google-auth

https://googleapis.dev/python/google-auth/latest
Admin
google-auth is the Google authentication library for Python that provides ability to authenticate to...
Tokens:113,671
Snippets:873
Trust Score:9.9
Update:3 months ago
Show doc for...
Tokens:
Raw
### Credential Source Configuration Examples

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/identity_pool.html

Examples of credential source dictionaries for URL-sourced and file-sourced credentials.

```python
{
    "url": "http://www.example.com",
    "format": {
        "type": "json",
        "subject_token_field_name": "access_token",
    },
    "headers": {"foo": "bar"},
}
```

```python
{
    "file": "/path/to/token/file.txt"
}
```

--------------------------------

### Configure credential source for file

Source: https://googleapis.dev/python/google-auth/latest/reference/google.auth.identity_pool.html

Example dictionary structure for retrieving credentials from a local file.

```json
{
    "file": "/path/to/token/file.txt"
}
```

--------------------------------

### Configure credential source for URL

Source: https://googleapis.dev/python/google-auth/latest/reference/google.auth.identity_pool.html

Example dictionary structure for retrieving credentials from a URL.

```json
{
    "url": "http://www.example.com",
    "format": {
        "type": "json",
        "subject_token_field_name": "access_token",
    },
    "headers": {"foo": "bar"},
}
```

--------------------------------

### Initialize Compute Engine Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/compute_engine/credentials.html

Handles the setup of service account email, metadata identity endpoints, and signers during credential initialization.

```python
        self._quota_project_id = quota_project_id
        self._use_metadata_identity_endpoint = use_metadata_identity_endpoint
        self._target_audience = target_audience

        if use_metadata_identity_endpoint:
            if token_uri or additional_claims or service_account_email or signer:
                raise ValueError(
                    "If use_metadata_identity_endpoint is set, token_uri, "
                    "additional_claims, service_account_email, signer arguments"
                    " must not be set"
                )
            self._token_uri = None
            self._additional_claims = None
            self._signer = None

        if service_account_email is None:
            sa_info = _metadata.get_service_account_info(request)
            self._service_account_email = sa_info["email"]
        else:
            self._service_account_email = service_account_email

        if not use_metadata_identity_endpoint:
            if signer is None:
                signer = iam.Signer(
                    request=request,
                    credentials=Credentials(),
                    service_account_email=self._service_account_email,
                )
            self._signer = signer
            self._token_uri = token_uri or _DEFAULT_TOKEN_URI

            if additional_claims is not None:
                self._additional_claims = additional_claims
            else:
                self._additional_claims = {}
```

--------------------------------

### Get Default Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/_default.html

Entry point for retrieving Application Default Credentials for the current environment.

```python
def default(
    scopes: Optional[Sequence[str]] = None,
    request: Optional["google.auth.transport.Request"] = None,
    quota_project_id: Optional[str] = None,
    default_scopes: Optional[Sequence[str]] = None,
) -> tuple["google.auth.credentials.Credentials", Optional[str]]:
    """Gets the default credentials for the current environment.

    `Application Default Credentials`_ provides an easy way to obtain
    credentials to call Google APIs for server-to-server or local applications.
    This function acquires credentials from the environment in the following
    order:
```

--------------------------------

### get(url, **kwargs)

Source: https://googleapis.dev/python/google-auth/latest/reference/google.auth.transport._aiohttp_requests.html

Performs an asynchronous HTTP GET request.

```APIDOC
## get(url, **kwargs)

### Description
Performs an asynchronous HTTP GET request.

### Parameters
- **url** (str | URL) - Required - The URL at which the HTTP request is sent.
- **allow_redirects** (bool) - Optional - Whether to follow redirects (default: True).
```

--------------------------------

### Create Credentials from File

Source: https://googleapis.dev/python/google-auth/latest/reference/google.oauth2._service_account_async.html

Initialize credentials using a path to a service account JSON file.

```python
credentials = _service_account_async.Credentials.from_service_account_file(
    'service-account.json')
```

--------------------------------

### Create Credentials from Info

Source: https://googleapis.dev/python/google-auth/latest/reference/google.oauth2._service_account_async.html

Initialize credentials using a dictionary loaded from a service account JSON file.

```python
service_account_info = json.load(open('service-account.json'))
credentials = _service_account_async.Credentials.from_service_account_info(
    service_account_info)
```

--------------------------------

### Install google-auth via pip

Source: https://googleapis.dev/python/google-auth/latest/_sources/index.rst.txt

The standard method for installing the google-auth library in a Python environment using the pip package manager.

```bash
pip install --upgrade google-auth
```

--------------------------------

### Manage refresh handler

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/credentials.html

Allows getting and setting a custom refresh handler for the credentials.

```python
@property
def refresh_handler(self):
    """Returns the refresh handler if available.

    Returns:
       Optional[Callable[[google.auth.transport.Request, Sequence[str]], [str, datetime]]]:
           The current refresh handler.
    """
    return self._refresh_handler

@refresh_handler.setter
def refresh_handler(self, value):
    """Updates the current refresh handler.

    Args:
        value (Optional[Callable[[google.auth.transport.Request, Sequence[str]], [str, datetime]]]):
            The updated value of the refresh handler.

    Raises:
        TypeError: If the value is not a callable or None.
    """
    if not callable(value) and value is not None:
        raise TypeError("The provided refresh_handler is not a callable or None.")
    self._refresh_handler = value
```

--------------------------------

### Get API Key Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/_default.html

Creates credentials using a provided API key.

```python
def get_api_key_credentials(key):
    """Return credentials with the given API key."""
    from google.auth import api_key

    return api_key.Credentials(key)
```

--------------------------------

### Create Credentials from Service Account File or Info

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/_service_account_async.html

