Class ServiceAccountBearer

Provides automatically renewed access tokens for a service account.

This is the main service-account credential for the SDK. It signs a short-lived assertion, exchanges it for an access token, keeps the access token in memory, and renews it before expiration.

Example: Use separate service-account fields

import { SDK } from '@nebius/js-sdk';

// Raw service-account values let SDK create and connect the exchange flow.
const sdk = new SDK({
  credentials: {
    serviceAccountId: process.env.NEBIUS_SERVICE_ACCOUNT_ID ?? '',
    privateKeyPem: process.env.NEBIUS_PRIVATE_KEY_PEM ?? '',
    publicKeyId: process.env.NEBIUS_PUBLIC_KEY_ID ?? '',
  },
  userAgentPrefix: 'example-application/1.0',
});

Close the SDK during shutdown. This stops the renewal timer.

Hierarchy (View Summary)

Bearer
- ServiceAccountBearer

Indexable

[key: symbol]: () => unknown

Provides automatically renewed access tokens for a service account.

This is the main service-account credential for the SDK. It signs a short-lived assertion, exchanges it for an access token, keeps the access token in memory, and renews it before expiration.
- - (): unknown
  - Returns a JSON-safe value for logs.
    
    Returns unknown

Index

Constructors

constructor

new ServiceAccountBearer(
    serviceAccount: string | ServiceAccount | Reader,
    opts?: {
        initialRetryTimeoutMs?: number;
        lifetimeSafeFraction?: number;
        logger?: Logger;
        maxRetries?: number;
        maxRetryTimeoutMs?: number;
        metrics?: AuthMetricsInput;
        privateKeyPem?: string;
        publicKeyId?: string;
        refreshRequestTimeoutMs?: number;
        retryTimeoutExponent?: number;
        sdk?: SDKInterface | Promise<SDKInterface> | null;
    },
): ServiceAccountBearer
Creates renewable service-account credentials.

serviceAccount can be a reader, a complete ServiceAccount, or a service account ID. When it is an ID, privateKeyPem and publicKeyId are required. Do not supply these two options for the other input forms.
Parameters
- serviceAccount: string | ServiceAccount | Reader
- Optionalopts: {
      initialRetryTimeoutMs?: number;
      lifetimeSafeFraction?: number;
      logger?: Logger;
      maxRetries?: number;
      maxRetryTimeoutMs?: number;
      metrics?: AuthMetricsInput;
      privateKeyPem?: string;
      publicKeyId?: string;
      refreshRequestTimeoutMs?: number;
      retryTimeoutExponent?: number;
      sdk?: SDKInterface | Promise<SDKInterface> | null;
  }
  - OptionalinitialRetryTimeoutMs?: number
    
    Initial renewal backoff, in milliseconds.
  - OptionallifetimeSafeFraction?: number
    
    Fraction of token lifetime to wait before proactive renewal.
  - Optionallogger?: Logger
    
    Optional destination for diagnostic events.
  - OptionalmaxRetries?: number
    
    Maximum total authentication attempts for one receiver. Defaults to 2.
  - OptionalmaxRetryTimeoutMs?: number
    
    Maximum renewal backoff, in milliseconds.
  - Optionalmetrics?: AuthMetricsInput
    
    Optional authentication metrics destination.
  - OptionalprivateKeyPem?: string
    
    PEM private key. Required only when serviceAccount is an ID string.
  - OptionalpublicKeyId?: string
    
    Registered public-key ID. Required only when serviceAccount is an ID string.
  - OptionalrefreshRequestTimeoutMs?: number
    
    Default token-exchange request budget, in milliseconds.
    
    It applies to foreground and background renewal when the caller does not supply a synchronous override.
  - OptionalretryTimeoutExponent?: number
    
    Multiplier for exponential renewal backoff.
  - Optionalsdk?: SDKInterface | Promise<SDKInterface> | null
    
    SDK used for the token-exchange RPC.
    
