Class FederatedCredentialsBearer

Exchanges an external identity credential for renewable Nebius access tokens.

A string input is a credential file path, not a credential value. The file is read again for each exchange. When you supply a reader, also supply the target serviceAccountId.

Example: Use a rotating workload credential file

import { SDK } from '@nebius/js-sdk';
import { FederatedCredentialsBearer } from '@nebius/js-sdk/runtime/token/federated_credentials';

// A prebuilt bearer needs a separate SDK for its unauthenticated exchange RPC.
const exchangeSdk = new SDK({
  userAgentPrefix: 'example-application/1.0',
});
const credentials = new FederatedCredentialsBearer(
  '/var/run/secrets/nebius/credential',
  {
    sdk: exchangeSdk,
    serviceAccountId: 'serviceaccount-e00example',
  },
);
const sdk = new SDK({
  credentials,
  userAgentPrefix: 'example-application/1.0',
});

try {
  // Use sdk clients here.
} finally {
  await sdk.close();
  await exchangeSdk.close();
}

Close the SDK during shutdown to stop background renewal.

Hierarchy (View Summary)

Bearer
- FederatedCredentialsBearer

Indexable

[key: symbol]: () => unknown

Exchanges an external identity credential for renewable Nebius access tokens.

A string input is a credential file path, not a credential value. The file is read again for each exchange. When you supply a reader, also supply the target serviceAccountId.
- - (): unknown
  - Returns a JSON-safe value for logs.
    
    Returns unknown

Index

Constructors

constructor

new FederatedCredentialsBearer(
    federatedCredentials:
        | string
        | FederatedCredentialsReader
        | FederatedCredentialsTokenRequester,
    opts?: {
        initialRetryTimeoutMs?: number;
        lifetimeSafeFraction?: number;
        logger?: Logger;
        maxRetries?: number;
        maxRetryTimeoutMs?: number;
        metrics?: AuthMetricsInput;
        refreshRequestTimeoutMs?: number;
        retryTimeoutExponent?: number;
        sdk?: SDKInterface | Promise<SDKInterface> | null;
        serviceAccountId?: string | null;
    },
): FederatedCredentialsBearer
Creates a renewable federated-credentials flow.

Pass a FederatedCredentialsTokenRequester when you already assembled the exchange request source. Pass a FederatedCredentialsReader with serviceAccountId to let this class assemble it.
Parameters
- federatedCredentials: string | FederatedCredentialsReader | FederatedCredentialsTokenRequester
- Optionalopts: {
      initialRetryTimeoutMs?: number;
      lifetimeSafeFraction?: number;
      logger?: Logger;
      maxRetries?: number;
      maxRetryTimeoutMs?: number;
      metrics?: AuthMetricsInput;
      refreshRequestTimeoutMs?: number;
      retryTimeoutExponent?: number;
      sdk?: SDKInterface | Promise<SDKInterface> | null;
      serviceAccountId?: string | null;
  }
  - OptionalinitialRetryTimeoutMs?: number
    
    Initial renewal backoff, in milliseconds.
  - OptionallifetimeSafeFraction?: number
    
    Fraction of token lifetime to wait before proactive renewal.
  - Optionallogger?: Logger
    
    Optional destination for diagnostic events.
  - OptionalmaxRetries?: number
    
    Maximum total authentication attempts for one receiver. Defaults to 2.
  - OptionalmaxRetryTimeoutMs?: number
    
    Maximum renewal backoff, in milliseconds.
  - Optionalmetrics?: AuthMetricsInput
    
    Optional authentication metrics destination.
  - OptionalrefreshRequestTimeoutMs?: number
    
    Default token-exchange request budget, in milliseconds.
    
    It applies to foreground and background renewal when the caller does not supply a synchronous override.
  - OptionalretryTimeoutExponent?: number
    
    Multiplier for exponential renewal backoff.
  - Optionalsdk?: SDKInterface | Promise<SDKInterface> | null
    
    SDK used for the token-exchange RPC.
    
