlOpts

                                                                                                                                                                                                interface GenerateAuthUrlOpts {}

                                                                                                                                                                                                  property access_type

                                                                                                                                                                                                  access_type?: string;
                                                                                                                                                                                                  • Recommended. Indicates whether your application can refresh access tokens when the user is not present at the browser. Valid parameter values are 'online', which is the default value, and 'offline'. Set the value to 'offline' if your application needs to refresh access tokens when the user is not present at the browser. This value instructs the Google authorization server to return a refresh token and an access token the first time that your application exchanges an authorization code for tokens.

                                                                                                                                                                                                  property client_id

                                                                                                                                                                                                  client_id?: string;
                                                                                                                                                                                                  • The client ID for your application. The value passed into the constructor will be used if not provided. You can find this value in the API Console.

                                                                                                                                                                                                  property code_challenge

                                                                                                                                                                                                  code_challenge?: string;
                                                                                                                                                                                                  • Recommended. Specifies an encoded 'code_verifier' that will be used as a server-side challenge during authorization code exchange. This parameter must be used with the 'code_challenge' parameter described above.

                                                                                                                                                                                                  property code_challenge_method

                                                                                                                                                                                                  code_challenge_method?: CodeChallengeMethod;
                                                                                                                                                                                                  • Recommended. Specifies what method was used to encode a 'code_verifier' that will be used during authorization code exchange. This parameter must be used with the 'code_challenge' parameter. The value of the 'code_challenge_method' defaults to "plain" if not present in the request that includes a 'code_challenge'. The only supported values for this parameter are "S256" or "plain".

                                                                                                                                                                                                  property hd

                                                                                                                                                                                                  hd?: string;
                                                                                                                                                                                                  • The hd (hosted domain) parameter streamlines the login process for G Suite hosted accounts. By including the domain of the G Suite user (for example, mycollege.edu), you can indicate that the account selection UI should be optimized for accounts at that domain. To optimize for G Suite accounts generally instead of just one domain, use an asterisk: hd=*. Don't rely on this UI optimization to control who can access your app, as client-side requests can be modified. Be sure to validate that the returned ID token has an hd claim value that matches what you expect (e.g. mycolledge.edu). Unlike the request parameter, the ID token claim is contained within a security token from Google, so the value can be trusted.

                                                                                                                                                                                                  property include_granted_scopes

                                                                                                                                                                                                  include_granted_scopes?: boolean;
                                                                                                                                                                                                  • Optional. Enables applications to use incremental authorization to request access to additional scopes in context. If you set this parameter's value to true and the authorization request is granted, then the new access token will also cover any scopes to which the user previously granted the application access. See the incremental authorization section for examples.

                                                                                                                                                                                                  property login_hint

                                                                                                                                                                                                  login_hint?: string;
                                                                                                                                                                                                  • Optional. If your application knows which user is trying to authenticate, it can use this parameter to provide a hint to the Google Authentication Server. The server uses the hint to simplify the login flow either by prefilling the email field in the sign-in form or by selecting the appropriate multi-login session. Set the parameter value to an email address or sub identifier, which is equivalent to the user's Google ID.

                                                                                                                                                                                                  property prompt

                                                                                                                                                                                                  prompt?: string;
                                                                                                                                                                                                  • Optional. A space-delimited, case-sensitive list of prompts to present the user. If you don't specify this parameter, the user will be prompted only the first time your app requests access. Possible values are:

                                                                                                                                                                                                    'none' - Donot display any authentication or consent screens. Must not be specified with other values. 'consent' - Prompt the user for consent. 'select_account' - Prompt the user to select an account.

                                                                                                                                                                                                  property redirect_uri

                                                                                                                                                                                                  redirect_uri?: string;
                                                                                                                                                                                                  • Determines where the API server redirects the user after the user completes the authorization flow. The value must exactly match one of the 'redirect_uri' values listed for your project in the API Console. Note that the http or https scheme, case, and trailing slash ('/') must all match. The value passed into the constructor will be used if not provided.

