google-auth-library

  • Version 9.11.0
  • Published
  • 594 kB
  • 6 dependencies
  • Apache-2.0 license

Install

npm i google-auth-library
yarn add google-auth-library
pnpm add google-auth-library

Overview

Google APIs Authentication Client Library for Node.js

Index

Variables

Classes

Interfaces

Enums

Type Aliases

Variables

variable auth

const auth: GoogleAuth<JSONClient>;

    variable DEFAULT_UNIVERSE

    const DEFAULT_UNIVERSE: string;

    Classes

    class AuthClient

    abstract class AuthClient extends EventEmitter implements CredentialsClient {}

      constructor

      constructor(opts?: AuthClientOptions);

        property credentials

        credentials: Credentials;

          property eagerRefreshThresholdMillis

          eagerRefreshThresholdMillis: number;

            property forceRefreshOnFailure

            forceRefreshOnFailure: boolean;

              property gaxios

              readonly gaxios: any;

              property projectId

              projectId?: string;

                property quotaProjectId

                quotaProjectId?: string;
                • The quota project ID. The quota project can be used by client libraries for the billing purpose. See

                property RETRY_CONFIG

                static readonly RETRY_CONFIG: GaxiosOptions;
                • Retry config for Auth-related requests.

                  Remarks

                  This is not a part of the default config as some downstream APIs would prefer if customers explicitly enable retries, such as GCS.

                property transporter

                transporter: Transporter;

                  property universeDomain

                  universeDomain: string;

                    method addSharedMetadataHeaders

                    protected addSharedMetadataHeaders: (headers: Headers) => Headers;
                    • Append additional headers, e.g., x-goog-user-project, shared across the classes inheriting AuthClient. This method should be used by any method that overrides getRequestMetadataAsync(), which is a shared helper for setting request information in both gRPC and HTTP API calls.

                      Parameter headers

                      object to append additional headers to.

                    method getAccessToken

                    abstract getAccessToken: () => Promise<{
                    token?: string | null;
                    res?: GaxiosResponse | null;
                    }>;
                    • A promise that resolves with the current GCP access token response. If the current credential is expired, a new one is retrieved.

                    method getRequestHeaders

                    abstract getRequestHeaders: (url?: string) => Promise<Headers>;
                    • The main authentication interface. It takes an optional url which when present is the endpoint being accessed, and returns a Promise which resolves with authorization header fields.

                      The result has the form: { Authorization: 'Bearer <access_token_value>' }

                      Parameter url

                      The URI being authorized.

                    method request

                    abstract request: <T>(opts: GaxiosOptions) => GaxiosPromise<T>;
                    • Provides an alternative Gaxios request implementation with auth credentials

                    method setCredentials

                    setCredentials: (credentials: Credentials) => void;
                    • Sets the auth credentials.

                    class AwsClient

                    class AwsClient extends BaseExternalAccountClient {}
                    • AWS external account client. This is used for AWS workloads, where AWS STS GetCallerIdentity serialized signed requests are exchanged for GCP access token.

                    constructor

                    constructor(
                    options: AwsClientOptions | SnakeToCamelObject<AwsClientOptions>,
                    additionalOptions?: AuthClientOptions
                    );
                    • Instantiates an AwsClient instance using the provided JSON object loaded from an external account credentials file. An error is thrown if the credential is not a valid AWS credential.

                      Parameter options

                      The external account options object typically loaded from the external account JSON credential file.

                      Parameter additionalOptions

                      **DEPRECATED, all options are available in the options parameter.** Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors.

                    property AWS_EC2_METADATA_IPV4_ADDRESS

                    static AWS_EC2_METADATA_IPV4_ADDRESS: string;
                    • Deprecated

                      AWS client no validates the EC2 metadata address.

                    property AWS_EC2_METADATA_IPV6_ADDRESS

                    static AWS_EC2_METADATA_IPV6_ADDRESS: string;
                    • Deprecated

                      AWS client no validates the EC2 metadata address.

                    method retrieveSubjectToken

                    retrieveSubjectToken: () => Promise<string>;
                    • Triggered when an external subject token is needed to be exchanged for a GCP access token via GCP STS endpoint. This will call the AwsSecurityCredentialsSupplier to retrieve an AWS region and AWS Security Credentials, then use them to create a signed AWS STS request that can be exchanged for a GCP access token. A promise that resolves with the external subject token.

                    class BaseExternalAccountClient

                    abstract class BaseExternalAccountClient extends AuthClient {}
                    • Base external account client. This is used to instantiate AuthClients for exchanging external account credentials for GCP access token and authorizing requests to GCP APIs. The base class implements common logic for exchanging various type of external credentials for GCP access token. The logic of determining and retrieving the external credential based on the environment and credential_source will be left for the subclasses.

                    constructor

                    constructor(
                    options:
                    | BaseExternalAccountClientOptions
                    | SnakeToCamelObject<BaseExternalAccountClientOptions>,
                    additionalOptions?: AuthClientOptions
                    );
                    • Instantiate a BaseExternalAccountClient instance using the provided JSON object loaded from an external account credentials file.

                      Parameter options

                      The external account options object typically loaded from the external account JSON credential file. The camelCased options are aliases for the snake_cased options.

                      Parameter additionalOptions

                      **DEPRECATED, all options are available in the options parameter.** Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors.

                    property audience

                    protected readonly audience: string;

                      property cloudResourceManagerURL

                      protected cloudResourceManagerURL: string | URL;
                      • Example 1

                        new URL('https://cloudresourcemanager.googleapis.com/v1/projects/');

                      property credentialSourceType

                      protected credentialSourceType?: string;

                        property projectNumber

                        projectNumber: string;

                          property scopes

                          scopes?: string | string[];
                          • OAuth scopes for the GCP access token to use. When not provided, the default https://www.googleapis.com/auth/cloud-platform is used.

                          property subjectTokenType

                          protected readonly subjectTokenType: string;

                            property supplierContext

                            protected supplierContext: ExternalAccountSupplierContext;

                              method getAccessToken

                              getAccessToken: () => Promise<GetAccessTokenResponse>;
                              • A promise that resolves with the current GCP access token response. If the current credential is expired, a new one is retrieved.

                              method getProjectId

                              getProjectId: () => Promise<string | null>;
                              • A promise that resolves with the project ID corresponding to the current workload identity pool or current workforce pool if determinable. For workforce pool credential, it returns the project ID corresponding to the workforcePoolUserProject. This is introduced to match the current pattern of using the Auth library: const projectId = await auth.getProjectId(); const url = https://dns.googleapis.com/dns/v1/projects/${projectId}; const res = await client.request({ url }); The resource may not have permission (resourcemanager.projects.get) to call this API or the required scopes may not be selected: https://cloud.google.com/resource-manager/reference/rest/v1/projects/get#authorization-scopes

                              method getRequestHeaders

                              getRequestHeaders: () => Promise<Headers>;
                              • The main authentication interface. It takes an optional url which when present is the endpoint being accessed, and returns a Promise which resolves with authorization header fields.

                                The result has the form: { Authorization: 'Bearer <access_token_value>' }

                              method getServiceAccountEmail

                              getServiceAccountEmail: () => string | null;
                              • The service account email to be impersonated, if available.

                              method refreshAccessTokenAsync

                              protected refreshAccessTokenAsync: () => Promise<CredentialsWithResponse>;
                              • Forces token refresh, even if unexpired tokens are currently cached. External credentials are exchanged for GCP access tokens via the token exchange endpoint and other settings provided in the client options object. If the service_account_impersonation_url is provided, an additional step to exchange the external account GCP access token for a service account impersonated token is performed. A promise that resolves with the fresh GCP access tokens.

                              method request

                              request: {
                              <T>(opts: GaxiosOptions): GaxiosPromise<T>;
                              <T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
                              };
                              • Provides a request implementation with OAuth 2.0 flow. In cases of HTTP 401 and 403 responses, it automatically asks for a new access token and replays the unsuccessful request.

                                Parameter opts

                                Request options.

                                Parameter callback

                                callback. A promise that resolves with the HTTP response when no callback is provided.

                              method requestAsync

                              protected requestAsync: <T>(
                              opts: GaxiosOptions,
                              reAuthRetried?: boolean
                              ) => Promise<GaxiosResponse<T>>;
                              • Authenticates the provided HTTP request, processes it and resolves with the returned response.

                                Parameter opts

                                The HTTP request options.

                                Parameter reAuthRetried

                                Whether the current attempt is a retry after a failed attempt due to an auth failure. A promise that resolves with the successful response.

                              method retrieveSubjectToken

                              abstract retrieveSubjectToken: () => Promise<string>;
                              • Triggered when a external subject token is needed to be exchanged for a GCP access token via GCP STS endpoint. This abstract method needs to be implemented by subclasses depending on the type of external credential used. A promise that resolves with the external subject token.

                              method setCredentials

                              setCredentials: (credentials: Credentials) => void;
                              • Provides a mechanism to inject GCP access tokens directly. When the provided credential expires, a new credential, using the external account options, is retrieved.

                                Parameter credentials

                                The Credentials object to set on the current client.

                              class Compute

                              class Compute extends OAuth2Client {}

                                constructor

                                constructor(options?: ComputeOptions);
                                • Google Compute Engine service account credentials.

                                  Retrieve access token from the metadata server. See: https://cloud.google.com/compute/docs/access/authenticate-workloads#applications

                                property scopes

                                scopes: string[];

                                  property serviceAccountEmail

                                  readonly serviceAccountEmail: string;

                                    method fetchIdToken

                                    fetchIdToken: (targetAudience: string) => Promise<string>;
                                    • Fetches an ID token.

                                      Parameter targetAudience

                                      the audience for the fetched ID token.

                                    method refreshTokenNoCache

                                    protected refreshTokenNoCache: (
                                    refreshToken?: string | null
                                    ) => Promise<GetTokenResponse>;
                                    • Refreshes the access token.

                                      Parameter refreshToken

                                      Unused parameter

                                    method wrapError

                                    protected wrapError: (e: GaxiosError) => void;

                                      class DefaultTransporter

                                      class DefaultTransporter implements Transporter {}

                                        property defaults

                                        defaults: GaxiosOptions;

                                          property instance

                                          instance: Gaxios;
                                          • A configurable, replacable Gaxios instance.

                                          property USER_AGENT

                                          static readonly USER_AGENT: string;
                                          • Default user agent.

                                          method configure

                                          configure: (opts?: GaxiosOptions) => GaxiosOptions;
                                          • Configures request options before making a request.

                                            Parameter opts

                                            GaxiosOptions options. Configured options.

                                          method request

                                          request: <T>(opts: GaxiosOptions) => GaxiosPromise<T>;
                                          • Makes a request using Gaxios with given options.

                                            Parameter opts

                                            GaxiosOptions options.

                                            Parameter callback

                                            optional callback that contains GaxiosResponse object. GaxiosPromise, assuming no callback is passed.

                                          class DownscopedClient

                                          class DownscopedClient extends AuthClient {}
                                          • Defines a set of Google credentials that are downscoped from an existing set of Google OAuth2 credentials. This is useful to restrict the Identity and Access Management (IAM) permissions that a short-lived credential can use. The common pattern of usage is to have a token broker with elevated access generate these downscoped credentials from higher access source credentials and pass the downscoped short-lived access tokens to a token consumer via some secure authenticated channel for limited access to Google Cloud Storage resources.

                                          constructor

                                          constructor(
                                          authClient: AuthClient,
                                          credentialAccessBoundary: CredentialAccessBoundary,
                                          additionalOptions?: AuthClientOptions,
                                          quotaProjectId?: string
                                          );
                                          • Instantiates a downscoped client object using the provided source AuthClient and credential access boundary rules. To downscope permissions of a source AuthClient, a Credential Access Boundary that specifies which resources the new credential can access, as well as an upper bound on the permissions that are available on each resource, has to be defined. A downscoped client can then be instantiated using the source AuthClient and the Credential Access Boundary.

                                            Parameter authClient

                                            The source AuthClient to be downscoped based on the provided Credential Access Boundary rules.

                                            Parameter credentialAccessBoundary

                                            The Credential Access Boundary which contains a list of access boundary rules. Each rule contains information on the resource that the rule applies to, the upper bound of the permissions that are available on that resource and an optional condition to further restrict permissions.

                                            Parameter additionalOptions

                                            **DEPRECATED, set this in the provided authClient.** Optional additional behavior customization options.

                                            Parameter quotaProjectId

                                            **DEPRECATED, set this in the provided authClient.** Optional quota project id for setting up in the x-goog-user-project header.

                                          method getAccessToken

                                          getAccessToken: () => Promise<DownscopedAccessTokenResponse>;

                                            method getRequestHeaders

                                            getRequestHeaders: () => Promise<Headers>;
                                            • The main authentication interface. It takes an optional url which when present is the endpoint being accessed, and returns a Promise which resolves with authorization header fields.

                                              The result has the form: { Authorization: 'Bearer <access_token_value>' }

                                            method refreshAccessTokenAsync

                                            protected refreshAccessTokenAsync: () => Promise<CredentialsWithResponse>;
                                            • Forces token refresh, even if unexpired tokens are currently cached. GCP access tokens are retrieved from authclient object/source credential. Then GCP access tokens are exchanged for downscoped access tokens via the token exchange endpoint. A promise that resolves with the fresh downscoped access token.

                                            method request

                                            request: {
                                            <T>(opts: GaxiosOptions): GaxiosPromise<T>;
                                            <T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
                                            };
                                            • Provides a request implementation with OAuth 2.0 flow. In cases of HTTP 401 and 403 responses, it automatically asks for a new access token and replays the unsuccessful request.

                                              Parameter opts

                                              Request options.

                                              Parameter callback

                                              callback. A promise that resolves with the HTTP response when no callback is provided.

                                            method requestAsync

                                            protected requestAsync: <T>(
                                            opts: GaxiosOptions,
                                            reAuthRetried?: boolean
                                            ) => Promise<GaxiosResponse<T>>;
                                            • Authenticates the provided HTTP request, processes it and resolves with the returned response.

                                              Parameter opts

                                              The HTTP request options.

                                              Parameter reAuthRetried

                                              Whether the current attempt is a retry after a failed attempt due to an auth failure A promise that resolves with the successful response.

                                            method setCredentials

                                            setCredentials: (credentials: Credentials) => void;
                                            • Provides a mechanism to inject Downscoped access tokens directly. The expiry_date field is required to facilitate determination of the token expiration which would make it easier for the token consumer to handle.

                                              Parameter credentials

                                              The Credentials object to set on the current client.

                                            class ExternalAccountClient

                                            class ExternalAccountClient {}
                                            • Dummy class with no constructor. Developers are expected to use fromJSON.

                                            constructor

                                            constructor();

                                              method fromJSON

                                              static fromJSON: (
                                              options: ExternalAccountClientOptions,
                                              additionalOptions?: AuthClientOptions
                                              ) => BaseExternalAccountClient | null;
                                              • This static method will instantiate the corresponding type of external account credential depending on the underlying credential source.

                                                Parameter options

                                                The external account options object typically loaded from the external account JSON credential file.

                                                Parameter additionalOptions

                                                **DEPRECATED, all options are available in the options parameter.** Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors. A BaseExternalAccountClient instance or null if the options provided do not correspond to an external account credential.

                                              class GoogleAuth

                                              class GoogleAuth<T extends AuthClient = JSONClient> {}

                                                constructor

                                                constructor(opts?: GoogleAuthOptions<T>);
                                                • Configuration is resolved in the following order of precedence: - - -

                                                  are passed to the .

                                                  Parameter opts

                                                property cachedCredential

                                                cachedCredential: T | JSONClient | Compute;

                                                  property defaultScopes

                                                  defaultScopes?: string | string[];
                                                  • Scopes populated by the client library by default. We differentiate between these and user defined scopes when deciding whether to use a self-signed JWT.

                                                  property defaultServicePath

                                                  defaultServicePath?: string;

                                                    property DefaultTransporter

                                                    static DefaultTransporter: typeof DefaultTransporter;
                                                    • Export DefaultTransporter as a static property of the class.

                                                    property isGCE

                                                    readonly isGCE: boolean;

                                                      property jsonContent

                                                      jsonContent: JWTInput | ExternalAccountClientOptions;

                                                        property transporter

                                                        transporter?: Transporter;

                                                          property useJWTAccessWithScope

                                                          useJWTAccessWithScope?: boolean;

                                                            method authorizeRequest

                                                            authorizeRequest: (opts: {
                                                            url?: string;
                                                            uri?: string;
                                                            headers?: Headers;
                                                            }) => Promise<{
                                                            url?: string | undefined;
                                                            uri?: string | undefined;
                                                            headers?: Headers | undefined;
                                                            }>;
                                                            • Obtain credentials for a request, then attach the appropriate headers to the request options.

                                                              Parameter opts

                                                              Axios or Request options on which to attach the headers

                                                            method fromAPIKey

                                                            fromAPIKey: (apiKey: string, options?: AuthClientOptions) => JWT;
                                                            • Create a credentials instance using the given API key string.

                                                              Parameter apiKey

                                                              The API key string

                                                              Parameter options

                                                              An optional options object.

                                                              Returns

                                                              A JWT loaded from the key

                                                            method fromImpersonatedJSON

                                                            fromImpersonatedJSON: (json: ImpersonatedJWTInput) => Impersonated;
                                                            • Create a credentials instance using a given impersonated input options.

                                                              Parameter json

                                                              The impersonated input object.

                                                              Returns

                                                              JWT or UserRefresh Client with data

                                                            method fromJSON

                                                            fromJSON: (
                                                            json: JWTInput | ImpersonatedJWTInput,
                                                            options?: AuthClientOptions
                                                            ) => JSONClient;
                                                            • Create a credentials instance using the given input options.

                                                              Parameter json

                                                              The input object.

                                                              Parameter options

                                                              The JWT or UserRefresh options for the client

                                                              Returns

                                                              JWT or UserRefresh Client with data

                                                            method fromStream

                                                            fromStream: {
                                                            (inputStream: stream.Readable): Promise<JSONClient>;
                                                            (inputStream: stream.Readable, callback: CredentialCallback): void;
                                                            (
                                                            inputStream: stream.Readable,
                                                            options: AuthClientOptions
                                                            ): Promise<JSONClient>;
                                                            (
                                                            inputStream: stream.Readable,
                                                            options: AuthClientOptions,
                                                            callback: CredentialCallback
                                                            ): void;
                                                            };
                                                            • Create a credentials instance using the given input stream.

                                                              Parameter inputStream

                                                              The input stream.

                                                              Parameter callback

                                                              Optional callback.

                                                            method getAccessToken

                                                            getAccessToken: () => Promise<string | null | undefined>;
                                                            • Automatically obtain application default credentials, and return an access token for making requests.

                                                            method getApplicationDefault

                                                            getApplicationDefault: {
                                                            (): Promise<ADCResponse>;
                                                            (callback: ADCCallback): void;
                                                            (options: AuthClientOptions): Promise<ADCResponse>;
                                                            (options: AuthClientOptions, callback: ADCCallback): void;
                                                            };
                                                            • Obtains the default service-level credentials for the application.

                                                              Parameter callback

                                                              Optional callback.

                                                              Returns

                                                              Promise that resolves with the ADCResponse (if no callback was passed).

                                                            method getClient

                                                            getClient: () => Promise<Compute | JSONClient | T>;
                                                            • Automatically obtain an based on the provided configuration. If no options were passed, use Application Default Credentials.

                                                            method getCredentials

                                                            getCredentials: {
                                                            (): Promise<CredentialBody>;
                                                            (callback: (err: Error, credentials?: CredentialBody) => void): void;
                                                            };
                                                            • The callback function handles a credential object that contains the client_email and private_key (if exists). getCredentials first checks if the client is using an external account and uses the service account email in place of client_email. If that doesn't exist, it checks for these values from the user JSON. If the user JSON doesn't exist, and the environment is on GCE, it gets the client_email from the cloud metadata server.

                                                              Parameter callback

                                                              Callback that handles the credential object that contains a client_email and optional private key, or the error. returned

                                                            method getEnv

                                                            getEnv: () => Promise<GCPEnv>;
                                                            • Determine the compute environment in which the code is running.

                                                            method getIdTokenClient

                                                            getIdTokenClient: (targetAudience: string) => Promise<IdTokenClient>;
                                                            • Creates a client which will fetch an ID token for authorization.

                                                              Parameter targetAudience

                                                              the audience for the fetched ID token.

                                                              Returns

                                                              IdTokenClient for making HTTP calls authenticated with ID tokens.

                                                            method getProjectId

                                                            getProjectId: { (): Promise<string>; (callback: ProjectIdCallback): void };
                                                            • Obtains the default project ID for the application.

                                                              Retrieves in the following order of precedence: - The projectId provided in this object's construction - GCLOUD_PROJECT or GOOGLE_CLOUD_PROJECT environment variable - GOOGLE_APPLICATION_CREDENTIALS JSON file - Cloud SDK: gcloud config config-helper --format json - GCE project ID from metadata server

                                                            method getRequestHeaders

                                                            getRequestHeaders: (url?: string) => Promise<Headers>;
                                                            • Obtain the HTTP headers that will provide authorization for a given request.

                                                            method getUniverseDomain

                                                            getUniverseDomain: () => Promise<string>;

                                                            method getUniverseDomainFromMetadataServer

                                                            getUniverseDomainFromMetadataServer: () => Promise<string>;
                                                            • Retrieves a universe domain from the metadata server via gcpMetadata.universe.

                                                              Returns

                                                              a universe domain

                                                            method request

                                                            request: <T = any>(opts: GaxiosOptions) => Promise<GaxiosResponse<T>>;
                                                            • Automatically obtain application default credentials, and make an HTTP request using the given options.

                                                              Parameter opts

                                                              Axios request options for the HTTP request.

                                                            method setGapicJWTValues

                                                            setGapicJWTValues: (client: JWT) => void;

                                                              method sign

                                                              sign: (data: string, endpoint?: string) => Promise<string>;
                                                              • Sign the given data with the current private key, or go out to the IAM API to sign it.

                                                                Parameter data

                                                                The data to be signed.

                                                                Parameter endpoint

                                                                A custom endpoint to use.

                                                                Example 1

                                                                sign('data', 'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/');

                                                              class IAMAuth

                                                              class IAMAuth {}

                                                                constructor

                                                                constructor(selector: string, token: string);
                                                                • IAM credentials.

                                                                  Parameter selector

                                                                  the iam authority selector

                                                                  Parameter token

                                                                  the token

                                                                property selector

                                                                selector: string;

                                                                  property token

                                                                  token: string;

                                                                    method getRequestHeaders

                                                                    getRequestHeaders: () => {
                                                                    'x-goog-iam-authority-selector': string;
                                                                    'x-goog-iam-authorization-token': string;
                                                                    };
                                                                    • Acquire the HTTP headers required to make an authenticated request.

                                                                    class IdentityPoolClient

                                                                    class IdentityPoolClient extends BaseExternalAccountClient {}
                                                                    • Defines the Url-sourced and file-sourced external account clients mainly used for K8s and Azure workloads.

                                                                    constructor

                                                                    constructor(
                                                                    options:
                                                                    | IdentityPoolClientOptions
                                                                    | SnakeToCamelObject<IdentityPoolClientOptions>,
                                                                    additionalOptions?: AuthClientOptions
                                                                    );
                                                                    • Instantiate an IdentityPoolClient instance using the provided JSON object loaded from an external account credentials file. An error is thrown if the credential is not a valid file-sourced or url-sourced credential or a workforce pool user project is provided with a non workforce audience.

                                                                      Parameter options

                                                                      The external account options object typically loaded from the external account JSON credential file. The camelCased options are aliases for the snake_cased options.

                                                                      Parameter additionalOptions

                                                                      **DEPRECATED, all options are available in the options parameter.** Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors.

                                                                    method retrieveSubjectToken

                                                                    retrieveSubjectToken: () => Promise<string>;
                                                                    • Triggered when a external subject token is needed to be exchanged for a GCP access token via GCP STS endpoint. Gets a subject token by calling the configured SubjectTokenSupplier A promise that resolves with the external subject token.

