These credentials are mostly intended for testing. Integration tests running against an emulator do not need to authenticate. In fact, it may be impossible to connect to an emulator using SSL/TLS because the emulators typically run without secure communication.

In addition, unit tests may benefit from using these credentials: loading the default credentials unnecessarily slows down the unit tests, and in some CI environments the credentials may fail to load, creating confusing warnings and sometimes even errors.

Parameter
Name	Description
`opts`	optional configuration values. Note that the effect of these parameters depends on the underlying transport. For example, `TracingComponentsOption` is ignored by gRPC-based services.

MakeGoogleDefaultCredentials

Creates the default credentials.

These are the most commonly used credentials, and are expected to meet the needs of most applications. The Google Default Credentials conform to aip/4110. Consider using these credentials when:

Your application is deployed to a GCP environment such as GCE, GKE, or Cloud Run. Each of these deployment environments provides a default service account to the application, and offers mechanisms to change the default credentials without any code changes to your application.
You are testing or developing the application on a workstation (physical or virtual). These credentials will use your preferences as set with gcloud auth application-default. These preferences can be your own GCP user credentials, or some service account.
Regardless of where your application is running, you can use the GOOGLE_APPLICATION_CREDENTIALS environment variable to override the defaults. This environment variable should point to a file containing a service account key file, or a JSON object describing your user credentials.

MakeAccessTokenCredentials

Creates credentials with a fixed access token.

These credentials are useful when using an out-of-band mechanism to fetch access tokens. Note that access tokens are time limited, you will need to manually refresh the tokens created by the

MakeImpersonateServiceAccountCredentials

Creates credentials for service account impersonation.

Service account impersonation allows one account (user or service account) to act as a second account. This can be useful in multi-tenant services, where the service may perform some actions with an specific account associated with a tenant. The tenant can grant or restrict permissions to this tenant account.

When using service account impersonation is important to distinguish between the credentials used to obtain the target account credentials (the base_credentials) parameter, and the credentials representing the target_service_account.

Use AccessTokenLifetimeOption to configure the maximum lifetime of the obtained credentials. The default is 1h (3600s), see IAM quotas for the limits set by the platform and how to override them.

Use DelegatesOption to configure a sequence of intermediate service account, each of which has permissions to impersonate the next and the last one has permissions to impersonate target_service_account.

Use ScopesOption to restrict the authentication scope for the obtained credentials. See below for possible values.

MakeServiceAccountCredentials

Creates service account credentials from a service account key.

A service account is an account for an application or compute workload instead of an individual end user. The recommended practice is to use Google Default Credentials, which relies on the configuration of the Google Cloud system hosting your application (GCE, GKE, Cloud Run) to authenticate your workload or application. But sometimes you may need to create and download a service account key, for example, to use a service account when running your application on a system that is not part of Google Cloud.

Service account credentials are used in this latter case.

You can create multiple service account keys for a single service account. When you create a service account key, the key is returned as string, in the format described by aip/4112. This string contains an id for the service account, as well as the cryptographical materials (a RSA private key) required to authenticate the caller.

Therefore, services account keys should be treated as any other secret with security implications. Think of them as unencrypted passwords. Do not store them where unauthorized persons or programs may read them.

As stated above, most applications should probably use default credentials, maybe pointing them to a file with these contents. Using this function may be useful when the service account key is obtained from Cloud Secret Manager or a similar service.

Parameters
Name	Description
`json_object`	the service account configuration as a JSON string. Typically applications read this from a file, or download the contents from something like Google's secret manager service.
`opts`	optional configuration values. Note that the effect of these parameters depends on the underlying transport. For example, `TracingComponentsOption` is ignored by gRPC-based services.

MakeExternalAccountCredentials

Creates credentials based on external accounts.

Workload Identity Federation can grant on-premises or multi-cloud workloads access to Google Cloud resources, without using a service account key. You can use identity federation with Amazon Web Services (AWS), or with any identity provider that supports OpenID Connect (OIDC), such as Microsoft Azure, or SAML 2.0.

make_ready_future

Create a future that is immediately ready.

Parameters
Name	Description
`t`
`typename T`

make_ready_future

Create a future that is immediately ready.

MakeStatusFromRpcError

Creates a google::cloud::Status from a grpc::Status.

Parameter
Name	Description
`status`

MakeStatusFromRpcError

Creates a google::cloud::Status from a grpc::StatusCode and description.

Parameters
Name	Description
`code`
`what`

MakeStatusFromRpcError

Creates a google::cloud::Status from a google:rpc::Status proto.

Some gRPC services return the google::rpc::Status proto for errors. The libraries in google-cloud-cpp represent these errors using a google::cloud::Status.

Parameter
Name	Description
`proto`

MakeKmsKeyName

Constructs a KmsKeyName from the given full_name.

Returns a non-OK Status if full_name is improperly formed.

Parameter
Name	Description
`full_name`

ParseSeverity

Convert a human-readable representation to a Severity.

Parameter
Name	Description
`name`

MakeProject

Constructs a Project from the given full_name.

Returns a non-OK Status if full_name is improperly formed.

Parameter
Name	Description
`full_name`

StatusCodeToString

Convert code to a human readable string.

Parameter
Name	Description
`code`

make_status_or

Parameters
Name	Description
`rhs`
`typename T`

SetTerminateHandler

Install terminate handler and get the old one atomically.

Parameter
Name	Description
`f`	the handler. It should never return, behaviour is undefined otherwise.

GetTerminateHandler

Get the currently installed handler.

Terminate

Invoke the currently installed handler.

This function should never return.

Parameter
Name	Description
`msg`	Details about the error.

Parameters
Name	Description
`access_token`	the access token to be used by the client library.
`expiration`	the expiration time for the token.
`opts`	optional configuration values. Note that the effect of these parameters depends on the underlying transport. For example, `TracingComponentsOption` is ignored by gRPC-based services.

Parameters
Name	Description
`base_credentials`	the credentials used to contact the IAM Credentials services.
`target_service_account`	the email address of the service account to impersonate.
`opts`	optional configuration values. Note that the effect of these parameters depends on the underlying transport. For example, `TracingComponentsOption` is ignored by gRPC-based services.

Namespace google::cloud (2.10.1)

Classes

Structs

Enums

Functions

MakeInsecureCredentials

MakeGoogleDefaultCredentials

See Also

MakeAccessTokenCredentials

See Also

MakeImpersonateServiceAccountCredentials

See Also

See Also

See Also

MakeServiceAccountCredentials

MakeExternalAccountCredentials

See Also

make_ready_future

make_ready_future

MakeStatusFromRpcError

MakeStatusFromRpcError

MakeStatusFromRpcError

MakeKmsKeyName

ParseSeverity

MakeProject

StatusCodeToString

make_status_or

SetTerminateHandler

GetTerminateHandler

Terminate

version_major

See Alsohttps://semver.org/spec/v2.0.0.html for details.

version_minor

See Alsohttps://semver.org/spec/v2.0.0.html for details.

version_patch

See Alsohttps://semver.org/spec/v2.0.0.html for details.

version_pre_release

See Alsohttps://semver.org/spec/v2.0.0.html for details.

version

version_string