                                                                                                                                                                                                  property response_type

                                                                                                                                                                                                  response_type?: string;
                                                                                                                                                                                                  • The 'response_type' will always be set to 'CODE'.

                                                                                                                                                                                                  property scope

                                                                                                                                                                                                  scope?: string[] | string;
                                                                                                                                                                                                  • Required. A space-delimited list of scopes that identify the resources that your application could access on the user's behalf. These values inform the consent screen that Google displays to the user. Scopes enable your application to only request access to the resources that it needs while also enabling users to control the amount of access that they grant to your application. Thus, there is an inverse relationship between the number of scopes requested and the likelihood of obtaining user consent. The OAuth 2.0 API Scopes document provides a full list of scopes that you might use to access Google APIs. We recommend that your application request access to authorization scopes in context whenever possible. By requesting access to user data in context, via incremental authorization, you help users to more easily understand why your application needs the access it is requesting.

                                                                                                                                                                                                  property state

                                                                                                                                                                                                  state?: string;
                                                                                                                                                                                                  • Recommended. Specifies any string value that your application uses to maintain state between your authorization request and the authorization server's response. The server returns the exact value that you send as a name=value pair in the hash (#) fragment of the 'redirect_uri' after the user consents to or denies your application's access request. You can use this parameter for several purposes, such as directing the user to the correct resource in your application, sending nonces, and mitigating cross-site request forgery. Since your redirect_uri can be guessed, using a state value can increase your assurance that an incoming connection is the result of an authentication request. If you generate a random string or encode the hash of a cookie or another value that captures the client's state, you can validate the response to additionally ensure that the request and response originated in the same browser, providing protection against attacks such as cross-site request forgery. See the OpenID Connect documentation for an example of how to create and confirm a state token.

                                                                                                                                                                                                  interface GetTokenOptions

                                                                                                                                                                                                  interface GetTokenOptions {}

                                                                                                                                                                                                    property client_id

                                                                                                                                                                                                    client_id?: string;
                                                                                                                                                                                                    • The client ID for your application. The value passed into the constructor will be used if not provided. Must match any client_id option passed to a corresponding call to generateAuthUrl.

                                                                                                                                                                                                    property code

                                                                                                                                                                                                    code: string;

                                                                                                                                                                                                      property codeVerifier

                                                                                                                                                                                                      codeVerifier?: string;

                                                                                                                                                                                                        property redirect_uri

                                                                                                                                                                                                        redirect_uri?: string;
                                                                                                                                                                                                        • Determines where the API server redirects the user after the user completes the authorization flow. The value passed into the constructor will be used if not provided. Must match any redirect_uri option passed to a corresponding call to generateAuthUrl.

                                                                                                                                                                                                        interface GoogleAuthOptions

                                                                                                                                                                                                        interface GoogleAuthOptions {}

                                                                                                                                                                                                          property clientOptions

                                                                                                                                                                                                          clientOptions?:
                                                                                                                                                                                                          | JWTOptions
                                                                                                                                                                                                          | OAuth2ClientOptions
                                                                                                                                                                                                          | UserRefreshClientOptions
                                                                                                                                                                                                          | ImpersonatedOptions;
                                                                                                                                                                                                          • Options object passed to the constructor of the client

                                                                                                                                                                                                          property credentials

                                                                                                                                                                                                          credentials?: CredentialBody | ExternalAccountClientOptions;
                                                                                                                                                                                                          • Object containing client_email and private_key properties, or the external account client options.

                                                                                                                                                                                                          property keyFile

                                                                                                                                                                                                          keyFile?: string;
                                                                                                                                                                                                          • Path to a .json, .pem, or .p12 key file

                                                                                                                                                                                                          property keyFilename

                                                                                                                                                                                                          keyFilename?: string;
                                                                                                                                                                                                          • Path to a .json, .pem, or .p12 key file

                                                                                                                                                                                                          property projectId

                                                                                                                                                                                                          projectId?: string;
                                                                                                                                                                                                          • Your project ID.