                                                                    class IdTokenClient

                                                                    class IdTokenClient extends OAuth2Client {}

                                                                      constructor

                                                                      constructor(options: IdTokenOptions);
                                                                      • Google ID Token client

                                                                        Retrieve ID token from the metadata server. See: https://cloud.google.com/docs/authentication/get-id-token#metadata-server

                                                                      property idTokenProvider

                                                                      idTokenProvider: IdTokenProvider;

                                                                        property targetAudience

                                                                        targetAudience: string;

                                                                          method getRequestMetadataAsync

                                                                          protected getRequestMetadataAsync: (
                                                                          url?: string | null
                                                                          ) => Promise<RequestMetadataResponse>;

                                                                            class Impersonated

                                                                            class Impersonated extends OAuth2Client implements IdTokenProvider {}

                                                                              constructor

                                                                              constructor(options?: ImpersonatedOptions);
                                                                              • Impersonated service account credentials.

                                                                                Create a new access token by impersonating another service account.

                                                                                Impersonated Credentials allowing credentials issued to a user or service account to impersonate another. The source project using Impersonated Credentials must enable the "IAMCredentials" API. Also, the target service account must grant the orginating principal the "Service Account Token Creator" IAM role.

                                                                                Parameter options

                                                                                The configuration object.

                                                                                Parameter

                                                                                {object} [options.sourceClient] the source credential used as to acquire the impersonated credentials.

                                                                                Parameter

                                                                                {string} [options.targetPrincipal] the service account to impersonate.

                                                                                Parameter

                                                                                {string[]} [options.delegates] the chained list of delegates required to grant the final access_token. If set, the sequence of identities must have "Service Account Token Creator" capability granted to the preceding identity. For example, if set to [serviceAccountB, serviceAccountC], the sourceCredential must have the Token Creator role on serviceAccountB. serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token Creator on target_principal. If left unset, sourceCredential must have that role on targetPrincipal.

                                                                                Parameter

                                                                                {string[]} [options.targetScopes] scopes to request during the authorization grant.

                                                                                Parameter

                                                                                {number} [options.lifetime] number of seconds the delegated credential should be valid for up to 3600 seconds by default, or 43,200 seconds by extending the token's lifetime, see: https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth

                                                                                Parameter

                                                                                {string} [options.endpoint] api endpoint override.

                                                                              method fetchIdToken

                                                                              fetchIdToken: (
                                                                              targetAudience: string,
                                                                              options?: FetchIdTokenOptions
                                                                              ) => Promise<string>;
                                                                              • Generates an OpenID Connect ID token for a service account.

                                                                                Parameter targetAudience

                                                                                the audience for the fetched ID token.

                                                                                Parameter options

                                                                                the for the request an OpenID Connect ID token

                                                                              method getTargetPrincipal

                                                                              getTargetPrincipal: () => string;
                                                                              • The service account email to be impersonated.

                                                                              method refreshToken

                                                                              protected refreshToken: () => Promise<GetTokenResponse>;
                                                                              • Refreshes the access token.

                                                                              method sign

                                                                              sign: (blobToSign: string) => Promise<SignBlobResponse>;
                                                                              • Signs some bytes.

                                                                                Parameter blobToSign

                                                                                String to sign. denoting the keyyID and signedBlob in base64 string

                                                                              class JWT

                                                                              class JWT extends OAuth2Client implements IdTokenProvider {}

                                                                                constructor

                                                                                constructor(options: JWTOptions);
                                                                                • JWT service account credentials.

                                                                                  Retrieve access token using gtoken.

                                                                                  Parameter email

                                                                                  service account email address.

                                                                                  Parameter keyFile

                                                                                  path to private key file.

                                                                                  Parameter key

                                                                                  value of key

                                                                                  Parameter scopes

                                                                                  list of requested scopes or a single scope.

                                                                                  Parameter subject

                                                                                  impersonated account's email address.

                                                                                  Parameter key_id

                                                                                  the ID of the key

                                                                                constructor

                                                                                constructor(
                                                                                email?: string,
                                                                                keyFile?: string,
                                                                                key?: string,
                                                                                scopes?: string | string[],
                                                                                subject?: string,
                                                                                keyId?: string
                                                                                );

                                                                                  property additionalClaims

                                                                                  additionalClaims?: {};

                                                                                    property defaultScopes

                                                                                    defaultScopes?: string | string[];

                                                                                      property defaultServicePath

                                                                                      defaultServicePath?: string;

                                                                                        property email

                                                                                        email?: string;

                                                                                          property gtoken

                                                                                          gtoken?: GoogleToken;

                                                                                            property key

                                                                                            key?: string;

                                                                                              property keyFile

                                                                                              keyFile?: string;

                                                                                                property keyId

                                                                                                keyId?: string;

                                                                                                  property scope

                                                                                                  scope?: string;

                                                                                                    property scopes

                                                                                                    scopes?: string | string[];

                                                                                                      property subject

                                                                                                      subject?: string;

                                                                                                        property useJWTAccessWithScope

                                                                                                        useJWTAccessWithScope?: boolean;

                                                                                                          method authorize

                                                                                                          authorize: {
                                                                                                          (): Promise<Credentials>;
                                                                                                          (callback: (err: Error, result?: Credentials) => void): void;
                                                                                                          };
                                                                                                          • Get the initial access token using gToken.

                                                                                                            Parameter callback

                                                                                                            Optional callback.

                                                                                                            Returns

                                                                                                            Promise that resolves with credentials

                                                                                                          method createScoped

                                                                                                          createScoped: (scopes?: string | string[]) => JWT;
                                                                                                          • Creates a copy of the credential with the specified scopes.

                                                                                                            Parameter scopes

                                                                                                            List of requested scopes or a single scope. The cloned instance.

                                                                                                          method fetchIdToken

                                                                                                          fetchIdToken: (targetAudience: string) => Promise<string>;
                                                                                                          • Fetches an ID token.

                                                                                                            Parameter targetAudience

                                                                                                            the audience for the fetched ID token.

                                                                                                          method fromAPIKey

                                                                                                          fromAPIKey: (apiKey: string) => void;
                                                                                                          • Creates a JWT credentials instance using an API Key for authentication.

                                                                                                            Parameter apiKey

                                                                                                            The API Key in string form.

                                                                                                          method fromJSON

                                                                                                          fromJSON: (json: JWTInput) => void;
                                                                                                          • Create a JWT credentials instance using the given input options.

                                                                                                            Parameter json

                                                                                                            The input object.

                                                                                                          method fromStream

                                                                                                          fromStream: {
                                                                                                          (inputStream: stream.Readable): Promise<void>;
                                                                                                          (inputStream: stream.Readable, callback: (err?: Error) => void): void;
                                                                                                          };
                                                                                                          • Create a JWT credentials instance using the given input stream.

                                                                                                            Parameter inputStream

                                                                                                            The input stream.

                                                                                                            Parameter callback

                                                                                                            Optional callback.

                                                                                                          method getCredentials

                                                                                                          getCredentials: () => Promise<CredentialBody>;
                                                                                                          • Using the key or keyFile on the JWT client, obtain an object that contains the key and the client email.

                                                                                                          method getRequestMetadataAsync

                                                                                                          protected getRequestMetadataAsync: (
                                                                                                          url?: string | null
                                                                                                          ) => Promise<RequestMetadataResponse>;
                                                                                                          • Obtains the metadata to be sent with the request.

                                                                                                            Parameter url

                                                                                                            the URI being authorized.

                                                                                                          method refreshTokenNoCache

                                                                                                          protected refreshTokenNoCache: (
                                                                                                          refreshToken?: string | null
                                                                                                          ) => Promise<GetTokenResponse>;
                                                                                                          • Refreshes the access token.

                                                                                                            Parameter refreshToken

                                                                                                            ignored

                                                                                                          class JWTAccess

                                                                                                          class JWTAccess {}

                                                                                                            constructor

                                                                                                            constructor(
                                                                                                            email?: string,
                                                                                                            key?: string,
                                                                                                            keyId?: string,
                                                                                                            eagerRefreshThresholdMillis?: number
                                                                                                            );
                                                                                                            • JWTAccess service account credentials.

                                                                                                              Create a new access token by using the credential to create a new JWT token that's recognized as the access token.

                                                                                                              Parameter email

                                                                                                              the service account email address.

                                                                                                              Parameter key

                                                                                                              the private key that will be used to sign the token.

                                                                                                              Parameter keyId

                                                                                                              the ID of the private key used to sign the token.

                                                                                                            property eagerRefreshThresholdMillis

                                                                                                            eagerRefreshThresholdMillis: number;

                                                                                                              property email

                                                                                                              email?: string;

                                                                                                                property key

                                                                                                                key?: string;

                                                                                                                  property keyId

                                                                                                                  keyId?: string;

                                                                                                                    property projectId

                                                                                                                    projectId?: string;

                                                                                                                      method fromJSON

                                                                                                                      fromJSON: (json: JWTInput) => void;
                                                                                                                      • Create a JWTAccess credentials instance using the given input options.

                                                                                                                        Parameter json

                                                                                                                        The input object.

                                                                                                                      method fromStream

                                                                                                                      fromStream: {
                                                                                                                      (inputStream: stream.Readable): Promise<void>;
                                                                                                                      (inputStream: stream.Readable, callback: (err?: Error) => void): void;
                                                                                                                      };
                                                                                                                      • Create a JWTAccess credentials instance using the given input stream.

                                                                                                                        Parameter inputStream

                                                                                                                        The input stream.

                                                                                                                        Parameter callback

                                                                                                                        Optional callback.

                                                                                                                      method getCachedKey

                                                                                                                      getCachedKey: (url?: string, scopes?: string | string[]) => string;
                                                                                                                      • Ensures that we're caching a key appropriately, giving precedence to scopes vs. url

                                                                                                                        Parameter url

                                                                                                                        The URI being authorized.

                                                                                                                        Parameter scopes

                                                                                                                        The scope or scopes being authorized

                                                                                                                        Returns

                                                                                                                        A string that returns the cached key.

                                                                                                                      method getRequestHeaders

                                                                                                                      getRequestHeaders: (
                                                                                                                      url?: string,
                                                                                                                      additionalClaims?: Claims,
                                                                                                                      scopes?: string | string[]
                                                                                                                      ) => Headers;
                                                                                                                      • Get a non-expired access token, after refreshing if necessary.

                                                                                                                        Parameter url

                                                                                                                        The URI being authorized.

                                                                                                                        Parameter additionalClaims

                                                                                                                        An object with a set of additional claims to include in the payload.

                                                                                                                        Returns

                                                                                                                        An object that includes the authorization header.

                                                                                                                      class LoginTicket

                                                                                                                      class LoginTicket {}

                                                                                                                        constructor

                                                                                                                        constructor(env?: string, pay?: TokenPayload);
                                                                                                                        • Create a simple class to extract user ID from an ID Token

                                                                                                                          Parameter env

                                                                                                                          Envelope of the jwt

                                                                                                                          Parameter pay

                                                                                                                          Payload of the jwt

                                                                                                                        method getAttributes

                                                                                                                        getAttributes: () => {
                                                                                                                        envelope: string | undefined;
                                                                                                                        payload: TokenPayload | undefined;
                                                                                                                        };
                                                                                                                        • Returns attributes from the login ticket. This can contain various information about the user session.

                                                                                                                          The envelope and payload

                                                                                                                        method getEnvelope

                                                                                                                        getEnvelope: () => string | undefined;

                                                                                                                          method getPayload

                                                                                                                          getPayload: () => TokenPayload | undefined;

                                                                                                                            method getUserId

                                                                                                                            getUserId: () => string | null;
                                                                                                                            • Create a simple class to extract user ID from an ID Token

                                                                                                                              The user ID

                                                                                                                            class OAuth2Client

                                                                                                                            class OAuth2Client extends AuthClient {}

                                                                                                                              constructor

                                                                                                                              constructor(options?: OAuth2ClientOptions);
                                                                                                                              • Handles OAuth2 flow for Google APIs.

                                                                                                                                Parameter clientId

                                                                                                                                The authentication client ID.

                                                                                                                                Parameter clientSecret

                                                                                                                                The authentication client secret.

                                                                                                                                Parameter redirectUri

                                                                                                                                The URI to redirect to after completing the auth request.

                                                                                                                                Parameter opts

                                                                                                                                optional options for overriding the given parameters.

                                                                                                                              constructor

                                                                                                                              constructor(clientId?: string, clientSecret?: string, redirectUri?: string);

                                                                                                                                property apiKey

                                                                                                                                apiKey?: string;

                                                                                                                                  property clientAuthentication

                                                                                                                                  readonly clientAuthentication: ClientAuthentication;

                                                                                                                                    property endpoints

                                                                                                                                    readonly endpoints: Readonly<OAuth2ClientEndpoints>;

                                                                                                                                      property GOOGLE_TOKEN_INFO_URL

                                                                                                                                      protected static readonly GOOGLE_TOKEN_INFO_URL: string;

                                                                                                                                      property issuers

                                                                                                                                      readonly issuers: string[];

                                                                                                                                        property refreshHandler

                                                                                                                                        refreshHandler?: GetRefreshHandlerCallback;

                                                                                                                                          property refreshTokenPromises

                                                                                                                                          protected refreshTokenPromises: Map<string, Promise<GetTokenResponse>>;

                                                                                                                                            method generateAuthUrl

                                                                                                                                            generateAuthUrl: (opts?: GenerateAuthUrlOpts) => string;
                                                                                                                                            • Generates URL for consent page landing.

                                                                                                                                              Parameter opts

                                                                                                                                              Options. URL to consent page.

                                                                                                                                            method generateCodeVerifier

                                                                                                                                            generateCodeVerifier: () => void;

                                                                                                                                              method generateCodeVerifierAsync

                                                                                                                                              generateCodeVerifierAsync: () => Promise<CodeVerifierResults>;
                                                                                                                                              • Convenience method to automatically generate a code_verifier, and its resulting SHA256. If used, this must be paired with a S256 code_challenge_method.

                                                                                                                                                For a full example see: https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/oauth2-codeVerifier.js

                                                                                                                                              method getAccessToken

                                                                                                                                              getAccessToken: {
                                                                                                                                              (): Promise<GetAccessTokenResponse>;
                                                                                                                                              (callback: GetAccessTokenCallback): void;
                                                                                                                                              };
                                                                                                                                              • Get a non-expired access token, after refreshing if necessary

                                                                                                                                                Parameter callback

                                                                                                                                                Callback to call with the access token

                                                                                                                                              method getFederatedSignonCerts

                                                                                                                                              getFederatedSignonCerts: {
                                                                                                                                              (): Promise<FederatedSignonCertsResponse>;
                                                                                                                                              (callback: GetFederatedSignonCertsCallback): void;
                                                                                                                                              };
                                                                                                                                              • Gets federated sign-on certificates to use for verifying identity tokens. Returns certs as array structure, where keys are key ids, and values are certificates in either PEM or JWK format.

                                                                                                                                                Parameter callback

                                                                                                                                                Callback supplying the certificates

                                                                                                                                              method getFederatedSignonCertsAsync

                                                                                                                                              getFederatedSignonCertsAsync: () => Promise<FederatedSignonCertsResponse>;

                                                                                                                                                method getIapPublicKeys

                                                                                                                                                getIapPublicKeys: {
                                                                                                                                                (): Promise<IapPublicKeysResponse>;
                                                                                                                                                (callback: GetIapPublicKeysCallback): void;
                                                                                                                                                };
                                                                                                                                                • Gets federated sign-on certificates to use for verifying identity tokens. Returns certs as array structure, where keys are key ids, and values are certificates in either PEM or JWK format.

                                                                                                                                                  Parameter callback

                                                                                                                                                  Callback supplying the certificates

                                                                                                                                                method getIapPublicKeysAsync

                                                                                                                                                getIapPublicKeysAsync: () => Promise<IapPublicKeysResponse>;

                                                                                                                                                  method getRequestHeaders

                                                                                                                                                  getRequestHeaders: (url?: string) => Promise<Headers>;
                                                                                                                                                  • The main authentication interface. It takes an optional url which when present is the endpoint being accessed, and returns a Promise which resolves with authorization header fields.

                                                                                                                                                    In OAuth2Client, the result has the form: { Authorization: 'Bearer <access_token_value>' }

                                                                                                                                                    Parameter url

                                                                                                                                                    The optional url being authorized

                                                                                                                                                  method getRequestMetadataAsync

                                                                                                                                                  protected getRequestMetadataAsync: (
                                                                                                                                                  url?: string | URL | null
                                                                                                                                                  ) => Promise<RequestMetadataResponse>;

                                                                                                                                                    method getRevokeTokenUrl

                                                                                                                                                    static getRevokeTokenUrl: (token: string) => string;
                                                                                                                                                    • Generates an URL to revoke the given token.

                                                                                                                                                      Parameter token

                                                                                                                                                      The existing token to be revoked.

                                                                                                                                                      Deprecated

                                                                                                                                                      use instance method OAuth2Client.getRevokeTokenURL

                                                                                                                                                    method getRevokeTokenURL

                                                                                                                                                    getRevokeTokenURL: (token: string) => URL;
                                                                                                                                                    • Generates a URL to revoke the given token.

                                                                                                                                                      Parameter token

                                                                                                                                                      The existing token to be revoked.

                                                                                                                                                    method getToken

                                                                                                                                                    getToken: {
                                                                                                                                                    (code: string): Promise<GetTokenResponse>;
                                                                                                                                                    (options: GetTokenOptions): Promise<GetTokenResponse>;
                                                                                                                                                    (code: string, callback: GetTokenCallback): void;
                                                                                                                                                    (options: GetTokenOptions, callback: GetTokenCallback): void;
                                                                                                                                                    };
                                                                                                                                                    • Gets the access token for the given code.

                                                                                                                                                      Parameter code

                                                                                                                                                      The authorization code.

                                                                                                                                                      Parameter callback

                                                                                                                                                      Optional callback fn.

                                                                                                                                                    method getTokenInfo

                                                                                                                                                    getTokenInfo: (accessToken: string) => Promise<TokenInfo>;
                                                                                                                                                    • Obtains information about the provisioned access token. Especially useful if you want to check the scopes that were provisioned to a given token.

                                                                                                                                                      Parameter accessToken

                                                                                                                                                      Required. The Access Token for which you want to get user info.

                                                                                                                                                    method isTokenExpiring

                                                                                                                                                    protected isTokenExpiring: () => boolean;
                                                                                                                                                    • Returns true if a token is expired or will expire within eagerRefreshThresholdMillismilliseconds. If there is no expiry time, assumes the token is not expired or expiring.

                                                                                                                                                    method refreshAccessToken

                                                                                                                                                    refreshAccessToken: {
                                                                                                                                                    (): Promise<RefreshAccessTokenResponse>;
                                                                                                                                                    (callback: RefreshAccessTokenCallback): void;
                                                                                                                                                    };
                                                                                                                                                    • Retrieves the access token using refresh token

                                                                                                                                                      Parameter callback

                                                                                                                                                      callback

                                                                                                                                                    method refreshToken

                                                                                                                                                    protected refreshToken: (
                                                                                                                                                    refreshToken?: string | null
                                                                                                                                                    ) => Promise<GetTokenResponse>;
                                                                                                                                                    • Refreshes the access token.

                                                                                                                                                      Parameter refresh_token

                                                                                                                                                      Existing refresh token.

                                                                                                                                                    method refreshTokenNoCache

                                                                                                                                                    protected refreshTokenNoCache: (
                                                                                                                                                    refreshToken?: string | null
                                                                                                                                                    ) => Promise<GetTokenResponse>;

                                                                                                                                                      method request

                                                                                                                                                      request: {
                                                                                                                                                      <T>(opts: GaxiosOptions): GaxiosPromise<T>;
                                                                                                                                                      <T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
                                                                                                                                                      };
                                                                                                                                                      • Provides a request implementation with OAuth 2.0 flow. If credentials have a refresh_token, in cases of HTTP 401 and 403 responses, it automatically asks for a new access token and replays the unsuccessful request.

                                                                                                                                                        Parameter opts

                                                                                                                                                        Request options.

                                                                                                                                                        Parameter callback

                                                                                                                                                        callback. Request object

                                                                                                                                                      method requestAsync

                                                                                                                                                      protected requestAsync: <T>(
                                                                                                                                                      opts: GaxiosOptions,
                                                                                                                                                      reAuthRetried?: boolean
                                                                                                                                                      ) => Promise<GaxiosResponse<T>>;

                                                                                                                                                        method revokeCredentials

                                                                                                                                                        revokeCredentials: {
                                                                                                                                                        (): GaxiosPromise<RevokeCredentialsResult>;
                                                                                                                                                        (callback: BodyResponseCallback<RevokeCredentialsResult>): void;
                                                                                                                                                        };
                                                                                                                                                        • Revokes access token and clears the credentials object

                                                                                                                                                          Parameter callback

                                                                                                                                                          callback

                                                                                                                                                        method revokeToken

                                                                                                                                                        revokeToken: {
                                                                                                                                                        (token: string): GaxiosPromise<RevokeCredentialsResult>;
                                                                                                                                                        (
                                                                                                                                                        token: string,
                                                                                                                                                        callback: BodyResponseCallback<RevokeCredentialsResult>
                                                                                                                                                        ): void;
                                                                                                                                                        };
                                                                                                                                                        • Revokes the access given to token.

                                                                                                                                                          Parameter token

                                                                                                                                                          The existing token to be revoked.

                                                                                                                                                          Parameter callback

                                                                                                                                                          Optional callback fn.

                                                                                                                                                        method verifyIdToken

                                                                                                                                                        verifyIdToken: {
                                                                                                                                                        (options: VerifyIdTokenOptions): Promise<LoginTicket>;
                                                                                                                                                        (
                                                                                                                                                        options: VerifyIdTokenOptions,
                                                                                                                                                        callback: (err: Error, login?: LoginTicket) => void
                                                                                                                                                        ): void;
                                                                                                                                                        };
                                                                                                                                                        • Verify id token is token by checking the certs and audience

                                                                                                                                                          Parameter options

                                                                                                                                                          that contains all options.

                                                                                                                                                          Parameter callback

                                                                                                                                                          Callback supplying GoogleLogin if successful

                                                                                                                                                        method verifySignedJwtWithCerts

                                                                                                                                                        verifySignedJwtWithCerts: () => void;

                                                                                                                                                          method verifySignedJwtWithCertsAsync

                                                                                                                                                          verifySignedJwtWithCertsAsync: (
                                                                                                                                                          jwt: string,
                                                                                                                                                          certs: Certificates | PublicKeys,
                                                                                                                                                          requiredAudience?: string | string[],
                                                                                                                                                          issuers?: string[],
                                                                                                                                                          maxExpiry?: number
                                                                                                                                                          ) => Promise<LoginTicket>;
                                                                                                                                                          • Verify the id token is signed with the correct certificate and is from the correct audience.

                                                                                                                                                            Parameter jwt

                                                                                                                                                            The jwt to verify (The ID Token in this case).

                                                                                                                                                            Parameter certs

                                                                                                                                                            The array of certs to test the jwt against.

                                                                                                                                                            Parameter requiredAudience

                                                                                                                                                            The audience to test the jwt against.

                                                                                                                                                            Parameter issuers

                                                                                                                                                            The allowed issuers of the jwt (Optional).

                                                                                                                                                            Parameter maxExpiry

                                                                                                                                                            The max expiry the certificate can be (Optional). Returns a promise resolving to LoginTicket on verification.

                                                                                                                                                          class PassThroughClient

                                                                                                                                                          class PassThroughClient extends AuthClient {}
                                                                                                                                                          • An AuthClient without any Authentication information. Useful for: - Anonymous access - Local Emulators - Testing Environments

                                                                                                                                                          method getAccessToken

                                                                                                                                                          getAccessToken: () => Promise<GetAccessTokenResponse>;
                                                                                                                                                          • A required method of the base class. Always will return an empty object.

                                                                                                                                                            Returns

                                                                                                                                                            {}

                                                                                                                                                          method getRequestHeaders

                                                                                                                                                          getRequestHeaders: () => Promise<Headers>;
                                                                                                                                                          • A required method of the base class. Always will return an empty object.

                                                                                                                                                            Returns

                                                                                                                                                            {}

                                                                                                                                                          method request

                                                                                                                                                          request: <T>(opts: GaxiosOptions) => Promise<import('gaxios').GaxiosResponse<T>>;
                                                                                                                                                          • Creates a request without any authentication headers or checks.

