Creates signed JWT assertions for service-account token exchange.
This object does not call the token service. Use it with ServiceAccountBearer, which exchanges the short-lived assertion and renews the resulting access token.
Creates signed JWT assertions for service-account token exchange.
This object does not call the token service. Use it with ServiceAccountBearer, which exchanges the short-lived assertion and renews the resulting access token.
Returns a JSON-safe value for logs.
Creates service-account signing credentials.
Signing parses and validates the private key. The public-key and service-account IDs are sent as supplied, so the remote service can reject missing or invalid IDs.
PEM-encoded RSA private key. Treat this value as a secret.
ID of the public key registered for the service account.
ID of the service account that owns the key.
Optionallogger: Logger
Optional destination for diagnostic events.
Optional ReadonlyloggerOptional destination for diagnostic events.
ReadonlyprivatePEM-encoded RSA private key. Treat this value as a secret.
ReadonlypublicID of the public key registered for the service account.
ReadonlyserviceID of the service account that owns the key.
Returns a JSON-safe value for logs.
Creates a token-exchange request with a newly signed, one-minute JWT.
The request contains a secret assertion. Send it directly to the token exchange service and do not log or persist it.
Creates signed JWT assertions for service-account token exchange.
This object does not call the token service. Use it with ServiceAccountBearer, which exchanges the short-lived assertion and renews the resulting access token.
Example: Create credentials from an in-memory private key