Use these helper methods to initialize credentials from a JSON file or loaded dictionary.

```python
credentials = _service_account_async.Credentials.from_service_account_file(
    'service-account.json')
```

```python
service_account_info = json.load(open('service_account.json'))
credentials = _service_account_async.Credentials.from_service_account_info(
    service_account_info)
```

```python
credentials = _service_account_async.Credentials.from_service_account_file(
    'service-account.json',
    scopes=['email'],
    subject='user@example.com')
```

--------------------------------

### Initialize Scoped Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/_credentials_async.html

Demonstrates creating scoped credentials directly or by copying an existing instance.

```python
credentials = SomeScopedCredentials(scopes=['one', 'two'])
```

```python
scoped_credentials = _credentials_async.with_scopes(scopes=['one', 'two'])
```

--------------------------------

### Initialize source credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/impersonated_credentials.html

Load service account credentials from a file to act as the source for impersonation.

```python
from google.oauth2 import service_account

target_scopes = [
    'https://www.googleapis.com/auth/devstorage.read_only']

source_credentials = (
    service_account.Credentials.from_service_account_file(
        '/path/to/svc_account.json',
        scopes=target_scopes))
```

--------------------------------

### Create Credentials from File

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/service_account.html

Initializes credentials from a service account JSON file, optionally specifying scopes and a subject for domain-wide delegation.

```python
credentials = service_account.Credentials.from_service_account_file(
    'service-account.json',
    scopes=['email'],
    subject='user@example.com')
```

--------------------------------

### Create Credentials from Service Account File

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/service_account.html

Initializes a Credentials instance by loading service account information from a JSON file.

```python
@classmethod
def from_service_account_file(cls, filename, **kwargs):
    """Creates a Credentials instance from a service account json file.

    Args:
        filename (str): The path to the service account json file.
        kwargs: Additional arguments to pass to the constructor.

    Returns:
        google.auth.service_account.Credentials: The constructed
            credentials.
    """
    info, signer = _service_account_info.from_filename(
        filename, require=["client_email", "token_uri"]
    )
    return cls._from_signer_and_info(signer, info, **kwargs)
```

--------------------------------

### HTTP Methods (get, post, delete, etc.)

Source: https://googleapis.dev/python/google-auth/latest/reference/google.auth.transport.requests.html

Standard HTTP methods provided by the session wrapper.

```APIDOC
## HTTP Methods

### Description
The session provides standard HTTP methods: `get(url, **kwargs)`, `delete(url, **kwargs)`, `head(url, **kwargs)`, `options(url, **kwargs)`, and `patch(url, data=None, **kwargs)`.

### Returns
- **requests.Response** - The response object from the server.
```

--------------------------------

### Get Google Compute Engine Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/_default.html

Retrieves credentials from the GCE Metadata Service, requiring the requests dependency.

```python
def _get_gce_credentials(request=None, quota_project_id=None):
    """Gets credentials and project ID from the GCE Metadata Service."""
    # While this library is normally bundled with compute_engine, there are
    # some cases where it's not available, so we tolerate ImportError.
    # Compute Engine requires optional `requests` dependency.
    try:
        from google.auth import compute_engine
        from google.auth.compute_engine import _metadata
        import google.auth.transport.requests
    except ImportError:
        _LOGGER.warning("Import of Compute Engine auth library failed.")
        return None, None

    if request is None:
        request = google.auth.transport.requests.Request()

    if _metadata.is_on_gce(request=request):
        # Get the project ID.
        try:
            project_id = _metadata.get_project_id(request=request)
        except exceptions.TransportError:
            project_id = None

        cred = compute_engine.Credentials()
        cred = _apply_quota_project_id(cred, quota_project_id)

        return cred, project_id
    else:
        _LOGGER.warning(
            "Authentication failed using Compute Engine authentication due to unavailable metadata server."
        )
        return None, None
```

--------------------------------

### Get Service Account Information

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/compute_engine/_metadata.html

Retrieves metadata information for a specified service account using a recursive request.

```python
def get_service_account_info(request, service_account="default"):
    path = "instance/service-accounts/{0}/".format(service_account)
    # See https://cloud.google.com/compute/docs/metadata#aggcontents
    # for more on the use of 'recursive'.
    return get(request, path, params={"recursive": "true"})
```

--------------------------------

### Instantiate User Credentials

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Create a Credentials instance using an access token, optionally including refresh token details for automatic refreshing.

```python
import google.oauth2.credentials

credentials = google.oauth2.credentials.Credentials(
    'access_token')
```

```python
credentials = google.oauth2.credentials.Credentials(
    'access_token',
    refresh_token='refresh_token',
    token_uri='token_uri',
    client_id='client_id',
    client_secret='client_secret')
```

--------------------------------

### Get Google App Engine Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/_default.html

Attempts to retrieve credentials and project ID specifically for the App Engine environment.

```python
def _get_gae_credentials():
    """Gets Google App Engine App Identity credentials and project ID."""
    # If not GAE gen1, prefer the metadata service even if the GAE APIs are
    # available as per https://google.aip.dev/auth/4115.
    if os.environ.get(environment_vars.LEGACY_APPENGINE_RUNTIME) != "python27":
        return None, None

    # While this library is normally bundled with app_engine, there are
    # some cases where it's not available, so we tolerate ImportError.
    try:
        _LOGGER.debug("Checking for App Engine runtime as part of auth process...")
        import google.auth.app_engine as app_engine
    except ImportError:
        _LOGGER.warning("Import of App Engine auth library failed.")
        return None, None

    try:
        credentials = app_engine.Credentials()
        project_id = app_engine.get_project_id()
        return credentials, project_id
    except EnvironmentError:
        _LOGGER.debug(
            "No App Engine library was found so cannot authentication via App Engine Identity Credentials."
        )
        return None, None
```