                                                                                                                                                            Parameter opts

                                                                                                                                                            Returns

                                                                                                                                                            The response of the request.

                                                                                                                                                            Remarks

                                                                                                                                                            In testing environments it may be useful to change the provided AuthClient.transporter for any desired request overrides/handling.

                                                                                                                                                          class PluggableAuthClient

                                                                                                                                                          class PluggableAuthClient extends BaseExternalAccountClient {}
                                                                                                                                                          • PluggableAuthClient enables the exchange of workload identity pool external credentials for Google access tokens by retrieving 3rd party tokens through a user supplied executable. These scripts/executables are completely independent of the Google Cloud Auth libraries. These credentials plug into ADC and will call the specified executable to retrieve the 3rd party token to be exchanged for a Google access token.

                                                                                                                                                            To use these credentials, the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment variable must be set to '1'. This is for security reasons.

                                                                                                                                                            Both OIDC and SAML are supported. The executable must adhere to a specific response format defined below.

                                                                                                                                                            The executable must print out the 3rd party token to STDOUT in JSON format. When an output_file is specified in the credential configuration, the executable must also handle writing the JSON response to this file.

                                                                                                                                                            OIDC response sample: { "version": 1, "success": true, "token_type": "urn:ietf:params:oauth:token-type:id_token", "id_token": "HEADER.PAYLOAD.SIGNATURE", "expiration_time": 1620433341 }

                                                                                                                                                            SAML2 response sample: { "version": 1, "success": true, "token_type": "urn:ietf:params:oauth:token-type:saml2", "saml_response": "...", "expiration_time": 1620433341 }

                                                                                                                                                            Error response sample: { "version": 1, "success": false, "code": "401", "message": "Error message." }

                                                                                                                                                            The "expiration_time" field in the JSON response is only required for successful responses when an output file was specified in the credential configuration

                                                                                                                                                            The auth libraries will populate certain environment variables that will be accessible by the executable, such as: GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE, GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE, GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE, GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL, and GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE.

                                                                                                                                                            Please see this repositories README for a complete executable request/response specification.

                                                                                                                                                          constructor

                                                                                                                                                          constructor(
                                                                                                                                                          options: PluggableAuthClientOptions,
                                                                                                                                                          additionalOptions?: AuthClientOptions
                                                                                                                                                          );
                                                                                                                                                          • Instantiates a PluggableAuthClient instance using the provided JSON object loaded from an external account credentials file. An error is thrown if the credential is not a valid pluggable auth credential.

                                                                                                                                                            Parameter options

                                                                                                                                                            The external account options object typically loaded from the external account JSON credential file.

                                                                                                                                                            Parameter additionalOptions

                                                                                                                                                            **DEPRECATED, all options are available in the options parameter.** Optional additional behavior customization options. These currently customize expiration threshold time and whether to retry on 401/403 API request errors.

                                                                                                                                                          method retrieveSubjectToken

                                                                                                                                                          retrieveSubjectToken: () => Promise<string>;
                                                                                                                                                          • Triggered when an external subject token is needed to be exchanged for a GCP access token via GCP STS endpoint. This uses the options.credential_source object to figure out how to retrieve the token using the current environment. In this case, this calls a user provided executable which returns the subject token. The logic is summarized as: 1. Validated that the executable is allowed to run. The GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment must be set to 1 for security reasons. 2. If an output file is specified by the user, check the file location for a response. If the file exists and contains a valid response, return the subject token from the file. 3. Call the provided executable and return response. A promise that resolves with the external subject token.

                                                                                                                                                          class UserRefreshClient

                                                                                                                                                          class UserRefreshClient extends OAuth2Client {}

                                                                                                                                                            constructor

                                                                                                                                                            constructor(clientId?: string, clientSecret?: string, refreshToken?: string);
                                                                                                                                                            • User Refresh Token credentials.

                                                                                                                                                              Parameter clientId

                                                                                                                                                              The authentication client ID.

                                                                                                                                                              Parameter clientSecret

                                                                                                                                                              The authentication client secret.

                                                                                                                                                              Parameter refreshToken

                                                                                                                                                              The authentication refresh token.

                                                                                                                                                            constructor

                                                                                                                                                            constructor(options: UserRefreshClientOptions);

                                                                                                                                                              constructor

                                                                                                                                                              constructor(clientId?: string, clientSecret?: string, refreshToken?: string);

                                                                                                                                                                method fetchIdToken

                                                                                                                                                                fetchIdToken: (targetAudience: string) => Promise<string>;

                                                                                                                                                                  method fromJSON

                                                                                                                                                                  fromJSON: (json: JWTInput) => void;
                                                                                                                                                                  • Create a UserRefreshClient credentials instance using the given input options.

                                                                                                                                                                    Parameter json

                                                                                                                                                                    The input object.

                                                                                                                                                                  method fromStream

                                                                                                                                                                  fromStream: {
                                                                                                                                                                  (inputStream: stream.Readable): Promise<void>;
                                                                                                                                                                  (inputStream: stream.Readable, callback: (err?: Error) => void): void;
                                                                                                                                                                  };
                                                                                                                                                                  • Create a UserRefreshClient credentials instance using the given input stream.

                                                                                                                                                                    Parameter inputStream

                                                                                                                                                                    The input stream.

                                                                                                                                                                    Parameter callback

                                                                                                                                                                    Optional callback.

                                                                                                                                                                  method refreshTokenNoCache

                                                                                                                                                                  protected refreshTokenNoCache: (
                                                                                                                                                                  refreshToken?: string | null
                                                                                                                                                                  ) => Promise<GetTokenResponse>;
                                                                                                                                                                  • Refreshes the access token.

                                                                                                                                                                    Parameter refreshToken

                                                                                                                                                                    An ignored refreshToken..

                                                                                                                                                                    Parameter callback

                                                                                                                                                                    Optional callback.

                                                                                                                                                                  Interfaces

                                                                                                                                                                  interface AuthClient

                                                                                                                                                                  interface AuthClient {}

                                                                                                                                                                    method on

                                                                                                                                                                    on: (event: 'tokens', listener: (tokens: Credentials) => void) => this;

                                                                                                                                                                      interface AwsClientOptions

                                                                                                                                                                      interface AwsClientOptions extends BaseExternalAccountClientOptions {}
                                                                                                                                                                      • AWS credentials JSON interface. This is used for AWS workloads.

                                                                                                                                                                      property aws_security_credentials_supplier

                                                                                                                                                                      aws_security_credentials_supplier?: AwsSecurityCredentialsSupplier;
                                                                                                                                                                      • The AWS security credentials supplier to call to retrieve the AWS region and AWS security credentials. Either this or a valid credential source must be specified.

                                                                                                                                                                      property credential_source

                                                                                                                                                                      credential_source?: {
                                                                                                                                                                      /**
                                                                                                                                                                      * AWS environment ID. Currently only 'AWS1' is supported.
                                                                                                                                                                      */
                                                                                                                                                                      environment_id: string;
                                                                                                                                                                      /**
                                                                                                                                                                      * The EC2 metadata URL to retrieve the current AWS region from. If this is
                                                                                                                                                                      * not provided, the region should be present in the AWS_REGION or AWS_DEFAULT_REGION
                                                                                                                                                                      * environment variables.
                                                                                                                                                                      */
                                                                                                                                                                      region_url?: string;
                                                                                                                                                                      /**
                                                                                                                                                                      * The EC2 metadata URL to retrieve AWS security credentials. If this is not provided,
                                                                                                                                                                      * the credentials should be present in the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,
                                                                                                                                                                      * and AWS_SESSION_TOKEN environment variables.
                                                                                                                                                                      */
                                                                                                                                                                      url?: string;
                                                                                                                                                                      /**
                                                                                                                                                                      * The regional GetCallerIdentity action URL, used to determine the account
                                                                                                                                                                      * ID and its roles.
                                                                                                                                                                      */
                                                                                                                                                                      regional_cred_verification_url: string;
                                                                                                                                                                      /**
                                                                                                                                                                      * The imdsv2 session token url is used to fetch session token from AWS
                                                                                                                                                                      * which is later sent through headers for metadata requests. If the
                                                                                                                                                                      * field is missing, then session token won't be fetched and sent with
                                                                                                                                                                      * the metadata requests.
                                                                                                                                                                      * The session token is required for IMDSv2 but optional for IMDSv1
                                                                                                                                                                      */
                                                                                                                                                                      imdsv2_session_token_url?: string;
                                                                                                                                                                      };
                                                                                                                                                                      • Object containing options to retrieve AWS security credentials. A valid credential source or a aws security credentials supplier should be specified.

                                                                                                                                                                      interface BaseExternalAccountClientOptions

                                                                                                                                                                      interface BaseExternalAccountClientOptions
                                                                                                                                                                      extends SharedExternalAccountClientOptions {}
                                                                                                                                                                      • Base external account credentials json interface.

                                                                                                                                                                      property client_id

                                                                                                                                                                      client_id?: string;
                                                                                                                                                                      • Client ID of the service account from the console.

                                                                                                                                                                      property client_secret

                                                                                                                                                                      client_secret?: string;
                                                                                                                                                                      • Client secret of the service account from the console.

                                                                                                                                                                      property cloud_resource_manager_url

                                                                                                                                                                      cloud_resource_manager_url?: string | URL;
                                                                                                                                                                      • Example 1

                                                                                                                                                                        https://cloudresourcemanager.googleapis.com/v1/projects/

                                                                                                                                                                      property scopes

                                                                                                                                                                      scopes?: string[];
                                                                                                                                                                      • The scopes to request during the authorization grant.

                                                                                                                                                                      property service_account_impersonation

                                                                                                                                                                      service_account_impersonation?: {
                                                                                                                                                                      /**
                                                                                                                                                                      * The desired lifetime of the impersonated service account access token.
                                                                                                                                                                      * If not provided, the default lifetime will be 3600 seconds.
                                                                                                                                                                      */
                                                                                                                                                                      token_lifetime_seconds?: number;
                                                                                                                                                                      };
                                                                                                                                                                      • Object containing additional options for service account impersonation.

                                                                                                                                                                      property service_account_impersonation_url

                                                                                                                                                                      service_account_impersonation_url?: string;
                                                                                                                                                                      • The URL for the service account impersonation request. This URL is required for some APIs. If this URL is not available, the access token from the Security Token Service is used directly.

                                                                                                                                                                      property subject_token_type

                                                                                                                                                                      subject_token_type: string;
                                                                                                                                                                      • The Security Token Service subject token type based on the OAuth 2.0 token exchange spec. Expected values include: * 'urn:ietf:params:oauth:token-type:jwt' * 'urn:ietf:params:aws:token-type:aws4_request' * 'urn:ietf:params:oauth:token-type:saml2' * 'urn:ietf:params:oauth:token-type:id_token'

                                                                                                                                                                      property token_info_url

                                                                                                                                                                      token_info_url?: string;
                                                                                                                                                                      • The endpoint used to retrieve account related information.

                                                                                                                                                                      property type

                                                                                                                                                                      type?: string;
                                                                                                                                                                      • Credential type, should always be 'external_account'.

                                                                                                                                                                      property workforce_pool_user_project

                                                                                                                                                                      workforce_pool_user_project?: string;
                                                                                                                                                                      • The workforce pool user project. Required when using a workforce identity pool.

                                                                                                                                                                      interface Certificates

                                                                                                                                                                      interface Certificates {}

                                                                                                                                                                        index signature

                                                                                                                                                                        [index: string]: string | JwkCertificate;

                                                                                                                                                                          interface Claims

                                                                                                                                                                          interface Claims {}

                                                                                                                                                                            index signature

                                                                                                                                                                            [index: string]: string;

                                                                                                                                                                              interface CodeVerifierResults

                                                                                                                                                                              interface CodeVerifierResults {}
                                                                                                                                                                              • The results from the generateCodeVerifierAsync method. To learn more, See the sample: https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/oauth2-codeVerifier.js

                                                                                                                                                                              property codeChallenge

                                                                                                                                                                              codeChallenge?: string;
                                                                                                                                                                              • The code_challenge that should be sent with the generateAuthUrl call to obtain a verifiable authentication url.