                                                                                                                                                                                                          property scopes

                                                                                                                                                                                                          scopes?: string | string[];
                                                                                                                                                                                                          • Required scopes for the desired API request

                                                                                                                                                                                                          interface IdentityPoolClientOptions

                                                                                                                                                                                                          interface IdentityPoolClientOptions extends BaseExternalAccountClientOptions {}
                                                                                                                                                                                                          • Url-sourced/file-sourced credentials json interface. This is used for K8s and Azure workloads.

                                                                                                                                                                                                          property credential_source

                                                                                                                                                                                                          credential_source: {
                                                                                                                                                                                                          file?: string;
                                                                                                                                                                                                          url?: string;
                                                                                                                                                                                                          headers?: {
                                                                                                                                                                                                          [key: string]: string;
                                                                                                                                                                                                          };
                                                                                                                                                                                                          format?: {
                                                                                                                                                                                                          type: SubjectTokenFormatType;
                                                                                                                                                                                                          subject_token_field_name?: string;
                                                                                                                                                                                                          };
                                                                                                                                                                                                          };

                                                                                                                                                                                                            interface IdTokenProvider

                                                                                                                                                                                                            interface IdTokenProvider {}

                                                                                                                                                                                                              property fetchIdToken

                                                                                                                                                                                                              fetchIdToken: (targetAudience: string) => Promise<string>;

                                                                                                                                                                                                                interface ImpersonatedOptions

                                                                                                                                                                                                                interface ImpersonatedOptions extends RefreshOptions {}

                                                                                                                                                                                                                  property delegates

                                                                                                                                                                                                                  delegates?: string[];
                                                                                                                                                                                                                  • The chained list of delegates required to grant the final access_token.

                                                                                                                                                                                                                  property endpoint

                                                                                                                                                                                                                  endpoint?: string;
                                                                                                                                                                                                                  • API endpoint to fetch token from.

                                                                                                                                                                                                                  property lifetime

                                                                                                                                                                                                                  lifetime?: number | 3600;
                                                                                                                                                                                                                  • Number of seconds the delegated credential should be valid.

                                                                                                                                                                                                                  property sourceClient

                                                                                                                                                                                                                  sourceClient?: AuthClient;
                                                                                                                                                                                                                  • Client used to perform exchange for impersonated client.

                                                                                                                                                                                                                  property targetPrincipal

                                                                                                                                                                                                                  targetPrincipal?: string;
                                                                                                                                                                                                                  • The service account to impersonate.

                                                                                                                                                                                                                  property targetScopes

                                                                                                                                                                                                                  targetScopes?: string[];
                                                                                                                                                                                                                  • Scopes to request during the authorization grant.

                                                                                                                                                                                                                  interface JWTInput

                                                                                                                                                                                                                  interface JWTInput {}

                                                                                                                                                                                                                    property client_email

                                                                                                                                                                                                                    client_email?: string;

                                                                                                                                                                                                                      property client_id

                                                                                                                                                                                                                      client_id?: string;

                                                                                                                                                                                                                        property client_secret

                                                                                                                                                                                                                        client_secret?: string;

                                                                                                                                                                                                                          property private_key

                                                                                                                                                                                                                          private_key?: string;

                                                                                                                                                                                                                            property private_key_id

                                                                                                                                                                                                                            private_key_id?: string;

                                                                                                                                                                                                                              property project_id

                                                                                                                                                                                                                              project_id?: string;

                                                                                                                                                                                                                                property quota_project_id

                                                                                                                                                                                                                                quota_project_id?: string;

                                                                                                                                                                                                                                  property refresh_token

                                                                                                                                                                                                                                  refresh_token?: string;