--------------------------------

### Initialize External Account Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/external_account.html

Constructor for setting up external account credentials with STS configuration and optional impersonation settings.

```python
super(Credentials, self).__init__()
self._audience = audience
self._subject_token_type = subject_token_type
self._universe_domain = universe_domain
self._token_url = token_url
if self._token_url == _DEFAULT_TOKEN_URL:
    self._token_url = self._token_url.replace(
        "{universe_domain}", self._universe_domain
    )
self._cloud_resource_manager_url = _CLOUD_RESOURCE_MANAGER.replace(
    "{universe_domain}", self._universe_domain
)
self._token_info_url = token_info_url
self._credential_source = credential_source
self._service_account_impersonation_url = service_account_impersonation_url
self._service_account_impersonation_options = (
    service_account_impersonation_options or {}
)
self._client_id = client_id
self._client_secret = client_secret
self._quota_project_id = quota_project_id
self._scopes = scopes
self._default_scopes = default_scopes
self._workforce_pool_user_project = workforce_pool_user_project
self._trust_boundary = trust_boundary

if self._client_id:
    self._client_auth = utils.ClientAuthentication(
        utils.ClientAuthType.basic, self._client_id, self._client_secret
    )
else:
    self._client_auth = None
self._sts_client = sts.Client(self._token_url, self._client_auth)

self._metrics_options = self._create_default_metrics_options()

self._impersonated_credentials = None
self._impersonation_lock = threading.Lock()
self._project_id = None
self._supplier_context = SupplierContext(
    self._subject_token_type, self._audience
)
self._cred_file_path = None

if not self.is_workforce_pool and self._workforce_pool_user_project:
    # Workload identity pools do not support workforce pool user projects.
    raise exceptions.InvalidValue(
        "workforce_pool_user_project should not be set for non-workforce pool "
        "credentials"
    )
```

--------------------------------

### Define AWS credential source configuration

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/aws.html

Example structure for the credential_source dictionary used to retrieve AWS credentials for exchange.

```json
{
    "environment_id": "aws1",
    "regional_cred_verification_url": "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",
    "region_url": "http://169.254.169.254/latest/meta-data/placement/availability-zone",
    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials",
    "imdsv2_session_token_url": "http://169.254.169.254/latest/api/token"
}
```

--------------------------------

### ESSigner.__init__

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/crypt/es.html

Initializes a new ESSigner instance with a private key.

```APIDOC
## ESSigner.__init__(private_key, key_id=None)

### Description
Initializes the signer with an EllipticCurvePrivateKey.

### Parameters
- **private_key** (cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey) - Required - The private key to sign with.
- **key_id** (str) - Optional - An optional key ID used to identify this private key.
```

--------------------------------

### request_encode_url

Source: https://googleapis.dev/python/google-auth/latest/reference/google.auth.transport.urllib3.html

Makes an HTTP request using urlopen() with fields encoded in the URL. This is suitable for methods like GET, HEAD, and DELETE.

```APIDOC
## request_encode_url(method, url, fields=None, headers=None, **urlopen_kw)

### Description
Make a request using urlopen() with the fields encoded in the url. This is useful for request methods like GET, HEAD, DELETE, etc.

### Parameters
- **method** (str) - Required - HTTP request method (such as GET, POST, PUT, etc.)
- **url** (str) - Required - The URL to perform the request on.
- **fields** (Sequence[tuple[str, str | bytes]] | Mapping[str, str | bytes]) - Optional - Data to encode and send in the URL.
- **headers** (Mapping[str, str]) - Optional - Dictionary of custom headers to send. If None, pool headers are used. If provided, these headers completely replace any pool-specific headers.
- **urlopen_kw** (str) - Optional - Additional keyword arguments for urlopen.

### Returns
- **BaseHTTPResponse** - The response object from the request.
```

--------------------------------

### Configure Quota Project from Environment

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/credentials.html

Checks the environment for a quota project ID and returns a new credentials instance if found.

```python
def with_quota_project_from_environment(self):
        quota_from_env = os.environ.get(environment_vars.GOOGLE_CLOUD_QUOTA_PROJECT)
        if quota_from_env:
            return self.with_quota_project(quota_from_env)
        return self
```

--------------------------------

### Create Credentials with Scopes and Subject

Source: https://googleapis.dev/python/google-auth/latest/reference/google.oauth2._service_account_async.html

Initialize credentials with specific scopes and a subject for domain-wide delegation.

```python
credentials = _service_account_async.Credentials.from_service_account_file(
    'service-account.json',
    scopes=['email'],
    subject='user@example.com')
```

--------------------------------

### Get mTLS Certificate and Key Paths

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/external_account.html

Retrieves file locations for mTLS certificates and keys. Raises NotImplementedError if not configured for mTLS.

```python
    def _get_mtls_cert_and_key_paths(self):
        """Gets the file locations for a certificate and private key file
        to be used for configuring mTLS for the sts and service account
        impersonation calls. Currently only expected to return a value when using
        X509 workload identity federation.

        Returns:
            Tuple[str, str]: The cert and key file locations as strings in a tuple.

        Raises:
            NotImplementedError: When the current credential is not configured for
                mTLS.
        """
        raise NotImplementedError(
            "_get_mtls_cert_and_key_location must be implemented."
        )
```