                                                                                                                                                                              property codeVerifier

                                                                                                                                                                              codeVerifier: string;
                                                                                                                                                                              • The code verifier that will be used when calling getToken to obtain a new access token.

                                                                                                                                                                              interface ComputeOptions

                                                                                                                                                                              interface ComputeOptions extends OAuth2ClientOptions {}

                                                                                                                                                                                property scopes

                                                                                                                                                                                scopes?: string | string[];
                                                                                                                                                                                • The scopes that will be requested when acquiring service account credentials. Only applicable to modern App Engine and Cloud Function runtimes as of March 2019.

                                                                                                                                                                                property serviceAccountEmail

                                                                                                                                                                                serviceAccountEmail?: string;
                                                                                                                                                                                • The service account email to use, or 'default'. A Compute Engine instance may have multiple service accounts.

                                                                                                                                                                                interface CredentialAccessBoundary

                                                                                                                                                                                interface CredentialAccessBoundary {}
                                                                                                                                                                                • Defines an upper bound of permissions available for a GCP credential.

                                                                                                                                                                                property accessBoundary

                                                                                                                                                                                accessBoundary: {
                                                                                                                                                                                accessBoundaryRules: AccessBoundaryRule[];
                                                                                                                                                                                };

                                                                                                                                                                                  interface CredentialBody

                                                                                                                                                                                  interface CredentialBody {}

                                                                                                                                                                                    property client_email

                                                                                                                                                                                    client_email?: string;

                                                                                                                                                                                      property private_key

                                                                                                                                                                                      private_key?: string;

                                                                                                                                                                                        property universe_domain

                                                                                                                                                                                        universe_domain?: string;

                                                                                                                                                                                          interface CredentialRequest

                                                                                                                                                                                          interface CredentialRequest {}

                                                                                                                                                                                            property access_token

                                                                                                                                                                                            access_token?: string;
                                                                                                                                                                                            • A token that can be sent to a Google API.

                                                                                                                                                                                            property expires_in

                                                                                                                                                                                            expires_in?: number;
                                                                                                                                                                                            • The remaining lifetime of the access token in seconds.

                                                                                                                                                                                            property id_token

                                                                                                                                                                                            id_token?: string;
                                                                                                                                                                                            • A JWT that contains identity information about the user that is digitally signed by Google.

                                                                                                                                                                                            property refresh_token

                                                                                                                                                                                            refresh_token?: string;
                                                                                                                                                                                            • This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.

                                                                                                                                                                                            property scope

                                                                                                                                                                                            scope?: string;
                                                                                                                                                                                            • The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.

                                                                                                                                                                                            property token_type

                                                                                                                                                                                            token_type?: string;
                                                                                                                                                                                            • Identifies the type of token returned. At this time, this field always has the value Bearer.

                                                                                                                                                                                            interface Credentials

                                                                                                                                                                                            interface Credentials {}

                                                                                                                                                                                              property access_token

                                                                                                                                                                                              access_token?: string | null;
                                                                                                                                                                                              • A token that can be sent to a Google API.

                                                                                                                                                                                              property expiry_date

                                                                                                                                                                                              expiry_date?: number | null;
                                                                                                                                                                                              • The time in ms at which this token is thought to expire.

                                                                                                                                                                                              property id_token

                                                                                                                                                                                              id_token?: string | null;
                                                                                                                                                                                              • A JWT that contains identity information about the user that is digitally signed by Google.

                                                                                                                                                                                              property refresh_token

                                                                                                                                                                                              refresh_token?: string | null;
                                                                                                                                                                                              • This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.

                                                                                                                                                                                              property scope

                                                                                                                                                                                              scope?: string;
                                                                                                                                                                                              • The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.

                                                                                                                                                                                              property token_type

                                                                                                                                                                                              token_type?: string | null;
                                                                                                                                                                                              • Identifies the type of token returned. At this time, this field always has the value Bearer.

                                                                                                                                                                                              interface GenerateAuthUrlOpts

                                                                                                                                                                                              interface GenerateAuthUrlOpts {}

                                                                                                                                                                                                property access_type

                                                                                                                                                                                                access_type?: string;
                                                                                                                                                                                                • Recommended. Indicates whether your application can refresh access tokens when the user is not present at the browser. Valid parameter values are 'online', which is the default value, and 'offline'. Set the value to 'offline' if your application needs to refresh access tokens when the user is not present at the browser. This value instructs the Google authorization server to return a refresh token and an access token the first time that your application exchanges an authorization code for tokens.

                                                                                                                                                                                                property client_id

                                                                                                                                                                                                client_id?: string;
                                                                                                                                                                                                • The client ID for your application. The value passed into the constructor will be used if not provided. You can find this value in the API Console.

                                                                                                                                                                                                property code_challenge

                                                                                                                                                                                                code_challenge?: string;
                                                                                                                                                                                                • Recommended. Specifies an encoded 'code_verifier' that will be used as a server-side challenge during authorization code exchange. This parameter must be used with the 'code_challenge' parameter described above.

                                                                                                                                                                                                property code_challenge_method

                                                                                                                                                                                                code_challenge_method?: CodeChallengeMethod;
                                                                                                                                                                                                • Recommended. Specifies what method was used to encode a 'code_verifier' that will be used during authorization code exchange. This parameter must be used with the 'code_challenge' parameter. The value of the 'code_challenge_method' defaults to "plain" if not present in the request that includes a 'code_challenge'. The only supported values for this parameter are "S256" or "plain".

                                                                                                                                                                                                property hd

                                                                                                                                                                                                hd?: string;
                                                                                                                                                                                                • The hd (hosted domain) parameter streamlines the login process for G Suite hosted accounts. By including the domain of the G Suite user (for example, mycollege.edu), you can indicate that the account selection UI should be optimized for accounts at that domain. To optimize for G Suite accounts generally instead of just one domain, use an asterisk: hd=*. Don't rely on this UI optimization to control who can access your app, as client-side requests can be modified. Be sure to validate that the returned ID token has an hd claim value that matches what you expect (e.g. mycolledge.edu). Unlike the request parameter, the ID token claim is contained within a security token from Google, so the value can be trusted.

                                                                                                                                                                                                property include_granted_scopes

                                                                                                                                                                                                include_granted_scopes?: boolean;
                                                                                                                                                                                                • Optional. Enables applications to use incremental authorization to request access to additional scopes in context. If you set this parameter's value to true and the authorization request is granted, then the new access token will also cover any scopes to which the user previously granted the application access. See the incremental authorization section for examples.

                                                                                                                                                                                                property login_hint

                                                                                                                                                                                                login_hint?: string;
                                                                                                                                                                                                • Optional. If your application knows which user is trying to authenticate, it can use this parameter to provide a hint to the Google Authentication Server. The server uses the hint to simplify the login flow either by prefilling the email field in the sign-in form or by selecting the appropriate multi-login session. Set the parameter value to an email address or sub identifier, which is equivalent to the user's Google ID.

                                                                                                                                                                                                property prompt

                                                                                                                                                                                                prompt?: string;
                                                                                                                                                                                                • Optional. A space-delimited, case-sensitive list of prompts to present the user. If you don't specify this parameter, the user will be prompted only the first time your app requests access. Possible values are:

                                                                                                                                                                                                  'none' - Donot display any authentication or consent screens. Must not be specified with other values. 'consent' - Prompt the user for consent. 'select_account' - Prompt the user to select an account.

                                                                                                                                                                                                property redirect_uri

                                                                                                                                                                                                redirect_uri?: string;
                                                                                                                                                                                                • Determines where the API server redirects the user after the user completes the authorization flow. The value must exactly match one of the 'redirect_uri' values listed for your project in the API Console. Note that the http or https scheme, case, and trailing slash ('/') must all match. The value passed into the constructor will be used if not provided.

                                                                                                                                                                                                property response_type

                                                                                                                                                                                                response_type?: string;
                                                                                                                                                                                                • The 'response_type' will always be set to 'CODE'.

                                                                                                                                                                                                property scope

                                                                                                                                                                                                scope?: string[] | string;
                                                                                                                                                                                                • Required. A space-delimited list of scopes that identify the resources that your application could access on the user's behalf. These values inform the consent screen that Google displays to the user. Scopes enable your application to only request access to the resources that it needs while also enabling users to control the amount of access that they grant to your application. Thus, there is an inverse relationship between the number of scopes requested and the likelihood of obtaining user consent. The OAuth 2.0 API Scopes document provides a full list of scopes that you might use to access Google APIs. We recommend that your application request access to authorization scopes in context whenever possible. By requesting access to user data in context, via incremental authorization, you help users to more easily understand why your application needs the access it is requesting.

                                                                                                                                                                                                property state

                                                                                                                                                                                                state?: string;
                                                                                                                                                                                                • Recommended. Specifies any string value that your application uses to maintain state between your authorization request and the authorization server's response. The server returns the exact value that you send as a name=value pair in the hash (#) fragment of the 'redirect_uri' after the user consents to or denies your application's access request. You can use this parameter for several purposes, such as directing the user to the correct resource in your application, sending nonces, and mitigating cross-site request forgery. Since your redirect_uri can be guessed, using a state value can increase your assurance that an incoming connection is the result of an authentication request. If you generate a random string or encode the hash of a cookie or another value that captures the client's state, you can validate the response to additionally ensure that the request and response originated in the same browser, providing protection against attacks such as cross-site request forgery. See the OpenID Connect documentation for an example of how to create and confirm a state token.

                                                                                                                                                                                                index signature

                                                                                                                                                                                                [
                                                                                                                                                                                                key: string
                                                                                                                                                                                                ]: querystring.ParsedUrlQueryInput[keyof querystring.ParsedUrlQueryInput];
                                                                                                                                                                                                • A way for developers and/or the auth team to provide a set of key value pairs to be added as query parameters to the authorization url.

                                                                                                                                                                                                interface GetTokenOptions

                                                                                                                                                                                                interface GetTokenOptions {}

                                                                                                                                                                                                  property client_id

                                                                                                                                                                                                  client_id?: string;
                                                                                                                                                                                                  • The client ID for your application. The value passed into the constructor will be used if not provided. Must match any client_id option passed to a corresponding call to generateAuthUrl.

                                                                                                                                                                                                  property code

                                                                                                                                                                                                  code: string;

                                                                                                                                                                                                    property codeVerifier

                                                                                                                                                                                                    codeVerifier?: string;

                                                                                                                                                                                                      property redirect_uri

                                                                                                                                                                                                      redirect_uri?: string;
                                                                                                                                                                                                      • Determines where the API server redirects the user after the user completes the authorization flow. The value passed into the constructor will be used if not provided. Must match any redirect_uri option passed to a corresponding call to generateAuthUrl.

                                                                                                                                                                                                      interface GoogleAuthOptions

                                                                                                                                                                                                      interface GoogleAuthOptions<T extends AuthClient = JSONClient> {}

                                                                                                                                                                                                        property authClient

                                                                                                                                                                                                        authClient?: T;
                                                                                                                                                                                                        • An AuthClient to use

                                                                                                                                                                                                        property clientOptions

                                                                                                                                                                                                        clientOptions?:
                                                                                                                                                                                                        | JWTOptions
                                                                                                                                                                                                        | OAuth2ClientOptions
                                                                                                                                                                                                        | UserRefreshClientOptions
                                                                                                                                                                                                        | ImpersonatedOptions;
                                                                                                                                                                                                        • Options object passed to the constructor of the client

                                                                                                                                                                                                        property credentials

                                                                                                                                                                                                        credentials?: JWTInput | ExternalAccountClientOptions;
                                                                                                                                                                                                        • Object containing client_email and private_key properties, or the external account client options.

                                                                                                                                                                                                        property keyFile

                                                                                                                                                                                                        keyFile?: string;
                                                                                                                                                                                                        • Path to a .json, .pem, or .p12 key file

                                                                                                                                                                                                        property keyFilename

                                                                                                                                                                                                        keyFilename?: string;
                                                                                                                                                                                                        • Path to a .json, .pem, or .p12 key file

                                                                                                                                                                                                        property projectId

                                                                                                                                                                                                        projectId?: string;
                                                                                                                                                                                                        • Your project ID.

