These credentials are mostly intended for testing. Integration tests running against an emulator do not need to authenticate. In fact, it may be impossible to connect to an emulator using SSL/TLS because the emulators typically run without secure communication.

In addition, unit tests may benefit from using these credentials: loading the default credentials unnecessarily slows down the unit tests, and in some CI environments the credentials may fail to load, creating confusing warnings and sometimes even errors.

Parameter
Name	Description
`opts`	optional configuration values. Note that the effect of these parameters depends on the underlying transport. For example, `TracingComponentsOption` is ignored by gRPC-based services.

Returns
Type	Description
`std::shared_ptr< Credentials >`

MakeGoogleDefaultCredentials(Options)

Creates the default credentials.

These are the most commonly used credentials, and are expected to meet the needs of most applications. The Google Default Credentials conform to aip/4110. Consider using these credentials when:

Your application is deployed to a GCP environment such as GCE, GKE, or Cloud Run. Each of these deployment environments provides a default service account to the application, and offers mechanisms to change the default credentials without any code changes to your application.
You are testing or developing the application on a workstation (physical or virtual). These credentials will use your preferences as set with gcloud auth application-default. These preferences can be your own GCP user credentials, or some service account.
Regardless of where your application is running, you can use the GOOGLE_APPLICATION_CREDENTIALS environment variable to override the defaults. This environment variable should point to a file containing a service account key file, or a JSON object describing your user credentials.

MakeAccessTokenCredentials(std::string const &, std::chrono::system_clock::time_point, Options)

Creates credentials with a fixed access token.

These credentials are useful when using an out-of-band mechanism to fetch access tokens. Note that access tokens are time limited, you will need to manually refresh the tokens created by the

MakeImpersonateServiceAccountCredentials(std::shared_ptr< Credentials >, std::string, Options)

Creates credentials for service account impersonation.

Service account impersonation allows one account (user or service account) to act as a second account. This can be useful in multi-tenant services, where the service may perform some actions with an specific account associated with a tenant. The tenant can grant or restrict permissions to this tenant account.

When using service account impersonation is important to distinguish between the credentials used to obtain the target account credentials (the base_credentials) parameter, and the credentials representing the target_service_account.

Use AccessTokenLifetimeOption to configure the maximum lifetime of the obtained credentials. The default is 1h (3600s), see IAM quotas for the limits set by the platform and how to override them.

Use DelegatesOption to configure a sequence of intermediate service account, each of which has permissions to impersonate the next and the last one has permissions to impersonate target_service_account.

Use ScopesOption to restrict the authentication scope for the obtained credentials. See below for possible values.

MakeServiceAccountCredentials(std::string, Options)

Creates service account credentials from a service account key.

A service account is an account for an application or compute workload instead of an individual end user. The recommended practice is to use Google Default Credentials, which relies on the configuration of the Google Cloud system hosting your application (GCE, GKE, Cloud Run) to authenticate your workload or application. But sometimes you may need to create and download a service account key, for example, to use a service account when running your application on a system that is not part of Google Cloud.

Service account credentials are used in this latter case.

You can create multiple service account keys for a single service account. When you create a service account key, the key is returned as string, in the format described by aip/4112. This string contains an id for the service account, as well as the cryptographical materials (a RSA private key) required to authenticate the caller.

Therefore, services account keys should be treated as any other secret with security implications. Think of them as unencrypted passwords. Do not store them where unauthorized persons or programs may read them.

As stated above, most applications should probably use default credentials, maybe pointing them to a file with these contents. Using this function may be useful when the service account key is obtained from Cloud Secret Manager or a similar service.

Parameters
Name	Description
`json_object`	the service account configuration as a JSON string. Typically applications read this from a file, or download the contents from something like Google's secret manager service.
`opts`	optional configuration values. Note that the effect of these parameters depends on the underlying transport. For example, `TracingComponentsOption` is ignored by gRPC-based services.

Returns
Type	Description
`std::shared_ptr< Credentials >`

MakeExternalAccountCredentials(std::string, Options)

Creates credentials based on external accounts.