--------------------------------

### Configure Metrics and Constructor Arguments

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/identity_pool.html

Internal methods for setting up metrics options and managing constructor arguments.

```python
    def _create_default_metrics_options(self):
        metrics_options = super(Credentials, self)._create_default_metrics_options()
        # Check that credential source is a dict before checking for credential type. This check needs to be done
        # here because the external_account credential constructor needs to pass the metrics options to the
        # impersonated credential object before the identity_pool credentials are validated.
        if isinstance(self._credential_source, Mapping):
            if self._credential_source.get("file"):
                metrics_options["source"] = "file"
            elif self._credential_source.get("url"):
                metrics_options["source"] = "url"
            else:
                metrics_options["source"] = "x509"
        else:
            metrics_options["source"] = "programmatic"
        return metrics_options

    def _has_custom_supplier(self):
        return self._credential_source is None

    def _constructor_args(self):
        args = super(Credentials, self)._constructor_args()
        # If a custom supplier was used, append it to the args dict.
        if self._has_custom_supplier():
            args.update({"subject_token_supplier": self._subject_token_supplier})
        return args
```

--------------------------------

### End-to-End ID Token Flow

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Example of using service account credentials to authenticate a request and verify the resulting ID token.

```python
from google.oauth2 import id_token
from google.oauth2 import service_account
import google.auth
import google.auth.transport.requests
from google.auth.transport.requests import AuthorizedSession

target_audience = 'https://your-cloud-run-app.a.run.app'
url = 'https://your-cloud-run-app.a.run.app'

creds = service_account.IDTokenCredentials.from_service_account_file(
        '/path/to/svc.json', target_audience=target_audience)

authed_session = AuthorizedSession(creds)

# make authenticated request and print the response, status_code
resp = authed_session.get(url)
print(resp.status_code)
print(resp.text)

# to verify an ID Token
request = google.auth.transport.requests.Request()
token = creds.token
print(token)
print(id_token.verify_token(token,request))
```

--------------------------------

### Initialize Impersonated Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/impersonated_credentials.html

Configures source credentials and sets up target principal, scopes, and lifetime parameters.

```python
        self._source_credentials = copy.copy(source_credentials)
        # Service account source credentials must have the _IAM_SCOPE
        # added to refresh correctly. User credentials cannot have
        # their original scopes modified.
        if isinstance(self._source_credentials, credentials.Scoped):
            self._source_credentials = self._source_credentials.with_scopes(
                iam._IAM_SCOPE
            )
            # If the source credential is service account and self signed jwt
            # is needed, we need to create a jwt credential inside it
            if (
                hasattr(self._source_credentials, "_create_self_signed_jwt")
                and self._source_credentials._always_use_jwt_access
            ):
                self._source_credentials._create_self_signed_jwt(None)

        self._universe_domain = source_credentials.universe_domain
        self._target_principal = target_principal
        self._target_scopes = target_scopes
        self._delegates = delegates
        self._subject = subject
        self._lifetime = lifetime or _DEFAULT_TOKEN_LIFETIME_SECS
        self.token = None
        self.expiry = _helpers.utcnow()
        self._quota_project_id = quota_project_id
        self._iam_endpoint_override = iam_endpoint_override
        self._cred_file_path = None

        self._trust_boundary = trust_boundary
```

--------------------------------

### Define fields for request_encode_body

Source: https://googleapis.dev/python/google-auth/latest/reference/google.auth.transport.urllib3.html

Example structure for the fields parameter when using request_encode_body, including support for simple key-value pairs and file uploads.

```python
fields = {
    'foo': 'bar',
    'fakefile': ('foofile.txt', 'contents of foofile'),
    'realfile': ('barfile.txt', open('realfile').read()),
    'typedfile': ('bazfile.bin', open('bazfile').read(),
                  'image/jpeg'),
    'nonamefile': 'contents of nonamefile field',
}
```

--------------------------------

### Create Credentials from Signing Credentials

Source: https://googleapis.dev/python/google-auth/latest/reference/google.auth._jwt_async.html

Demonstrates initializing a new JWT Credentials instance using an existing Signing credentials object and a specified audience.

```python
svc_creds = service_account.Credentials.from_service_account_file(
    'service_account.json')
audience = (
    'https://pubsub.googleapis.com/google.pubsub.v1.Publisher')
jwt_creds = jwt.Credentials.from_signing_credentials(
    svc_creds, audience=audience)
```

--------------------------------

### Get Service Account OAuth Token

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/compute_engine/_metadata.html

Requests an OAuth 2.0 access token for a service account, including optional scope and certificate binding parameters.

```python
def get_service_account_token(request, service_account="default", scopes=None):
    from google.auth import _agent_identity_utils

    params = {}
    if scopes:
        if not isinstance(scopes, str):
            scopes = ",".join(scopes)
        params["scopes"] = scopes

    cert = _agent_identity_utils.get_and_parse_agent_identity_certificate()
    if cert:
        if _agent_identity_utils.should_request_bound_token(cert):
            fingerprint = _agent_identity_utils.calculate_certificate_fingerprint(cert)
            params["bindCertificateFingerprint"] = fingerprint

    metrics_header = {
        metrics.API_CLIENT_HEADER: metrics.token_request_access_token_mds()
    }

    path = "instance/service-accounts/{0}/token".format(service_account)
    token_json = get(request, path, params=params, headers=metrics_header)
    token_expiry = _helpers.utcnow() + datetime.timedelta(
        seconds=token_json["expires_in"]
    )
    return token_json["access_token"], token_expiry
```