                                                                                                                                                                                                                                    property type

                                                                                                                                                                                                                                    type?: string;

                                                                                                                                                                                                                                      interface JWTOptions

                                                                                                                                                                                                                                      interface JWTOptions extends RefreshOptions {}

                                                                                                                                                                                                                                        property additionalClaims

                                                                                                                                                                                                                                        additionalClaims?: {};

                                                                                                                                                                                                                                          property email

                                                                                                                                                                                                                                          email?: string;

                                                                                                                                                                                                                                            property key

                                                                                                                                                                                                                                            key?: string;

                                                                                                                                                                                                                                              property keyFile

                                                                                                                                                                                                                                              keyFile?: string;

                                                                                                                                                                                                                                                property keyId

                                                                                                                                                                                                                                                keyId?: string;

                                                                                                                                                                                                                                                  property scopes

                                                                                                                                                                                                                                                  scopes?: string | string[];

                                                                                                                                                                                                                                                    property subject

                                                                                                                                                                                                                                                    subject?: string;

                                                                                                                                                                                                                                                      interface OAuth2ClientOptions

                                                                                                                                                                                                                                                      interface OAuth2ClientOptions extends RefreshOptions {}

                                                                                                                                                                                                                                                        property clientId

                                                                                                                                                                                                                                                        clientId?: string;

                                                                                                                                                                                                                                                          property clientSecret

                                                                                                                                                                                                                                                          clientSecret?: string;

                                                                                                                                                                                                                                                            property redirectUri

                                                                                                                                                                                                                                                            redirectUri?: string;

                                                                                                                                                                                                                                                              interface ProjectIdCallback

                                                                                                                                                                                                                                                              interface ProjectIdCallback {}

                                                                                                                                                                                                                                                                call signature

                                                                                                                                                                                                                                                                (err?: Error | null, projectId?: string | null): void;

                                                                                                                                                                                                                                                                  interface RefreshOptions

                                                                                                                                                                                                                                                                  interface RefreshOptions {}

                                                                                                                                                                                                                                                                    property eagerRefreshThresholdMillis

                                                                                                                                                                                                                                                                    eagerRefreshThresholdMillis?: number;

                                                                                                                                                                                                                                                                      property forceRefreshOnFailure

                                                                                                                                                                                                                                                                      forceRefreshOnFailure?: boolean;

                                                                                                                                                                                                                                                                        interface RequestMetadata

                                                                                                                                                                                                                                                                        interface RequestMetadata {}

                                                                                                                                                                                                                                                                          property 'x-goog-iam-authority-selector'

                                                                                                                                                                                                                                                                          'x-goog-iam-authority-selector': string;

                                                                                                                                                                                                                                                                            property 'x-goog-iam-authorization-token'

                                                                                                                                                                                                                                                                            'x-goog-iam-authorization-token': string;

                                                                                                                                                                                                                                                                              interface TokenInfo

                                                                                                                                                                                                                                                                              interface TokenInfo {}

                                                                                                                                                                                                                                                                                property access_type

                                                                                                                                                                                                                                                                                access_type?: string;
                                                                                                                                                                                                                                                                                • Indicates whether your application can refresh access tokens when the user is not present at the browser. Valid parameter values are 'online', which is the default value, and 'offline'. Set the value to 'offline' if your application needs to refresh access tokens when the user is not present at the browser. This value instructs the Google authorization server to return a refresh token and an access token the first time that your application exchanges an authorization code for tokens.

                                                                                                                                                                                                                                                                                property aud

                                                                                                                                                                                                                                                                                aud: string;
                                                                                                                                                                                                                                                                                • The application that is the intended user of the access token.

                                                                                                                                                                                                                                                                                property azp

                                                                                                                                                                                                                                                                                azp?: string;
                                                                                                                                                                                                                                                                                • The client_id of the authorized presenter. This claim is only needed when the party requesting the ID token is not the same as the audience of the ID token. This may be the case at Google for hybrid apps where a web application and Android app have a different client_id but share the same project.