    Required for a prebuilt bearer. As an easier alternative, pass raw service-account values to new SDK({ credentials: ... }).
Returns ServiceAccountBearer
Overrides Bearer.constructor
- Defined in src/runtime/token/service_account.ts:60

Properties

`Readonly`$type

$type: "nebius.sdk.ServiceAccountBearer" = 'nebius.sdk.ServiceAccountBearer'

Contains the fully qualified runtime type name.

Accessors

metricProvider

get metricProvider(): string
Returns the provider name for authorization metrics.

Returns string
Inherited from Bearer.metricProvider
- Defined in src/runtime/token.ts:211

name

get name(): string | undefined
Returns the stable credential name used by file-backed token caches.

Most bearers do not have a name. Wrappers can add one with NamedBearer.

Returns string | undefined
Inherited from Bearer.name
- Defined in src/runtime/token.ts:201

wrapped

get wrapped(): Bearer | undefined
Returns the wrapped bearer.

Returns Bearer | undefined
Overrides Bearer.wrapped
- Defined in src/runtime/token/service_account.ts:194

Methods

[customJson]

"[customJson]"(): unknown
Returns a JSON-safe value for logs.

Returns unknown
- Defined in src/runtime/token/service_account.ts:174

close

close(graceMs?: number): Promise<void>
Stops owned background work and closes the wrapped bearer.
Parameters
- OptionalgraceMs: number
Returns Promise<void>
Inherited from Bearer.close
- Defined in src/runtime/token.ts:218

receiver

receiver(): Receiver
Creates a receiver that shares this bearer’s renewal state.

The bearer must have the exchange SDK supplied in its constructor options before the first token exchange. An SDK does not connect a prebuilt bearer.

Returns Receiver
Overrides Bearer.receiver
- Defined in src/runtime/token/service_account.ts:204

setMetrics

setMetrics(metrics: AuthMetricsInput): void
Sets the metrics.
Parameters
- metrics: AuthMetricsInput
Returns void
- Defined in src/runtime/token/service_account.ts:187

setSDK

setSDK(sdk: SDKInterface | Promise<SDKInterface> | null): void
Sets or clears the SDK used for token exchange.
Parameters
- sdk: SDKInterface | Promise<SDKInterface> | null
Returns void
- Defined in src/runtime/token/service_account.ts:182

Class ServiceAccountBearer

Example: Use separate service-account fields

Hierarchy (View Summary)

Indexable

Returns unknown

Index

Constructors

Properties

Accessors

Methods

Constructors

constructor

Parameters

OptionalinitialRetryTimeoutMs?: number

OptionallifetimeSafeFraction?: number

Optionallogger?: Logger

OptionalmaxRetries?: number

OptionalmaxRetryTimeoutMs?: number

Optionalmetrics?: AuthMetricsInput

OptionalprivateKeyPem?: string

OptionalpublicKeyId?: string

OptionalrefreshRequestTimeoutMs?: number

OptionalretryTimeoutExponent?: number

Optionalsdk?: SDKInterface | Promise<SDKInterface> | null

Returns ServiceAccountBearer

Properties

Readonly$type

Accessors

metricProvider

Returns string

name

Returns string | undefined

wrapped

Returns Bearer | undefined

Methods

[customJson]

Returns unknown

close

Parameters

Returns Promise<void>

receiver

Returns Receiver

setMetrics

Parameters

Returns void

setSDK

Parameters

Returns void

Settings

On This Page

`Optional`initialRetryTimeoutMs?: number

`Optional`lifetimeSafeFraction?: number

`Optional`logger?: Logger

`Optional`maxRetries?: number

`Optional`maxRetryTimeoutMs?: number

`Optional`metrics?: AuthMetricsInput

`Optional`privateKeyPem?: string

`Optional`publicKeyId?: string

`Optional`refreshRequestTimeoutMs?: number

`Optional`retryTimeoutExponent?: number

`Optional`sdk?: SDKInterface | Promise<SDKInterface> | null

`Readonly`$type