Workload Identity Federation can grant on-premises or multi-cloud workloads access to Google Cloud resources, without using a service account key. You can use identity federation with Amazon Web Services (AWS), or with any identity provider that supports OpenID Connect (OIDC), such as Microsoft Azure, or SAML 2.0.

make_ready_future(T &&)

Create a future that is immediately ready.

Parameters
Name	Description
`t`
`typename T`

Returns
Type	Description
`future< typename internal::make_ready_return< T >::type >`

make_ready_future()

Create a future that is immediately ready.

Returns
Type	Description
`future< void >`

MakeStatusFromRpcError(grpc::Status const &)

Creates a google::cloud::Status from a grpc::Status.

Parameter
Name	Description
`status`

Returns
Type	Description
`google::cloud::Status`

MakeStatusFromRpcError(grpc::StatusCode, std::string)

Creates a google::cloud::Status from a grpc::StatusCode and description.

Parameters
Name	Description
`code`
`what`

Returns
Type	Description
`google::cloud::Status`

MakeStatusFromRpcError(google::rpc::Status const &)

Creates a google::cloud::Status from a google:rpc::Status proto.

Some gRPC services return the google::rpc::Status proto for errors. The libraries in google-cloud-cpp represent these errors using a google::cloud::Status.

Parameter
Name	Description
`proto`

Returns
Type	Description
`google::cloud::Status`

MakeKmsKeyName(std::string const &)

Constructs a KmsKeyName from the given full_name.

Returns a non-OK Status if full_name is improperly formed.

Parameter
Name	Description
`full_name`

Returns
Type	Description
`StatusOr< KmsKeyName >`

ParseSeverity(std::string const &)

Convert a human-readable representation to a Severity.

Parameter
Name	Description
`name`

Returns
Type	Description
`absl::optional< Severity >`

MakeProject(std::string const &)

Constructs a Project from the given full_name.

Returns a non-OK Status if full_name is improperly formed.

Parameter
Name	Description
`full_name`

Returns
Type	Description
`StatusOr< Project >`

StatusCodeToString(StatusCode)

Convert code to a human readable string.

Parameter
Name	Description
`code`

Returns
Type	Description
`std::string`

make_status_or(T)

Parameters
Name	Description
`rhs`
`typename T`

Returns
Type	Description
`StatusOr< T >`

SetTerminateHandler(TerminateHandler)

Install terminate handler and get the old one atomically.

Parameter
Name	Description
`f`	the handler. It should never return, behaviour is undefined otherwise.

Returns
Type	Description
`TerminateHandler`	Previously set handler.

GetTerminateHandler()

Get the currently installed handler.

Returns
Type	Description
`TerminateHandler`	The currently installed handler.

Terminate(char const *)

Invoke the currently installed handler.

This function should never return.

Parameter
Name	Description
`msg`	Details about the error.

Returns
Type	Description
`void`

version_major()

The Google Cloud C++ Client major version.

version_minor()

The Google Cloud C++ Client minor version.

version_patch()

The Google Cloud C++ Client patch version.

version_pre_release()

The Google Cloud C++ Client pre-release version.

version()

A single integer representing the Major/Minor/Patch version.

Returns
Type	Description
`int constexpr`

version_string()

The version as a string, in MAJOR.MINOR.PATCH[-PRE][+gitrev] format.

Returns
Type	Description
`std::string`

Type Aliases

BackoffPolicy

Alias Of: ::google::cloud::internal::BackoffPolicy

The base class for backoff policies.

ExponentialBackoffPolicy

Alias Of: google::cloud::internal::ExponentialBackoffPolicy

A truncated exponential backoff policy with randomized periods.

CommonOptionList

Alias Of: OptionList< EndpointOption, UserAgentProductsOption, TracingComponentsOption, UserProjectOption, AuthorityOption >

A list of all the common options.

UnifiedCredentialsOptionList

Alias Of:

OptionList< AccessTokenLifetimeOption, CARootsFilePathOption, DelegatesOption, ScopesOption, TracingComponentsOption, UnifiedCredentialsOption >

A list of options related to authentication.