--------------------------------

### Initialize Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/jwt.html

Constructor for the Credentials class, requiring a signer, issuer, subject, and audience.

```python
    def __init__(
        self,
        signer,
        issuer,
        subject,
        audience,
        additional_claims=None,
        token_lifetime=_DEFAULT_TOKEN_LIFETIME_SECS,
        quota_project_id=None,
    ):
        """
        Args:
            signer (google.auth.crypt.Signer): The signer used to sign JWTs.
            issuer (str): The `iss` claim.
            subject (str): The `sub` claim.
            audience (str): the `aud` claim. The intended audience for the
                credentials.
            additional_claims (Mapping[str, str]): Any additional claims for
                the JWT payload.
            token_lifetime (int): The amount of time in seconds for
                which the token is valid. Defaults to 1 hour.
            quota_project_id (Optional[str]): The project ID used for quota
                and billing.
        """
        super(Credentials, self).__init__()
        self._signer = signer
        self._issuer = issuer
        self._subject = subject
        self._audience = audience
        self._token_lifetime = token_lifetime
        self._quota_project_id = quota_project_id

        if additional_claims is None:
            additional_claims = {}

        self._additional_claims = additional_claims
```

--------------------------------

### Credentials.__init__

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/credentials.html

Initializes a new Credentials object with OAuth 2.0 token information and configuration.

```APIDOC
## Credentials.__init__

### Description
Initializes the Credentials object with necessary OAuth 2.0 parameters, including tokens, client identifiers, and scope information.

### Parameters
- **token** (str) - Optional - The OAuth 2.0 access token.
- **refresh_token** (str) - Optional - The OAuth 2.0 refresh token.
- **id_token** (str) - Optional - The Open ID Connect ID Token.
- **token_uri** (str) - Optional - The OAuth 2.0 authorization server's token endpoint URI.
- **client_id** (str) - Optional - The OAuth 2.0 client ID.
- **client_secret** (str) - Optional - The OAuth 2.0 client secret.
- **scopes** (Sequence[str]) - Optional - The scopes used to obtain authorization.
- **default_scopes** (Sequence[str]) - Optional - Default scopes passed by a Google client library.
- **quota_project_id** (str) - Optional - The project ID used for quota and billing.
- **rapt_token** (str) - Optional - The reauth Proof Token.
- **refresh_handler** (Callable) - Optional - A callable for obtaining access tokens when no refresh tokens are provided.
- **enable_reauth_refresh** (bool) - Optional - Whether reauth refresh flow should be used.
- **granted_scopes** (Sequence[str]) - Optional - The scopes that were consented/granted by the user.
- **trust_boundary** (str) - Optional - String representation of trust boundary meta.
- **universe_domain** (str) - Optional - The universe domain.
- **account** (str) - Optional - The account associated with the credential.
```

--------------------------------

### Initialize default credentials

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Automatically discover and initialize credentials from the configured environment.

```python
import google.auth

credentials, project = google.auth.default()
```

--------------------------------

### Initialize Impersonated Credentials

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Import the impersonated_credentials module to begin configuring service account impersonation.

```python
from google.auth import impersonated_credentials
```

--------------------------------

### Configure Token URI

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/service_account.html

Creates a copy of the credentials instance with a specified token URI.

```python
@_helpers.copy_docstring(credentials.CredentialsWithTokenUri)
    def with_token_uri(self, token_uri):
        cred = self._make_copy()
        cred._token_uri = token_uri
        return cred
```

--------------------------------

### Create JWT credentials from a service account file

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/_jwt_async.html

Initialize credentials using a service account JSON file and a specified audience.

```python
audience = 'https://pubsub.googleapis.com/google.pubsub.v1.Publisher'
credentials = jwt_async.Credentials.from_service_account_file(
    'service-account.json',
    audience=audience)
```

--------------------------------

### Create X.509 Credential Configuration with Custom Path

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Generates a credential configuration file using a custom path for the certificate configuration via the --credential-cert-configuration-output-file flag.

```bash
gcloud iam workload-identity-pools create-cred-config \
    projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID \
    --service-account $SERVICE_ACCOUNT_EMAIL \
    --credential-cert-path "$PATH_TO_CERTIFICATE" \
    --credential-cert-private-key-path "$PATH_TO_PRIVATE_KEY" \
    --credential-cert-trust-chain-path "$PATH_TO_TRUST_CHAIN" \
    --credential-cert-configuration-output-file "/custom/path/cert_config.json" \
    --output-file /path/to/config.json
```

--------------------------------

### Retrieve constructor arguments

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/external_account.html

Gathers all configuration parameters required to reconstruct the credential object.

```python
    def _constructor_args(self):
        args = {
            "audience": self._audience,
            "subject_token_type": self._subject_token_type,
            "token_url": self._token_url,
            "token_info_url": self._token_info_url,
            "service_account_impersonation_url": self._service_account_impersonation_url,
            "service_account_impersonation_options": copy.deepcopy(
                self._service_account_impersonation_options
            )
            or None,
            "credential_source": copy.deepcopy(self._credential_source),
            "quota_project_id": self._quota_project_id,
            "client_id": self._client_id,
            "client_secret": self._client_secret,
            "workforce_pool_user_project": self._workforce_pool_user_project,
            "scopes": self._scopes,
            "default_scopes": self._default_scopes,
            "universe_domain": self._universe_domain,
            "trust_boundary": self._trust_boundary,
        }
        if not self.is_workforce_pool:
            args.pop("workforce_pool_user_project")
        return args
```

--------------------------------

### Initialize Azure or OIDC credentials

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Explicitly initialize credentials for Azure or OIDC providers using a configuration dictionary.

```python
import json

from google.auth import identity_pool

json_config_info = json.loads(function_to_get_json_config())
credentials = identity_pool.Credentials.from_info(json_config_info)
scoped_credentials = credentials.with_scopes(
    ['https://www.googleapis.com/auth/cloud-platform'])
```

--------------------------------

### Check and apply scopes to credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/credentials.html

Demonstrates how to check if credentials require scopes and how to apply them using the with_scopes method.

```python
if credentials.requires_scopes:
    # Scoping is required.
    credentials = credentials.with_scopes(scopes=['one', 'two'])
```

```python
credentials = SomeScopedCredentials(scopes=['one', 'two'])
```

```python
scoped_credentials = credentials.with_scopes(scopes=['one', 'two'])
```

