Console
    Start free

    Package com.google.auth.oauth2 (1.46.0)

    GitHub Repository

    Classes

    Class Description
    com. google. auth. oauth2. Access Token Represents a temporary OAuth2 access token and its expiration information.
    com. google. auth. oauth2. Access Token. Builder
    com. google. auth. oauth2. Aws Credential Source The AWS credential source. Stores data required to retrieve the AWS credential.
    com. google. auth. oauth2. Aws Credentials Credentials representing an AWS third-party identity for calling Google APIs. AWS security credentials are either sourced by calling EC2 metadata endpoints, environment variables, or a user provided supplier method.
    com. google. auth. oauth2. Aws Credentials. Builder
    com. google. auth. oauth2. Aws Security Credentials Defines AWS security credentials. These are either retrieved from the AWS security_credentials endpoint or AWS environment variables.
    com. google. auth. oauth2. Certificate Identity Pool Subject Token Supplier Provider for retrieving the subject tokens for IdentityPoolCredentials by reading an X.509 certificate from the filesystem. The certificate file (e.g., PEM or DER encoded) is read, the leaf certificate is base64-encoded (DER format), wrapped in a JSON array, and used as the subject token for STS exchange.
    com. google. auth. oauth2. Client Id An OAuth2 user authorization Client ID and associated information.

    Corresponds to the information in the json file downloadable for a Client ID.
    com. google. auth. oauth2. Client Id. Builder
    com. google. auth. oauth2. