Class FederationAccountBearer

Provides cached, renewable credentials for an interactive federation account.

On the first login, the bearer opens a browser unless noBrowserOpen is true. It writes the authorization URL with writer, waits for the local callback, and stores the access token in the shared credentials file. Later processes can reuse the cached token for the same profile.

This flow is intended for people at a workstation. Use a service account or workload federation for unattended applications.

Example

import { SDK } from '@nebius/js-sdk';
import { FederationAccountBearer } from '@nebius/js-sdk/runtime/token/federation_account';

const credentials = new FederationAccountBearer(
  'developer',
  'client-id',
  'https://auth.example',
  'federation-id',
);
const sdk = new SDK({
  credentials,
  userAgentPrefix: 'example-application/1.0',
});

Hierarchy (View Summary)

Bearer
- FederationAccountBearer

Indexable

[key: symbol]: () => unknown

Provides cached, renewable credentials for an interactive federation account.

On the first login, the bearer opens a browser unless noBrowserOpen is true. It writes the authorization URL with writer, waits for the local callback, and stores the access token in the shared credentials file. Later processes can reuse the cached token for the same profile.

This flow is intended for people at a workstation. Use a service account or workload federation for unattended applications.
- - (): unknown
  - Returns a JSON-safe value for logs.
    
    Returns unknown

Index

Constructors

constructor

new FederationAccountBearer(
    profileName: string,
    clientId: string,
    federationEndpoint: string,
    federationId: string,
    opts?: {
        ca?: string | string[] | Buffer<ArrayBufferLike>;
        cacheFilePath?: string;
        fileCacheThrottleMs?: number;
        initialRetryTimeoutMs?: number;
        initialSafetyMarginMs?: number | null;
        lifetimeSafeFraction?: number;
        logger?: Logger;
        maxRetries?: number;
        maxRetryTimeoutMs?: number;
        metrics?: AuthMetricsInput;
        noBrowserOpen?: boolean;
        retrySafetyMarginMs?: number;
        retryTimeoutExponent?: number;
        timeoutMs?: number;
        writer?: (s: string) => void;
    },
): FederationAccountBearer
Creates an interactive federation flow for profileName.

timeoutMs limits the wait for the browser callback. It does not limit the following token HTTP request. cacheFilePath selects the shared token cache. Close the SDK to stop renewal timers.
Parameters
- profileName: string
- clientId: string
- federationEndpoint: string
- federationId: string
- Optionalopts: {
      ca?: string | string[] | Buffer<ArrayBufferLike>;
      cacheFilePath?: string;
      fileCacheThrottleMs?: number;
      initialRetryTimeoutMs?: number;
      initialSafetyMarginMs?: number | null;
      lifetimeSafeFraction?: number;
      logger?: Logger;
      maxRetries?: number;
      maxRetryTimeoutMs?: number;
      metrics?: AuthMetricsInput;
      noBrowserOpen?: boolean;
      retrySafetyMarginMs?: number;
      retryTimeoutExponent?: number;
      timeoutMs?: number;
      writer?: (s: string) => void;
  }
  - Optionalca?: string | string[] | Buffer<ArrayBufferLike>
    
    Extra trusted CA certificates. This bearer currently forwards only a Buffer value.
  - OptionalcacheFilePath?: string
    
    Custom shared credentials-file path.
  - OptionalfileCacheThrottleMs?: number
    
    Minimum interval between cache-file reads. Defaults to five minutes.
  - OptionalinitialRetryTimeoutMs?: number
    
    Initial renewal backoff. Defaults to one second.
  - OptionalinitialSafetyMarginMs?: number | null
    
    Extra lifetime required for the first cached token.
    
    Defaults to two hours. null also selects this default. Valid cache hits keep the margin for later fetches. A fetch clears it only after it proceeds into the renewal path.
  - OptionallifetimeSafeFraction?: number
    
    Fraction of remaining lifetime to wait before renewal.
    