                                                                                                                                                                                                                                                                                property email

                                                                                                                                                                                                                                                                                email?: string;
                                                                                                                                                                                                                                                                                • The user's email address. This value may not be unique to this user and is not suitable for use as a primary key. Provided only if your scope included the email scope value.

                                                                                                                                                                                                                                                                                property email_verified

                                                                                                                                                                                                                                                                                email_verified?: boolean;
                                                                                                                                                                                                                                                                                • True if the user's e-mail address has been verified; otherwise false.

                                                                                                                                                                                                                                                                                property expiry_date

                                                                                                                                                                                                                                                                                expiry_date: number;
                                                                                                                                                                                                                                                                                • The datetime when the token becomes invalid.

                                                                                                                                                                                                                                                                                property scopes

                                                                                                                                                                                                                                                                                scopes: string[];
                                                                                                                                                                                                                                                                                • An array of scopes that the user granted access to.

                                                                                                                                                                                                                                                                                property sub

                                                                                                                                                                                                                                                                                sub?: string;
                                                                                                                                                                                                                                                                                • An identifier for the user, unique among all Google accounts and never reused. A Google account can have multiple emails at different points in time, but the sub value is never changed. Use sub within your application as the unique-identifier key for the user.

                                                                                                                                                                                                                                                                                property user_id

                                                                                                                                                                                                                                                                                user_id?: string;
                                                                                                                                                                                                                                                                                • This value lets you correlate profile information from multiple Google APIs. It is only present in the response if you included the profile scope in your request in step 1. The field value is an immutable identifier for the logged-in user that can be used to create and manage user sessions in your application. The identifier is the same regardless of which client ID is used to retrieve it. This enables multiple applications in the same organization to correlate profile information.

                                                                                                                                                                                                                                                                                interface TokenPayload

                                                                                                                                                                                                                                                                                interface TokenPayload {}

                                                                                                                                                                                                                                                                                  property at_hash

                                                                                                                                                                                                                                                                                  at_hash?: string;
                                                                                                                                                                                                                                                                                  • Access token hash. Provides validation that the access token is tied to the identity token. If the ID token is issued with an access token in the server flow, this is always included. This can be used as an alternate mechanism to protect against cross-site request forgery attacks, but if you follow Step 1 and Step 3 it is not necessary to verify the access token.

                                                                                                                                                                                                                                                                                  property aud

                                                                                                                                                                                                                                                                                  aud: string;
                                                                                                                                                                                                                                                                                  • Identifies the audience that this ID token is intended for. It must be one of the OAuth 2.0 client IDs of your application.

                                                                                                                                                                                                                                                                                  property azp

                                                                                                                                                                                                                                                                                  azp?: string;
                                                                                                                                                                                                                                                                                  • The client_id of the authorized presenter. This claim is only needed when the party requesting the ID token is not the same as the audience of the ID token. This may be the case at Google for hybrid apps where a web application and Android app have a different client_id but share the same project.

                                                                                                                                                                                                                                                                                  property email

                                                                                                                                                                                                                                                                                  email?: string;
                                                                                                                                                                                                                                                                                  • The user's email address. This may not be unique and is not suitable for use as a primary key. Provided only if your scope included the string "email".

                                                                                                                                                                                                                                                                                  property email_verified

                                                                                                                                                                                                                                                                                  email_verified?: boolean;
                                                                                                                                                                                                                                                                                  • True if the user's e-mail address has been verified; otherwise false.

                                                                                                                                                                                                                                                                                  property exp

                                                                                                                                                                                                                                                                                  exp: number;
                                                                                                                                                                                                                                                                                  • The time the ID token expires, represented in Unix time (integer seconds).

                                                                                                                                                                                                                                                                                  property family_name

                                                                                                                                                                                                                                                                                  family_name?: string;
                                                                                                                                                                                                                                                                                  • The user's family name, in a displayable form. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When name claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                                  property given_name

                                                                                                                                                                                                                                                                                  given_name?: string;
                                                                                                                                                                                                                                                                                  • The user's given name, in a displayable form. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When name claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                                  property hd

                                                                                                                                                                                                                                                                                  hd?: string;
                                                                                                                                                                                                                                                                                  • The hosted G Suite domain of the user. Provided only if the user belongs to a hosted domain.

                                                                                                                                                                                                                                                                                  property iat

                                                                                                                                                                                                                                                                                  iat: number;
                                                                                                                                                                                                                                                                                  • The time the ID token was issued, represented in Unix time (integer seconds).

                                                                                                                                                                                                                                                                                  property iss

                                                                                                                                                                                                                                                                                  iss: string;
                                                                                                                                                                                                                                                                                  • The Issuer Identifier for the Issuer of the response. Always https://accounts.google.com or accounts.google.com for Google ID tokens.

                                                                                                                                                                                                                                                                                  property locale

                                                                                                                                                                                                                                                                                  locale?: string;
                                                                                                                                                                                                                                                                                  • The user's locale, represented by a BCP 47 language tag. Might be provided when a name claim is present.

                                                                                                                                                                                                                                                                                  property name

                                                                                                                                                                                                                                                                                  name?: string;
                                                                                                                                                                                                                                                                                  • The user's full name, in a displayable form. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When name claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                                  property nonce

                                                                                                                                                                                                                                                                                  nonce?: string;
                                                                                                                                                                                                                                                                                  • The value of the nonce supplied by your app in the authentication request. You should enforce protection against replay attacks by ensuring it is presented only once.

                                                                                                                                                                                                                                                                                  property picture

                                                                                                                                                                                                                                                                                  picture?: string;
                                                                                                                                                                                                                                                                                  • The URL of the user's profile picture. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When picture claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                                  property profile

                                                                                                                                                                                                                                                                                  profile?: string;
                                                                                                                                                                                                                                                                                  • The URL of the user's profile page. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When profile claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                                  property sub

                                                                                                                                                                                                                                                                                  sub: string;
                                                                                                                                                                                                                                                                                  • An identifier for the user, unique among all Google accounts and never reused. A Google account can have multiple emails at different points in time, but the sub value is never changed. Use sub within your application as the unique-identifier key for the user.

                                                                                                                                                                                                                                                                                  interface UserRefreshClientOptions

                                                                                                                                                                                                                                                                                  interface UserRefreshClientOptions extends RefreshOptions {}

                                                                                                                                                                                                                                                                                    property clientId

                                                                                                                                                                                                                                                                                    clientId?: string;

                                                                                                                                                                                                                                                                                      property clientSecret

                                                                                                                                                                                                                                                                                      clientSecret?: string;

                                                                                                                                                                                                                                                                                        property refreshToken

                                                                                                                                                                                                                                                                                        refreshToken?: string;

                                                                                                                                                                                                                                                                                          interface VerifyIdTokenOptions

                                                                                                                                                                                                                                                                                          interface VerifyIdTokenOptions {}

                                                                                                                                                                                                                                                                                            property audience

                                                                                                                                                                                                                                                                                            audience?: string | string[];

                                                                                                                                                                                                                                                                                              property idToken

                                                                                                                                                                                                                                                                                              idToken: string;

                                                                                                                                                                                                                                                                                                property maxExpiry

                                                                                                                                                                                                                                                                                                maxExpiry?: number;

                                                                                                                                                                                                                                                                                                  Enums

                                                                                                                                                                                                                                                                                                  enum CodeChallengeMethod

                                                                                                                                                                                                                                                                                                  enum CodeChallengeMethod {
                                                                                                                                                                                                                                                                                                  Plain = 'plain',
                                                                                                                                                                                                                                                                                                  S256 = 'S256',
                                                                                                                                                                                                                                                                                                  }

