Classes
AccessTokenWithHeaders
Represents an access token that can be used to authorize a request. The token might be accompanied by extra information that should be sent in the form of headers.
AccessTokenWithHeaders.Builder
Builder class for AccessTokenWithHeaders to simplify common scenarios.
AuthorizationCodeInstalledApp
Thread-safe OAuth 2.0 authorization code flow for an installed application that persists end-user credentials.
AwsExternalAccountCredential
AWS credentials as described in https://google.aip.dev/auth/4117#determining-the-subject-token-in-aws.
BearerToken
OAuth 2.0 helper for accessing protected resources using the Bearer token as specified in http://tools.ietf.org/html/rfc6750.
BearerToken.AuthorizationHeaderAccessMethod
Thread-safe OAuth 2.0 method for accessing protected resources using the Authorization header as specified in http://tools.ietf.org/html/rfc6750#section-2.1.
BearerToken.QueryParameterAccessMethod
Obsolete.
Thread-safe OAuth 2.0 method for accessing protected resources using an access_token query parameter
as specified in http://tools.ietf.org/html/rfc6750#section-2.3.
This access method is being made obsolete. Please read here for more up to date information:
https://developers.google.com/identity/protocols/oauth2/index.html#4.-send-the-access-token-to-an-api..
Please use BearerToken.AuthorizationHeaderAccessMethod instead.
ClientSecrets
Client credential details for installed and web applications.
ComputeCredential
Google OAuth 2.0 credential for accessing protected resources using an access token. The Google OAuth 2.0 Authorization Server supports server-to-server interactions such as those between a web application and Google Cloud Storage. The requesting application has to prove its own identity to gain access to an API, and an end-user doesn't have to be involved.
More details about Compute Engine authentication is available at: https://cloud.google.com/compute/docs/authentication.
ComputeCredential.Initializer
An initializer class for the Compute credential. It uses ComputeTokenUrl as the token server URL (optionally overriding the host using the GCE_METADATA_HOST environment variable).
ExternalAccountCredential
Base class for external account credentials.
FileSourcedExternalAccountCredential
File-sourced credentials as described in https://google.aip.dev/auth/4117#determining-the-subject-token-in-file-sourced-credentials.
GoogleAuthConsts
Google OAuth2 constants. Canonical source for these URLs is: https://accounts.google.com/.well-known/openid-configuration
GoogleClientSecrets
OAuth 2.0 client secrets model as specified in https://cloud.google.com/console/.
GoogleCredential
Credential for authorizing calls using OAuth 2.0. It is a convenience wrapper that allows handling of different types of credentials (like ServiceAccountCredential, ComputeCredential or UserCredential) in a unified way.
See GetApplicationDefaultAsync(CancellationToken) for the credential retrieval logic.
GoogleWebAuthorizationBroker
A helper utility to manage the authorization code flow.
ImpersonatedCredential
Allows a service account or user credential to impersonate a service account. See https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials and https://cloud.google.com/iam/docs/impersonating-service-accounts for more information.
ImpersonatedCredential.Initializer
An initializer class for the impersonated credential.
JsonCredentialParameters
Holder for credential parameters read from JSON credential file. Fields are union of parameters for all supported credential types.
JsonCredentialParameters.CredentialSource
Holder for the credential source parameters associated to an external account credentials.
JsonCredentialParameters.CredentialSource.SubjectTokenFormat
Holder for the subject token format.
LocalServerCodeReceiver
OAuth 2.0 verification code receiver that runs a local server on a free port and waits for a call with the authorization verification code.
OidcToken
Represents an OIDC Token.
OidcTokenOptions
Options used to create an OidcToken.
RequestExtensions
Extension methods for requests.
ServiceAccountCredential
Google OAuth 2.0 credential for accessing protected resources using an access token. The Google OAuth 2.0 Authorization Server supports server-to-server interactions such as those between a web application and Google Cloud Storage. The requesting application has to prove its own identity to gain access to an API, and an end-user doesn't have to be involved.
Take a look in https://developers.google.com/accounts/docs/OAuth2ServiceAccount for more details.
Since version 1.9.3, service account credential also supports JSON Web Token access token scenario. In this scenario, instead of sending a signed JWT claim to a token server and exchanging it for an access token, a locally signed JWT claim bound to an appropriate URI is used as an access token directly. See GetAccessTokenForRequestAsync(String, CancellationToken) for explanation when JWT access token is used and when regular OAuth2 token is used.
ServiceAccountCredential.Initializer
An initializer class for the service account credential.
ServiceCredential
This type of Google OAuth 2.0 credential enables access to protected resources using an access token when interacting server to server. For example, a service account credential could be used to access Google Cloud Storage from a web application without a user's involvement.
ServiceAccountCredential inherits from this class in order to support Service Accounts. More details available at: https://developers.google.com/accounts/docs/OAuth2ServiceAccount. ComputeCredential is another example of a class that inherits from this class in order to support Compute credentials. For more information about Compute authentication, see: https://cloud.google.com/compute/docs/authentication.
ExternalAccountCredential inherits from this class to support both Workload Identity Federation and Workforce Identity Federation. You can read more about these topics in https://cloud.google.com/iam/docs/workload-identity-federation and https://cloud.google.com/iam/docs/workforce-identity-federation respectively. Note that in the case of Workforce Identity Federation, the external account does not represent a service account but a user account, so, the fact that ExternalAccountCredential inherits from ServiceCredential might be construed as misleading. In reality ServiceCredential is not tied to a service account in terms of implementation, only in terms of name. For instance, a better name for this class might have been NoUserFlowCredential, and in that sense, it's correct that ExternalAccountCredential inherits from ServiceCredential even when representing a Workforce Identity Federation account.
ServiceCredential.Initializer
An initializer class for the service credential.
SubjectTokenException
Exception thrown when the subject token cannot be obtained for a given external account credential.
UrlSourcedExternalAccountCredential
URL-sourced credentials as described in https://google.aip.dev/auth/4117#determining-the-subject-token-in-microsoft-azure-and-url-sourced-credentials.
UserCredential
OAuth 2.0 credential for accessing protected resources using an access token, as well as optionally refreshing the access token when it expires using a refresh token.
Interfaces
IAccessMethod
Method of presenting the access token to the resource server as specified in http://tools.ietf.org/html/rfc6749#section-7
IAuthorizationCodeInstalledApp
Authorization code flow for an installed application that persists end-user credentials.
IBlobSigner
Represents a data blob signer.
ICodeReceiver
OAuth 2.0 verification code receiver.
ICredential
The main interface to represent credential in the client library. Service account, User account and Compute credential inherit from this interface to provide access token functionality. In addition this interface inherits from IConfigurableHttpClientInitializer to be able to hook to http requests. More details are available in the specific implementations.
IOidcTokenProvider
Represents an OIDC token provider.
ITokenAccess
Allows direct retrieval of access tokens to authenticate requests. This is necessary for workflows where you don't want to use BaseClientService to access the API. (e.g. gRPC that implemenents the entire HTTP2 stack internally).
ITokenAccessWithHeaders
Allows direct retrieval of access tokens to authenticate requests. The access tokens obtained can be accompanied by extra information that either describes the access token or is associated with it. This information should acompany the token as headers when the token is used to access a resource.
Enums
LocalServerCodeReceiver.CallbackUriChooserStrategy
Describes the different strategies for the selection of the callback URI. 127.0.0.1 is recommended, but can't be done in non-admin Windows 7 and 8 at least.
OidcTokenFormat
Represents the OIDC token formats supported when the token is obtained using the GCE metadata server.