--------------------------------

### Create IDTokenCredentials from a file

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/service_account.html

Initialize IDTokenCredentials using a path to a service account JSON file.

```python
credentials = (
    service_account.IDTokenCredentials.from_service_account_file(
        'service-account.json'))
```

--------------------------------

### Generate SAML configuration for file-sourced credentials

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Use this command to create a configuration file for workforce pools using a SAML assertion retrieved from a URL.

```bash
# Generate a SAML configuration file for file-sourced credentials.
gcloud iam workforce-pools create-cred-config \
    locations/global/workforcePools/$WORKFORCE_POOL_ID/providers/$PROVIDER_ID \
    --subject-token-type=urn:ietf:params:oauth:token-type:saml2 \
    --credential-source-url=$URL_TO_GET_SAML_ASSERTION \
    --credential-source-headers $HEADER_KEY=$HEADER_VALUE \
    --workforce-pool-user-project=$WORKFORCE_POOL_USER_PROJECT \
    --output-file=/path/to/generated/config.json
```

--------------------------------

### from_file

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/external_account.html

Creates a Credentials instance from an external account JSON file.

```APIDOC
## from_file(filename, **kwargs)

### Description
Creates a Credentials instance from an external account JSON file.

### Parameters
- **filename** (str) - Required - The path to the external account JSON file.
- **kwargs** (dict) - Optional - Additional arguments to pass to the constructor.
```

--------------------------------

### from_info

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/external_account.html

Creates a Credentials instance from a mapping of external account information.

```APIDOC
## from_info(info, **kwargs)

### Description
Creates a Credentials instance from parsed external account info. Note that this method does not validate the credential configuration; ensure the source is trusted.

### Parameters
- **info** (Mapping[str, str]) - Required - The external account info in Google format.
- **kwargs** (dict) - Optional - Additional arguments to pass to the constructor.

### Returns
- **google.auth.identity_pool.Credentials** - The constructed credentials.
```

--------------------------------

### Configure Google Cloud SDK for Application Default Credentials

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/_default.html

Commands to authenticate and set the active project for the Google Cloud SDK.

```bash
gcloud auth application-default login
```

```bash
gcloud config set project
```

--------------------------------

### Prepare request for metadata server

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/compute_engine/_metadata.html

Configures a request object for the metadata server, including mTLS adapter mounting if required.

```python
def _prepare_request_for_mds(request, use_mtls=False) -> None:
    """Prepares a request for the metadata server.

    This will check if mTLS should be used and mount the mTLS adapter if needed.

    Args:
        request (google.auth.transport.Request): A callable used to make
            HTTP requests. If mTLS is enabled, and the request supports sessions,
            the request will have the mTLS adapter mounted. Otherwise, there
            will be no change.
        use_mtls (bool): Whether to use mTLS for the request.


    """
    # Only modify the request if mTLS is enabled, and request supports sessions.
    if use_mtls and hasattr(request, "session"):
        # Ensure the request has a session to mount the adapter to.
        if not request.session:
            request.session = requests.Session()

        adapter = _mtls.MdsMtlsAdapter()
        # Mount the adapter for all default GCE metadata hosts.
        for host in _GCE_DEFAULT_MDS_HOSTS:
            request.session.mount(f"https://{host}/", adapter)
```

--------------------------------

### Create a secure authorized gRPC channel

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/transport/grpc.html

Demonstrates how to initialize a secure gRPC channel using Google credentials and an HTTP request object for token refreshing.

```python
import google.auth
import google.auth.transport.grpc
import google.auth.transport.requests
from google.cloud.speech.v1 import cloud_speech_pb2

# Get credentials.
credentials, _ = google.auth.default()

# Get an HTTP request function to refresh credentials.
request = google.auth.transport.requests.Request()

# Create a channel.
channel = google.auth.transport.grpc.secure_authorized_channel(
    credentials, regular_endpoint, request,
    ssl_credentials=grpc.ssl_channel_credentials())

# Use the channel to create a stub.
cloud_speech.create_Speech_stub(channel)
```

--------------------------------

### Initialize X509 Supplier

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/identity_pool.html

Constructor for the internal X509 workload credential supplier.

```python
def __init__(self, trust_chain_path, leaf_cert_callback):
        self._trust_chain_path = trust_chain_path
        self._leaf_cert_callback = leaf_cert_callback
```

--------------------------------

### Implement a token consumer

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Uses a downscoped token from a broker to initialize a storage client with a refresh handler.

```python
    import google.oauth2

    from google.auth.transport import requests
    from google.cloud import storage

    # Downscoped token retrieved from token broker.
    # The `get_token_from_broker` callable requests a token and an expiry
    # from the token broker.
    downscoped_token, expiry = get_token_from_broker(
        requests.Request(),
        scopes=['https://www.googleapis.com/auth/cloud-platform'])

    # Create the OAuth credentials from the downscoped token and pass a
    # refresh handler to handle token expiration. Passing the original
    # downscoped token or the expiry here is optional, as the refresh_handler
    # will generate the downscoped token on demand.
    credentials = google.oauth2.credentials.Credentials(
        downscoped_token,
        expiry=expiry,
        scopes=['https://www.googleapis.com/auth/cloud-platform'],
        refresh_handler=get_token_from_broker)

    # Initialize a storage client with the oauth2 credentials.
    storage_client = storage.Client(
        project='my_project_id', credentials=credentials)
    # Call GCS APIs.
    # The token broker has readonly access to objects starting with "customer-a"
    # in bucket "bucket-123".
    bucket = storage_client.bucket('bucket-123')
    blob = bucket.blob('customer-a-data.txt')
    print(blob.download_as_bytes().decode("utf-8"))
```