BackgroundThreadsFactory

Alias Of: std::function< std::unique_ptr< BackgroundThreads >()>

GrpcOptionList

Alias Of:

OptionList< GrpcCredentialOption, GrpcNumChannelsOption, GrpcChannelArgumentsOption, GrpcChannelArgumentsNativeOption, GrpcTracingOptionsOption, GrpcBackgroundThreadPoolSizeOption, GrpcCompletionQueueOption, GrpcBackgroundThreadsFactoryOption >

A list of all the gRPC options.

IamUpdater

Alias Of: std::function< absl::optional< google::iam::v1::Policy >(google::iam::v1::Policy)>

Used in the SetIamPolicy() read-modify-write cycles where an etag helps prevent simultaneous updates of a policy from overwriting each other.

The updater is called with a recently fetched policy, and should either return an empty optional if no changes are required, or return a new policy to be set. In the latter case the updater should either (1) set the etag of the returned policy to that of the recently fetched policy (strongly suggested), or (2) not set the etag at all.

In case (1) if the etag does not match the existing policy (i.e., there has been an intermediate update), this update is dropped and a new cycle is initiated. In case (2) the existing policy is overwritten blindly.

optional

Alias Of: absl::optional< T >

Alias template for google::cloud::optional.

Deprecated: this alias is deprecated; use absl::optional<T> directly.

OptionList

Alias Of: internal::TypeList< T... >

A template to hold a list of "option" types.

This can be a useful way to create meaningful lists of options. For example, there could be a list containing all the gRPC options. Or a list of all ProductX options. This gives us a way to link to lists of options with doxygen, and to do some checking about what options a function may expect.

RestOptionList

Alias Of: ::google::cloud::OptionList< QuotaUserOption, RestTracingOptionsOption, ServerTimeoutOption, UserIpOption >

The complete list of options accepted by CurlRestClient

TerminateHandler

Alias Of: std::function< void(char const *msg)>

Terminate handler.

It should handle the error, whose description are given in msg and should never return.

Parameters
Name	Description
`access_token`	the access token to be used by the client library.
`expiration`	the expiration time for the token.
`opts`	optional configuration values. Note that the effect of these parameters depends on the underlying transport. For example, `TracingComponentsOption` is ignored by gRPC-based services.

Parameters
Name	Description
`base_credentials`	the credentials used to contact the IAM Credentials services.
`target_service_account`	the email address of the service account to impersonate.
`opts`	optional configuration values. Note that the effect of these parameters depends on the underlying transport. For example, `TracingComponentsOption` is ignored by gRPC-based services.

Namespace google::cloud (2.13.0)

Classes

Structs

Enums

Functions

MakeInsecureCredentials(Options)

MakeGoogleDefaultCredentials(Options)

See Also

MakeAccessTokenCredentials(std::string const &, std::chrono::system_clock::time_point, Options)

See Also

MakeImpersonateServiceAccountCredentials(std::shared_ptr< Credentials >, std::string, Options)

See Also

See Also

See Also

MakeServiceAccountCredentials(std::string, Options)

MakeExternalAccountCredentials(std::string, Options)

See Also

make_ready_future(T &&)

make_ready_future()

MakeStatusFromRpcError(grpc::Status const &)

MakeStatusFromRpcError(grpc::StatusCode, std::string)

MakeStatusFromRpcError(google::rpc::Status const &)

MakeKmsKeyName(std::string const &)

ParseSeverity(std::string const &)

MakeProject(std::string const &)

StatusCodeToString(StatusCode)

make_status_or(T)

SetTerminateHandler(TerminateHandler)

GetTerminateHandler()

Terminate(char const *)

version_major()

See Also

version_minor()

See Also

version_patch()

See Also

version_pre_release()

See Also

version()

version_string()

Type Aliases

BackoffPolicy

ExponentialBackoffPolicy

CommonOptionList

UnifiedCredentialsOptionList

BackgroundThreadsFactory

GrpcOptionList

IamUpdater

optional

OptionList

RestOptionList

TerminateHandler