                                                                                                                                                                                                                                                                                                    member Plain

                                                                                                                                                                                                                                                                                                    Plain = 'plain'

                                                                                                                                                                                                                                                                                                      member S256

                                                                                                                                                                                                                                                                                                      S256 = 'S256'

                                                                                                                                                                                                                                                                                                        enum GCPEnv

                                                                                                                                                                                                                                                                                                        enum GCPEnv {
                                                                                                                                                                                                                                                                                                        APP_ENGINE = 'APP_ENGINE',
                                                                                                                                                                                                                                                                                                        KUBERNETES_ENGINE = 'KUBERNETES_ENGINE',
                                                                                                                                                                                                                                                                                                        CLOUD_FUNCTIONS = 'CLOUD_FUNCTIONS',
                                                                                                                                                                                                                                                                                                        COMPUTE_ENGINE = 'COMPUTE_ENGINE',
                                                                                                                                                                                                                                                                                                        CLOUD_RUN = 'CLOUD_RUN',
                                                                                                                                                                                                                                                                                                        NONE = 'NONE',
                                                                                                                                                                                                                                                                                                        }

                                                                                                                                                                                                                                                                                                          member APP_ENGINE

                                                                                                                                                                                                                                                                                                          APP_ENGINE = 'APP_ENGINE'

                                                                                                                                                                                                                                                                                                            member CLOUD_FUNCTIONS

                                                                                                                                                                                                                                                                                                            CLOUD_FUNCTIONS = 'CLOUD_FUNCTIONS'

                                                                                                                                                                                                                                                                                                              member CLOUD_RUN

                                                                                                                                                                                                                                                                                                              CLOUD_RUN = 'CLOUD_RUN'

                                                                                                                                                                                                                                                                                                                member COMPUTE_ENGINE

                                                                                                                                                                                                                                                                                                                COMPUTE_ENGINE = 'COMPUTE_ENGINE'

                                                                                                                                                                                                                                                                                                                  member KUBERNETES_ENGINE

                                                                                                                                                                                                                                                                                                                  KUBERNETES_ENGINE = 'KUBERNETES_ENGINE'

                                                                                                                                                                                                                                                                                                                    member NONE

                                                                                                                                                                                                                                                                                                                    NONE = 'NONE'

                                                                                                                                                                                                                                                                                                                      Type Aliases

                                                                                                                                                                                                                                                                                                                      type ExternalAccountClientOptions

                                                                                                                                                                                                                                                                                                                      type ExternalAccountClientOptions = IdentityPoolClientOptions | AwsClientOptions;

                                                                                                                                                                                                                                                                                                                        Package Files (19)

                                                                                                                                                                                                                                                                                                                        Dependencies (9)

                                                                                                                                                                                                                                                                                                                        Dev Dependencies (40)

                                                                                                                                                                                                                                                                                                                        Peer Dependencies (0)

                                                                                                                                                                                                                                                                                                                        No peer dependencies.

                                                                                                                                                                                                                                                                                                                        Badge

                                                                                                                                                                                                                                                                                                                        To add a badge like this onejsDocs.io badgeto your package's README, use the codes available below.

                                                                                                                                                                                                                                                                                                                        You may also use Shields.io to create a custom badge linking to https://www.jsdocs.io/package/google-auth-library.

                                                                                                                                                                                                                                                                                                                        • Markdown
                                                                                                                                                                                                                                                                                                                          [![jsDocs.io](https://img.shields.io/badge/jsDocs.io-reference-blue)](https://www.jsdocs.io/package/google-auth-library)
                                                                                                                                                                                                                                                                                                                        • HTML
                                                                                                                                                                                                                                                                                                                          <a href="https://www.jsdocs.io/package/google-auth-library"><img src="https://img.shields.io/badge/jsDocs.io-reference-blue" alt="jsDocs.io"></a>