    A prebuilt bearer must receive this SDK explicitly.
  - OptionalserviceAccountId?: string | null
    
    Target service-account ID. Required when the input is a credential reader.
Returns FederatedCredentialsBearer
Overrides Bearer.constructor
- Defined in src/runtime/token/federated_credentials.ts:75

Properties

`Readonly`$type

$type: "nebius.sdk.FederatedCredentialsBearer" = 'nebius.sdk.FederatedCredentialsBearer'

Contains the fully qualified runtime type name.

Accessors

metricProvider

get metricProvider(): string
Returns the provider name for authorization metrics.

Returns string
Inherited from Bearer.metricProvider
- Defined in src/runtime/token.ts:211

name

get name(): string | undefined
Returns the stable credential name used by file-backed token caches.

Most bearers do not have a name. Wrappers can add one with NamedBearer.

Returns string | undefined
Inherited from Bearer.name
- Defined in src/runtime/token.ts:201

wrapped

get wrapped(): Bearer | undefined
Returns the wrapped bearer.

Returns Bearer | undefined
Overrides Bearer.wrapped
- Defined in src/runtime/token/federated_credentials.ts:206

Methods

[customJson]

"[customJson]"(): unknown
Returns a JSON-safe value for logs.

Returns unknown
- Defined in src/runtime/token/federated_credentials.ts:186

close

close(graceMs?: number): Promise<void>
Stops owned background work and closes the wrapped bearer.
Parameters
- OptionalgraceMs: number
Returns Promise<void>
Inherited from Bearer.close
- Defined in src/runtime/token.ts:218

receiver

receiver(): Receiver
Creates a token receiver.

Returns Receiver
Overrides Bearer.receiver
- Defined in src/runtime/token/federated_credentials.ts:211

setMetrics

setMetrics(metrics: AuthMetricsInput): void
Sets the metrics.
Parameters
- metrics: AuthMetricsInput
Returns void
- Defined in src/runtime/token/federated_credentials.ts:199

setSDK

setSDK(sdk: SDKInterface | Promise<SDKInterface> | null): void
Sets or clears the SDK used for token exchange.
Parameters
- sdk: SDKInterface | Promise<SDKInterface> | null
Returns void
- Defined in src/runtime/token/federated_credentials.ts:194

Class FederatedCredentialsBearer

Example: Use a rotating workload credential file

Hierarchy (View Summary)

Indexable

Returns unknown

Index

Constructors

Properties

Accessors

Methods

Constructors

constructor

Parameters

OptionalinitialRetryTimeoutMs?: number

OptionallifetimeSafeFraction?: number

Optionallogger?: Logger

OptionalmaxRetries?: number

OptionalmaxRetryTimeoutMs?: number

Optionalmetrics?: AuthMetricsInput

OptionalrefreshRequestTimeoutMs?: number

OptionalretryTimeoutExponent?: number

Optionalsdk?: SDKInterface | Promise<SDKInterface> | null

OptionalserviceAccountId?: string | null

Returns FederatedCredentialsBearer

Properties

Readonly$type

Accessors

metricProvider

Returns string

name

Returns string | undefined

wrapped

Returns Bearer | undefined

Methods

[customJson]

Returns unknown

close

Parameters

Returns Promise<void>

receiver

Returns Receiver

setMetrics

Parameters

Returns void

setSDK

Parameters

Returns void

Settings

On This Page

`Optional`initialRetryTimeoutMs?: number

`Optional`lifetimeSafeFraction?: number

`Optional`logger?: Logger

`Optional`maxRetries?: number

`Optional`maxRetryTimeoutMs?: number

`Optional`metrics?: AuthMetricsInput

`Optional`refreshRequestTimeoutMs?: number

`Optional`retryTimeoutExponent?: number

`Optional`sdk?: SDKInterface | Promise<SDKInterface> | null

`Optional`serviceAccountId?: string | null

`Readonly`$type