nebius.aio.token.service_account

module documentation
(source)

Use a service account for asynchronous authentication.

ServiceAccountBearer combines internal bearers. It exchanges service account credentials for access tokens, renews tokens, and supplies a stable diagnostic name.

Construct the bearer from one of these inputs:

  • A reader that supplies a service account.
  • A service-account object.
  • A service-account ID with private_key and public_key_id.

Examples

Constructing from an environment/CLI-backed reader (recommended):

>>> from nebius.aio.token.service_account import ServiceAccountBearer
>>> from nebius.base.service_account.pk_file import Reader as PKReader
>>> bearer = ServiceAccountBearer(PKReader("/path/to/private_key.pem"))

Constructing from explicit values (private key object required):

>>> from cryptography.hazmat.primitives.serialization import load_pem_private_key
>>> from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
>>> with open("/path/to/private_key.pem","rb") as fh:
...     key = load_pem_private_key(fh.read(), password=None)
>>> bearer = ServiceAccountBearer(
...     "service-account-id",
...     private_key=key,  # type: RSAPrivateKey
...     public_key_id="public-key-id",
... )

The resulting bearer exposes the receiver method used by the SDK's authentication layer. See nebius.aio.token.token for the receiver and token abstractions.

Class ServiceAccountBearer Bearer that obtains tokens using a service account.