--------------------------------

### Create JWT Credentials with Additional Claims

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/jwt.html

Initializes JWT credentials from a file while specifying custom JWT claims.

```python
credentials = jwt.Credentials.from_service_account_file(
    'service-account.json',
    audience=audience,
    additional_claims={'meta': 'data'})
```

--------------------------------

### Create Credentials from Signer and Info

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/jwt.html

Internal class method to instantiate Credentials using a signer and service account information.

```python
    @classmethod
    def _from_signer_and_info(cls, signer, info, **kwargs):
        """Creates a Credentials instance from a signer and service account
        info.

        Args:
            signer (google.auth.crypt.Signer): The signer used to sign JWTs.
            info (Mapping[str, str]): The service account info.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            google.auth.jwt.Credentials: The constructed credentials.

        Raises:
            google.auth.exceptions.MalformedError: If the info is not in the expected format.
        """
        kwargs.setdefault("subject", info["client_email"])
        kwargs.setdefault("issuer", info["client_email"])
        return cls(signer, **kwargs)
```

--------------------------------

### Create Credentials from File

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/external_account.html

Placeholder for the method that creates a Credentials instance from an external account JSON file.

```python
    @classmethod
    def from_file(cls, filename, **kwargs):
        """Creates a Credentials instance from an external account json file.
```

--------------------------------

### Create Credentials from Info

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/external_account.html

Constructs a Credentials instance from a dictionary of external account information. Validate untrusted input before use to prevent security risks.

```python
    @classmethod
    def from_info(cls, info, **kwargs):
        """Creates a Credentials instance from parsed external account info.

        **IMPORTANT**:
        This method does not validate the credential configuration. A security
        risk occurs when a credential configuration configured with malicious urls
        is used.
        When the credential configuration is accepted from an
        untrusted source, you should validate it before using with this method.
        Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details.

        Args:
            info (Mapping[str, str]): The external account info in Google
                format.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            google.auth.identity_pool.Credentials: The constructed
                credentials.

        Raises:
            InvalidValue: For invalid parameters.
        """
        return cls(
            audience=info.get("audience"),
            subject_token_type=info.get("subject_token_type"),
            token_url=info.get("token_url"),
            token_info_url=info.get("token_info_url"),
            service_account_impersonation_url=info.get(
                "service_account_impersonation_url"
            ),
            service_account_impersonation_options=info.get(
                "service_account_impersonation"
            )
            or {},
            client_id=info.get("client_id"),
            client_secret=info.get("client_secret"),
            credential_source=info.get("credential_source"),
            quota_project_id=info.get("quota_project_id"),
            workforce_pool_user_project=info.get("workforce_pool_user_project"),
            universe_domain=info.get(
                "universe_domain", credentials.DEFAULT_UNIVERSE_DOMAIN
            ),
            trust_boundary=info.get("trust_boundary"),
            **kwargs
        )
```

--------------------------------

### Create AWS Credentials from File

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/aws.html

Constructs an AWS Credentials instance by loading configuration from a specified JSON file.

```python
@classmethod
def from_file(cls, filename, **kwargs):
    """Creates an AWS Credentials instance from an external account json file.

    Args:
        filename (str): The path to the AWS external account json file.
        kwargs: Additional arguments to pass to the constructor.

    Returns:
        google.auth.aws.Credentials: The constructed credentials.
    """
    return super(Credentials, cls).from_file(filename, **kwargs)
```

--------------------------------

### Create credentials from impersonated service account info

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/impersonated_credentials.html

Constructs a Credentials instance from parsed info. Note that this method does not validate the configuration, so untrusted sources should be validated beforehand.

```python
@classmethod
    def from_impersonated_service_account_info(cls, info, scopes=None):
        """Creates a Credentials instance from parsed impersonated service account credentials info.

        **IMPORTANT**:
        This method does not validate the credential configuration. A security
        risk occurs when a credential configuration configured with malicious urls
        is used.
        When the credential configuration is accepted from an
        untrusted source, you should validate it before using with this method.
        Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details.

        Args:
            info (Mapping[str, str]): The impersonated service account credentials info in Google
                format.
            scopes (Sequence[str]): Optional list of scopes to include in the
                credentials.

        Returns:
            google.oauth2.credentials.Credentials: The constructed
                credentials.

        Raises:
            InvalidType: If the info["source_credentials"] are not a supported impersonation type
            InvalidValue: If the info["service_account_impersonation_url"] is not in the expected format.
            ValueError: If the info is not in the expected format.
        """
```

--------------------------------

### Configure Quota Project

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/compute_engine/credentials.html

Returns a new credentials instance configured with the specified quota project ID.

```python
@_helpers.copy_docstring(credentials.CredentialsWithQuotaProject)
def with_quota_project(self, quota_project_id):
    creds = self._make_copy()
    creds._quota_project_id = quota_project_id
    return creds
```

--------------------------------

### Initialize the STS Client

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/sts.html

Instantiate the Client class with the required token exchange endpoint and optional client authentication credentials.

```python
class Client(utils.OAuthClientAuthHandler):
    """Implements the OAuth 2.0 token exchange spec based on
    https://tools.ietf.org/html/rfc8693.
    """

    def __init__(self, token_exchange_endpoint, client_authentication=None):
        """Initializes an STS client instance.

        Args:
            token_exchange_endpoint (str): The token exchange endpoint.
            client_authentication (Optional(google.oauth2.oauth2_utils.ClientAuthentication)):
                The optional OAuth client authentication credentials if available.
        """
        super(Client, self).__init__(client_authentication)
        self._token_exchange_endpoint = token_exchange_endpoint
```

--------------------------------

### Generate SAML file-sourced configuration

Source: https://googleapis.dev/python/google-auth/latest/_sources/user-guide.rst.txt