                                                                                                                                                                                                        property scopes

                                                                                                                                                                                                        scopes?: string | string[];
                                                                                                                                                                                                        • Required scopes for the desired API request

                                                                                                                                                                                                        property universeDomain

                                                                                                                                                                                                        universeDomain?: string;
                                                                                                                                                                                                        • The default service domain for a given Cloud universe.

                                                                                                                                                                                                          This is an ergonomic equivalent to clientOptions's universeDomain property and will be set for all generated AuthClients.

                                                                                                                                                                                                        interface IdentityPoolClientOptions

                                                                                                                                                                                                        interface IdentityPoolClientOptions extends BaseExternalAccountClientOptions {}
                                                                                                                                                                                                        • Url-sourced/file-sourced credentials json interface. This is used for K8s and Azure workloads.

                                                                                                                                                                                                        property credential_source

                                                                                                                                                                                                        credential_source?: {
                                                                                                                                                                                                        /**
                                                                                                                                                                                                        * The file location to read the subject token from. Either this or a URL
                                                                                                                                                                                                        * should be specified.
                                                                                                                                                                                                        */
                                                                                                                                                                                                        file?: string;
                                                                                                                                                                                                        /**
                                                                                                                                                                                                        * The URL to call to retrieve the subject token. Either this or a file
                                                                                                                                                                                                        * location should be specified.
                                                                                                                                                                                                        */
                                                                                                                                                                                                        url?: string;
                                                                                                                                                                                                        /**
                                                                                                                                                                                                        * Optional headers to send on the request to the specified URL.
                                                                                                                                                                                                        */
                                                                                                                                                                                                        headers?: {
                                                                                                                                                                                                        [key: string]: string;
                                                                                                                                                                                                        };
                                                                                                                                                                                                        /**
                                                                                                                                                                                                        * The format that the subject token is in the file or the URL response.
                                                                                                                                                                                                        * If not provided, will default to reading the text string directly.
                                                                                                                                                                                                        */
                                                                                                                                                                                                        format?: {
                                                                                                                                                                                                        /**
                                                                                                                                                                                                        * The format type. Can either be 'text' or 'json'.
                                                                                                                                                                                                        */
                                                                                                                                                                                                        type: SubjectTokenFormatType;
                                                                                                                                                                                                        /**
                                                                                                                                                                                                        * The field name containing the subject token value if the type is 'json'.
                                                                                                                                                                                                        */
                                                                                                                                                                                                        subject_token_field_name?: string;
                                                                                                                                                                                                        };
                                                                                                                                                                                                        };
                                                                                                                                                                                                        • Object containing options to retrieve identity pool credentials. A valid credential source or a subject token supplier must be specified.

                                                                                                                                                                                                        property subject_token_supplier

                                                                                                                                                                                                        subject_token_supplier?: SubjectTokenSupplier;
                                                                                                                                                                                                        • The subject token supplier to call to retrieve the subject token to exchange for a GCP access token. Either this or a valid credential source should be specified.

                                                                                                                                                                                                        interface IdTokenProvider

                                                                                                                                                                                                        interface IdTokenProvider {}

                                                                                                                                                                                                          property fetchIdToken

                                                                                                                                                                                                          fetchIdToken: (targetAudience: string) => Promise<string>;

                                                                                                                                                                                                            interface ImpersonatedOptions

                                                                                                                                                                                                            interface ImpersonatedOptions extends OAuth2ClientOptions {}

                                                                                                                                                                                                              property delegates

                                                                                                                                                                                                              delegates?: string[];
                                                                                                                                                                                                              • The chained list of delegates required to grant the final access_token.

                                                                                                                                                                                                              property endpoint

                                                                                                                                                                                                              endpoint?: string;
                                                                                                                                                                                                              • API endpoint to fetch token from.

                                                                                                                                                                                                              property lifetime

                                                                                                                                                                                                              lifetime?: number | 3600;
                                                                                                                                                                                                              • Number of seconds the delegated credential should be valid.

                                                                                                                                                                                                              property sourceClient

                                                                                                                                                                                                              sourceClient?: AuthClient;
                                                                                                                                                                                                              • Client used to perform exchange for impersonated client.

                                                                                                                                                                                                              property targetPrincipal

                                                                                                                                                                                                              targetPrincipal?: string;
                                                                                                                                                                                                              • The service account to impersonate.

                                                                                                                                                                                                              property targetScopes

                                                                                                                                                                                                              targetScopes?: string[];
                                                                                                                                                                                                              • Scopes to request during the authorization grant.

                                                                                                                                                                                                              interface JWTInput

                                                                                                                                                                                                              interface JWTInput {}

                                                                                                                                                                                                                property client_email

                                                                                                                                                                                                                client_email?: string;

                                                                                                                                                                                                                  property client_id

                                                                                                                                                                                                                  client_id?: string;

                                                                                                                                                                                                                    property client_secret

                                                                                                                                                                                                                    client_secret?: string;

                                                                                                                                                                                                                      property private_key

                                                                                                                                                                                                                      private_key?: string;

                                                                                                                                                                                                                        property private_key_id

                                                                                                                                                                                                                        private_key_id?: string;

                                                                                                                                                                                                                          property project_id

                                                                                                                                                                                                                          project_id?: string;

                                                                                                                                                                                                                            property quota_project_id

                                                                                                                                                                                                                            quota_project_id?: string;

                                                                                                                                                                                                                              property refresh_token

                                                                                                                                                                                                                              refresh_token?: string;

                                                                                                                                                                                                                                property type

                                                                                                                                                                                                                                type?: string;

                                                                                                                                                                                                                                  property universe_domain

                                                                                                                                                                                                                                  universe_domain?: string;

                                                                                                                                                                                                                                    interface JWTOptions

                                                                                                                                                                                                                                    interface JWTOptions extends OAuth2ClientOptions {}

                                                                                                                                                                                                                                      property additionalClaims

                                                                                                                                                                                                                                      additionalClaims?: {};

                                                                                                                                                                                                                                        property email

                                                                                                                                                                                                                                        email?: string;

                                                                                                                                                                                                                                          property key

                                                                                                                                                                                                                                          key?: string;

                                                                                                                                                                                                                                            property keyFile

                                                                                                                                                                                                                                            keyFile?: string;

                                                                                                                                                                                                                                              property keyId

                                                                                                                                                                                                                                              keyId?: string;

                                                                                                                                                                                                                                                property scopes

                                                                                                                                                                                                                                                scopes?: string | string[];

                                                                                                                                                                                                                                                  property subject

                                                                                                                                                                                                                                                  subject?: string;

                                                                                                                                                                                                                                                    interface OAuth2ClientOptions

                                                                                                                                                                                                                                                    interface OAuth2ClientOptions extends AuthClientOptions {}

                                                                                                                                                                                                                                                      property clientAuthentication

                                                                                                                                                                                                                                                      clientAuthentication?: ClientAuthentication;
                                                                                                                                                                                                                                                      • The client authentication type. Supported values are basic, post, and none. Defaults to post if not provided. https://datatracker.ietf.org/doc/html/rfc7591#section-2

                                                                                                                                                                                                                                                      property clientId

                                                                                                                                                                                                                                                      clientId?: string;

                                                                                                                                                                                                                                                        property clientSecret

                                                                                                                                                                                                                                                        clientSecret?: string;

                                                                                                                                                                                                                                                          property endpoints

                                                                                                                                                                                                                                                          endpoints?: Partial<OAuth2ClientEndpoints>;
                                                                                                                                                                                                                                                          • Customizable endpoints.

                                                                                                                                                                                                                                                          property issuers

                                                                                                                                                                                                                                                          issuers?: string[];
                                                                                                                                                                                                                                                          • The allowed OAuth2 token issuers.

                                                                                                                                                                                                                                                          property redirectUri

                                                                                                                                                                                                                                                          redirectUri?: string;

                                                                                                                                                                                                                                                            interface PluggableAuthClientOptions

                                                                                                                                                                                                                                                            interface PluggableAuthClientOptions extends BaseExternalAccountClientOptions {}
                                                                                                                                                                                                                                                            • Defines the credential source portion of the configuration for PluggableAuthClient.

                                                                                                                                                                                                                                                              Command is the only required field. If timeout_millis is not specified, the library will default to a 30-second timeout.

                                                                                                                                                                                                                                                              Sample credential source for Pluggable Auth Client: { ... "credential_source": { "executable": { "command": "/path/to/get/credentials.sh --arg1=value1 --arg2=value2", "timeout_millis": 5000, "output_file": "/path/to/generated/cached/credentials" } } }

                                                                                                                                                                                                                                                            property credential_source

                                                                                                                                                                                                                                                            credential_source: {
                                                                                                                                                                                                                                                            executable: {
                                                                                                                                                                                                                                                            /**
                                                                                                                                                                                                                                                            * The command used to retrieve the 3rd party token.
                                                                                                                                                                                                                                                            */
                                                                                                                                                                                                                                                            command: string;
                                                                                                                                                                                                                                                            /**
                                                                                                                                                                                                                                                            * The timeout for executable to run in milliseconds. If none is provided it
                                                                                                                                                                                                                                                            * will be set to the default timeout of 30 seconds.
                                                                                                                                                                                                                                                            */
                                                                                                                                                                                                                                                            timeout_millis?: number;
                                                                                                                                                                                                                                                            /**
                                                                                                                                                                                                                                                            * An optional output file location that will be checked for a cached response
                                                                                                                                                                                                                                                            * from a previous run of the executable.
                                                                                                                                                                                                                                                            */
                                                                                                                                                                                                                                                            output_file?: string;
                                                                                                                                                                                                                                                            };
                                                                                                                                                                                                                                                            };

                                                                                                                                                                                                                                                              interface ProjectIdCallback

                                                                                                                                                                                                                                                              interface ProjectIdCallback {}

                                                                                                                                                                                                                                                                call signature

                                                                                                                                                                                                                                                                (err?: Error | null, projectId?: string | null): void;

                                                                                                                                                                                                                                                                  interface RequestMetadata

                                                                                                                                                                                                                                                                  interface RequestMetadata {}

                                                                                                                                                                                                                                                                    property 'x-goog-iam-authority-selector'

                                                                                                                                                                                                                                                                    'x-goog-iam-authority-selector': string;

                                                                                                                                                                                                                                                                      property 'x-goog-iam-authorization-token'

                                                                                                                                                                                                                                                                      'x-goog-iam-authorization-token': string;

                                                                                                                                                                                                                                                                        interface TokenInfo

                                                                                                                                                                                                                                                                        interface TokenInfo {}

                                                                                                                                                                                                                                                                          property access_type

                                                                                                                                                                                                                                                                          access_type?: string;
                                                                                                                                                                                                                                                                          • Indicates whether your application can refresh access tokens when the user is not present at the browser. Valid parameter values are 'online', which is the default value, and 'offline'. Set the value to 'offline' if your application needs to refresh access tokens when the user is not present at the browser. This value instructs the Google authorization server to return a refresh token and an access token the first time that your application exchanges an authorization code for tokens.

                                                                                                                                                                                                                                                                          property aud

                                                                                                                                                                                                                                                                          aud: string;
                                                                                                                                                                                                                                                                          • The application that is the intended user of the access token.

                                                                                                                                                                                                                                                                          property azp

                                                                                                                                                                                                                                                                          azp?: string;
                                                                                                                                                                                                                                                                          • The client_id of the authorized presenter. This claim is only needed when the party requesting the ID token is not the same as the audience of the ID token. This may be the case at Google for hybrid apps where a web application and Android app have a different client_id but share the same project.

                                                                                                                                                                                                                                                                          property email

                                                                                                                                                                                                                                                                          email?: string;
                                                                                                                                                                                                                                                                          • The user's email address. This value may not be unique to this user and is not suitable for use as a primary key. Provided only if your scope included the email scope value.

                                                                                                                                                                                                                                                                          property email_verified

                                                                                                                                                                                                                                                                          email_verified?: boolean;
                                                                                                                                                                                                                                                                          • True if the user's e-mail address has been verified; otherwise false.

                                                                                                                                                                                                                                                                          property expiry_date

                                                                                                                                                                                                                                                                          expiry_date: number;
                                                                                                                                                                                                                                                                          • The datetime when the token becomes invalid.