    The default 0.9 renews with about 10% of the lifetime left.
  - Optionallogger?: Logger
    
    Optional destination for diagnostic events.
  - OptionalmaxRetries?: number
    
    Maximum total authentication attempts for one receiver. Defaults to 2.
  - OptionalmaxRetryTimeoutMs?: number
    
    Maximum renewal backoff. Defaults to 60 seconds.
  - Optionalmetrics?: AuthMetricsInput
    
    Optional authentication metrics destination.
  - OptionalnoBrowserOpen?: boolean
    
    Prevents automatic browser launch when true.
  - OptionalretrySafetyMarginMs?: number
    
    Reserved for compatibility. The JavaScript implementation does not use this value.
  - OptionalretryTimeoutExponent?: number
    
    Multiplier for exponential renewal backoff. Defaults to 1.5.
  - OptionaltimeoutMs?: number
    
    Timeout for the browser callback, in milliseconds.
    
    This value does not limit the following token HTTP request.
  - Optionalwriter?: (s: string) => void
    
    Receives the authorization URL. The default writer uses console.log.
Returns FederationAccountBearer
Overrides Bearer.constructor
- Defined in src/runtime/token/federation_account.ts:55

Properties

`Readonly`$type

$type: "nebius.sdk.FederationAccountBearer" = 'nebius.sdk.FederationAccountBearer'

Contains the fully qualified runtime type name.

Accessors

metricProvider

get metricProvider(): string
Returns the provider name for authorization metrics.

Returns string
Inherited from Bearer.metricProvider
- Defined in src/runtime/token.ts:211

name

get name(): string | undefined
Returns the stable credential name used by file-backed token caches.

Most bearers do not have a name. Wrappers can add one with NamedBearer.

Returns string | undefined
Inherited from Bearer.name
- Defined in src/runtime/token.ts:201

wrapped

get wrapped(): Bearer | undefined
Returns the wrapped bearer.

Returns Bearer | undefined
Overrides Bearer.wrapped
- Defined in src/runtime/token/federation_account.ts:152

Methods

[customJson]

"[customJson]"(): unknown
Returns a JSON-safe value for logs.

Returns unknown
- Defined in src/runtime/token/federation_account.ts:144

close

close(graceMs?: number): Promise<void>
Stops owned background work and closes the wrapped bearer.
Parameters
- OptionalgraceMs: number
Returns Promise<void>
Inherited from Bearer.close
- Defined in src/runtime/token.ts:218

receiver

receiver(): Receiver
Creates a token receiver.

Returns Receiver
Overrides Bearer.receiver
- Defined in src/runtime/token/federation_account.ts:163

setMetrics

setMetrics(metrics: AuthMetricsInput): void
Sets the metrics.
Parameters
- metrics: AuthMetricsInput
Returns void
- Defined in src/runtime/token/federation_account.ts:157

Class FederationAccountBearer

Example

Hierarchy (View Summary)

Indexable

Returns unknown

Index

Constructors

Properties

Accessors

Methods

Constructors

constructor

Parameters

Optionalca?: string | string[] | Buffer<ArrayBufferLike>

OptionalcacheFilePath?: string

OptionalfileCacheThrottleMs?: number

OptionalinitialRetryTimeoutMs?: number

OptionalinitialSafetyMarginMs?: number | null

OptionallifetimeSafeFraction?: number

Optionallogger?: Logger

OptionalmaxRetries?: number

OptionalmaxRetryTimeoutMs?: number

Optionalmetrics?: AuthMetricsInput

OptionalnoBrowserOpen?: boolean

OptionalretrySafetyMarginMs?: number

OptionalretryTimeoutExponent?: number

OptionaltimeoutMs?: number

Optionalwriter?: (s: string) => void

Returns FederationAccountBearer

Properties

Readonly$type

Accessors

metricProvider

Returns string

name

Returns string | undefined

wrapped

Returns Bearer | undefined

Methods

[customJson]

Returns unknown

close

Parameters

Returns Promise<void>

receiver

Returns Receiver

setMetrics

Parameters

Returns void

Settings

On This Page

`Optional`ca?: string | string[] | Buffer<ArrayBufferLike>

`Optional`cacheFilePath?: string

`Optional`fileCacheThrottleMs?: number

`Optional`initialRetryTimeoutMs?: number

`Optional`initialSafetyMarginMs?: number | null

`Optional`lifetimeSafeFraction?: number

`Optional`logger?: Logger

`Optional`maxRetries?: number

`Optional`maxRetryTimeoutMs?: number

`Optional`metrics?: AuthMetricsInput

`Optional`noBrowserOpen?: boolean

`Optional`retrySafetyMarginMs?: number

`Optional`retryTimeoutExponent?: number

`Optional`timeoutMs?: number

`Optional`writer?: (s: string) => void

`Readonly`$type