Creates a configuration file for SAML credentials sourced from a local file.

```bash
# Generate a SAML configuration file for file-sourced credentials.
gcloud iam workforce-pools create-cred-config \
    locations/global/workforcePools/$WORKFORCE_POOL_ID/providers/$PROVIDER_ID \
    --credential-source-file=$PATH_TO_SAML_ASSERTION \
    --subject-token-type=urn:ietf:params:oauth:token-type:saml2 \
    --workforce-pool-user-project=$WORKFORCE_POOL_USER_PROJECT \
    --output-file=/path/to/generated/config.json
```

--------------------------------

### Create Credentials with Quota Project

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/downscoped.html

Returns a new instance of the credentials class with the specified quota project ID.

```python
@_helpers.copy_docstring(credentials.CredentialsWithQuotaProject)
def with_quota_project(self, quota_project_id):
    return self.__class__(
        self._source_credentials,
        self._credential_access_boundary,
        quota_project_id=quota_project_id,
    )
```

--------------------------------

### Load external account credentials from file

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/external_account.html

Reads a JSON configuration file and constructs credentials. Ensure the source file is trusted to prevent security risks from malicious URLs.

```python
with io.open(filename, "r", encoding="utf-8") as json_file:
    data = json.load(json_file)
    return cls.from_info(data, **kwargs)
```

--------------------------------

### Credentials.from_service_account_file

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/oauth2/service_account.html

Creates a Credentials instance from a local service account JSON key file.

```APIDOC
## Credentials.from_service_account_file

### Description
Creates a new Credentials object by reading a service account private key JSON file from the local filesystem.

### Usage
```python
from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file(
    'service-account.json')
```
```

--------------------------------

### Parse source credentials from info dictionary

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/impersonated_credentials.html

Logic for extracting and initializing source credentials from a configuration dictionary based on the credential type.

```python
        source_credentials_info = info.get("source_credentials")
        source_credentials_type = source_credentials_info.get("type")
        if source_credentials_type == _SOURCE_CREDENTIAL_AUTHORIZED_USER_TYPE:
            from google.oauth2 import credentials

            source_credentials = credentials.Credentials.from_authorized_user_info(
                source_credentials_info
            )
        elif source_credentials_type == _SOURCE_CREDENTIAL_SERVICE_ACCOUNT_TYPE:
            from google.oauth2 import service_account

            source_credentials = service_account.Credentials.from_service_account_info(
                source_credentials_info
            )
        elif (
            source_credentials_type
            == _SOURCE_CREDENTIAL_EXTERNAL_ACCOUNT_AUTHORIZED_USER_TYPE
        ):
            from google.auth import external_account_authorized_user

            source_credentials = external_account_authorized_user.Credentials.from_info(
                source_credentials_info
            )
        else:
            raise exceptions.InvalidType(
                "source credential of type {} is not supported.".format(
                    source_credentials_type
                )
            )

        impersonation_url = info.get("service_account_impersonation_url")
        start_index = impersonation_url.rfind("/")
        end_index = impersonation_url.find(":generateAccessToken")
        if start_index == -1 or end_index == -1 or start_index > end_index:
            raise exceptions.InvalidValue(
                "Cannot extract target principal from {}".format(impersonation_url)
            )
        target_principal = impersonation_url[start_index + 1 : end_index]
        delegates = info.get("delegates")
        quota_project_id = info.get("quota_project_id")
        scopes = scopes or info.get("scopes")
        trust_boundary = info.get("trust_boundary")

        return cls(
            source_credentials,
            target_principal,
            scopes,
            delegates,
            quota_project_id=quota_project_id,
            trust_boundary=trust_boundary,
        )
```

--------------------------------

### Create Credentials from Service Account File

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/jwt.html

Factory method to create a Credentials instance from a JSON service account file.

```python
    @classmethod
    def from_service_account_file(cls, filename, **kwargs):
        """Creates a Credentials instance from a service account .json file
        in Google format.

        Args:
            filename (str): The path to the service account .json file.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            google.auth.jwt.Credentials: The constructed credentials.
        """
        info, signer = _service_account_info.from_filename(
            filename, require=["client_email"]
        )
        return cls._from_signer_and_info(signer, info, **kwargs)
```

--------------------------------

### Create Credentials from Service Account Info

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/jwt.html

Factory method to create a Credentials instance from a dictionary containing service account information.

```python
    @classmethod
    def from_service_account_info(cls, info, **kwargs):
        """Creates an Credentials instance from a dictionary.

        Args:
            info (Mapping[str, str]): The service account info in Google
                format.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            google.auth.jwt.Credentials: The constructed credentials.

        Raises:
            google.auth.exceptions.MalformedError: If the info is not in the expected format.
        """
        signer = _service_account_info.from_dict(info, require=["client_email"])
        return cls._from_signer_and_info(signer, info, **kwargs)
```

--------------------------------

### google.auth.downscoped.Credentials.__init__

Source: https://googleapis.dev/python/google-auth/latest/_modules/google/auth/downscoped.html

Initializes a new Credentials instance for downscoping.

```APIDOC
## Credentials(source_credentials, credential_access_boundary, quota_project_id=None, universe_domain=None)

### Description
Initializes the Credentials object with source credentials and a Credential Access Boundary.

### Parameters
- **source_credentials** (google.auth.credentials.Credentials) - Required - The source credentials to be downscoped.
- **credential_access_boundary** (google.auth.downscoped.CredentialAccessBoundary) - Required - The rules defining the access boundary.
- **quota_project_id** (str) - Optional - The quota project ID.
- **universe_domain** (str) - Optional - The universe domain (default: googleapis.com).
```
Tokens:
Raw