                                                                                                                                                                                                                                                                          property scopes

                                                                                                                                                                                                                                                                          scopes: string[];
                                                                                                                                                                                                                                                                          • An array of scopes that the user granted access to.

                                                                                                                                                                                                                                                                          property sub

                                                                                                                                                                                                                                                                          sub?: string;
                                                                                                                                                                                                                                                                          • An identifier for the user, unique among all Google accounts and never reused. A Google account can have multiple emails at different points in time, but the sub value is never changed. Use sub within your application as the unique-identifier key for the user.

                                                                                                                                                                                                                                                                          property user_id

                                                                                                                                                                                                                                                                          user_id?: string;
                                                                                                                                                                                                                                                                          • This value lets you correlate profile information from multiple Google APIs. It is only present in the response if you included the profile scope in your request in step 1. The field value is an immutable identifier for the logged-in user that can be used to create and manage user sessions in your application. The identifier is the same regardless of which client ID is used to retrieve it. This enables multiple applications in the same organization to correlate profile information.

                                                                                                                                                                                                                                                                          interface TokenPayload

                                                                                                                                                                                                                                                                          interface TokenPayload {}

                                                                                                                                                                                                                                                                            property at_hash

                                                                                                                                                                                                                                                                            at_hash?: string;
                                                                                                                                                                                                                                                                            • Access token hash. Provides validation that the access token is tied to the identity token. If the ID token is issued with an access token in the server flow, this is always included. This can be used as an alternate mechanism to protect against cross-site request forgery attacks, but if you follow Step 1 and Step 3 it is not necessary to verify the access token.

                                                                                                                                                                                                                                                                            property aud

                                                                                                                                                                                                                                                                            aud: string;
                                                                                                                                                                                                                                                                            • Identifies the audience that this ID token is intended for. It must be one of the OAuth 2.0 client IDs of your application.

                                                                                                                                                                                                                                                                            property azp

                                                                                                                                                                                                                                                                            azp?: string;
                                                                                                                                                                                                                                                                            • The client_id of the authorized presenter. This claim is only needed when the party requesting the ID token is not the same as the audience of the ID token. This may be the case at Google for hybrid apps where a web application and Android app have a different client_id but share the same project.

                                                                                                                                                                                                                                                                            property email

                                                                                                                                                                                                                                                                            email?: string;
                                                                                                                                                                                                                                                                            • The user's email address. This may not be unique and is not suitable for use as a primary key. Provided only if your scope included the string "email".

                                                                                                                                                                                                                                                                            property email_verified

                                                                                                                                                                                                                                                                            email_verified?: boolean;
                                                                                                                                                                                                                                                                            • True if the user's e-mail address has been verified; otherwise false.

                                                                                                                                                                                                                                                                            property exp

                                                                                                                                                                                                                                                                            exp: number;
                                                                                                                                                                                                                                                                            • The time the ID token expires, represented in Unix time (integer seconds).

                                                                                                                                                                                                                                                                            property family_name

                                                                                                                                                                                                                                                                            family_name?: string;
                                                                                                                                                                                                                                                                            • The user's family name, in a displayable form. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When name claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                            property given_name

                                                                                                                                                                                                                                                                            given_name?: string;
                                                                                                                                                                                                                                                                            • The user's given name, in a displayable form. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When name claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                            property hd

                                                                                                                                                                                                                                                                            hd?: string;
                                                                                                                                                                                                                                                                            • The hosted G Suite domain of the user. Provided only if the user belongs to a hosted domain.

                                                                                                                                                                                                                                                                            property iat

                                                                                                                                                                                                                                                                            iat: number;
                                                                                                                                                                                                                                                                            • The time the ID token was issued, represented in Unix time (integer seconds).

                                                                                                                                                                                                                                                                            property iss

                                                                                                                                                                                                                                                                            iss: string;
                                                                                                                                                                                                                                                                            • The Issuer Identifier for the Issuer of the response. Always https://accounts.google.com or accounts.google.com for Google ID tokens.

                                                                                                                                                                                                                                                                            property locale

                                                                                                                                                                                                                                                                            locale?: string;
                                                                                                                                                                                                                                                                            • The user's locale, represented by a BCP 47 language tag. Might be provided when a name claim is present.

                                                                                                                                                                                                                                                                            property name

                                                                                                                                                                                                                                                                            name?: string;
                                                                                                                                                                                                                                                                            • The user's full name, in a displayable form. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When name claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                            property nonce

                                                                                                                                                                                                                                                                            nonce?: string;
                                                                                                                                                                                                                                                                            • The value of the nonce supplied by your app in the authentication request. You should enforce protection against replay attacks by ensuring it is presented only once.

                                                                                                                                                                                                                                                                            property picture

                                                                                                                                                                                                                                                                            picture?: string;
                                                                                                                                                                                                                                                                            • The URL of the user's profile picture. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When picture claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                            property profile

                                                                                                                                                                                                                                                                            profile?: string;
                                                                                                                                                                                                                                                                            • The URL of the user's profile page. Might be provided when: - The request scope included the string "profile" - The ID token is returned from a token refresh - When profile claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.

                                                                                                                                                                                                                                                                            property sub

                                                                                                                                                                                                                                                                            sub: string;
                                                                                                                                                                                                                                                                            • An identifier for the user, unique among all Google accounts and never reused. A Google account can have multiple emails at different points in time, but the sub value is never changed. Use sub within your application as the unique-identifier key for the user.

                                                                                                                                                                                                                                                                            interface UserRefreshClientOptions

                                                                                                                                                                                                                                                                            interface UserRefreshClientOptions extends OAuth2ClientOptions {}

                                                                                                                                                                                                                                                                              property clientId

                                                                                                                                                                                                                                                                              clientId?: string;

                                                                                                                                                                                                                                                                                property clientSecret

                                                                                                                                                                                                                                                                                clientSecret?: string;

                                                                                                                                                                                                                                                                                  property refreshToken

                                                                                                                                                                                                                                                                                  refreshToken?: string;

                                                                                                                                                                                                                                                                                    interface VerifyIdTokenOptions

                                                                                                                                                                                                                                                                                    interface VerifyIdTokenOptions {}

                                                                                                                                                                                                                                                                                      property audience

                                                                                                                                                                                                                                                                                      audience?: string | string[];

                                                                                                                                                                                                                                                                                        property idToken

                                                                                                                                                                                                                                                                                        idToken: string;

                                                                                                                                                                                                                                                                                          property maxExpiry

                                                                                                                                                                                                                                                                                          maxExpiry?: number;

                                                                                                                                                                                                                                                                                            Enums

                                                                                                                                                                                                                                                                                            enum ClientAuthentication

                                                                                                                                                                                                                                                                                            enum ClientAuthentication {
                                                                                                                                                                                                                                                                                            ClientSecretPost = 'ClientSecretPost',
                                                                                                                                                                                                                                                                                            ClientSecretBasic = 'ClientSecretBasic',
                                                                                                                                                                                                                                                                                            None = 'None',
                                                                                                                                                                                                                                                                                            }
                                                                                                                                                                                                                                                                                            • The client authentication type. Supported values are basic, post, and none. https://datatracker.ietf.org/doc/html/rfc7591#section-2

                                                                                                                                                                                                                                                                                            member ClientSecretBasic

                                                                                                                                                                                                                                                                                            ClientSecretBasic = 'ClientSecretBasic'

                                                                                                                                                                                                                                                                                              member ClientSecretPost

                                                                                                                                                                                                                                                                                              ClientSecretPost = 'ClientSecretPost'

                                                                                                                                                                                                                                                                                                member None

                                                                                                                                                                                                                                                                                                None = 'None'

                                                                                                                                                                                                                                                                                                  enum CodeChallengeMethod

                                                                                                                                                                                                                                                                                                  enum CodeChallengeMethod {
                                                                                                                                                                                                                                                                                                  Plain = 'plain',
                                                                                                                                                                                                                                                                                                  S256 = 'S256',
                                                                                                                                                                                                                                                                                                  }

                                                                                                                                                                                                                                                                                                    member Plain

                                                                                                                                                                                                                                                                                                    Plain = 'plain'

                                                                                                                                                                                                                                                                                                      member S256

                                                                                                                                                                                                                                                                                                      S256 = 'S256'

                                                                                                                                                                                                                                                                                                        enum GCPEnv

                                                                                                                                                                                                                                                                                                        enum GCPEnv {
                                                                                                                                                                                                                                                                                                        APP_ENGINE = 'APP_ENGINE',
                                                                                                                                                                                                                                                                                                        KUBERNETES_ENGINE = 'KUBERNETES_ENGINE',
                                                                                                                                                                                                                                                                                                        CLOUD_FUNCTIONS = 'CLOUD_FUNCTIONS',
                                                                                                                                                                                                                                                                                                        COMPUTE_ENGINE = 'COMPUTE_ENGINE',
                                                                                                                                                                                                                                                                                                        CLOUD_RUN = 'CLOUD_RUN',
                                                                                                                                                                                                                                                                                                        NONE = 'NONE',
                                                                                                                                                                                                                                                                                                        }

                                                                                                                                                                                                                                                                                                          member APP_ENGINE

                                                                                                                                                                                                                                                                                                          APP_ENGINE = 'APP_ENGINE'

                                                                                                                                                                                                                                                                                                            member CLOUD_FUNCTIONS

                                                                                                                                                                                                                                                                                                            CLOUD_FUNCTIONS = 'CLOUD_FUNCTIONS'

                                                                                                                                                                                                                                                                                                              member CLOUD_RUN

                                                                                                                                                                                                                                                                                                              CLOUD_RUN = 'CLOUD_RUN'

                                                                                                                                                                                                                                                                                                                member COMPUTE_ENGINE

                                                                                                                                                                                                                                                                                                                COMPUTE_ENGINE = 'COMPUTE_ENGINE'

                                                                                                                                                                                                                                                                                                                  member KUBERNETES_ENGINE

                                                                                                                                                                                                                                                                                                                  KUBERNETES_ENGINE = 'KUBERNETES_ENGINE'

                                                                                                                                                                                                                                                                                                                    member NONE

                                                                                                                                                                                                                                                                                                                    NONE = 'NONE'

                                                                                                                                                                                                                                                                                                                      Type Aliases

                                                                                                                                                                                                                                                                                                                      type ExternalAccountClientOptions

                                                                                                                                                                                                                                                                                                                      type ExternalAccountClientOptions =
                                                                                                                                                                                                                                                                                                                      | IdentityPoolClientOptions
                                                                                                                                                                                                                                                                                                                      | AwsClientOptions
                                                                                                                                                                                                                                                                                                                      | PluggableAuthClientOptions;

                                                                                                                                                                                                                                                                                                                        type RefreshOptions

                                                                                                                                                                                                                                                                                                                        type RefreshOptions = Pick<
                                                                                                                                                                                                                                                                                                                        AuthClientOptions,
                                                                                                                                                                                                                                                                                                                        'eagerRefreshThresholdMillis' | 'forceRefreshOnFailure'
                                                                                                                                                                                                                                                                                                                        >;

                                                                                                                                                                                                                                                                                                                          Package Files (22)

                                                                                                                                                                                                                                                                                                                          Dependencies (6)

                                                                                                                                                                                                                                                                                                                          Dev Dependencies (36)

                                                                                                                                                                                                                                                                                                                          Peer Dependencies (0)

                                                                                                                                                                                                                                                                                                                          No peer dependencies.

                                                                                                                                                                                                                                                                                                                          Badge

                                                                                                                                                                                                                                                                                                                          To add a badge like this onejsDocs.io badgeto your package's README, use the codes available below.

                                                                                                                                                                                                                                                                                                                          You may also use Shields.io to create a custom badge linking to https://www.jsdocs.io/package/google-auth-library.

                                                                                                                                                                                                                                                                                                                          • Markdown
                                                                                                                                                                                                                                                                                                                            [![jsDocs.io](https://img.shields.io/badge/jsDocs.io-reference-blue)](https://www.jsdocs.io/package/google-auth-library)
                                                                                                                                                                                                                                                                                                                          • HTML
                                                                                                                                                                                                                                                                                                                            <a href="https://www.jsdocs.io/package/google-auth-library"><img src="https://img.shields.io/badge/jsDocs.io-reference-blue" alt="jsDocs.io"></a>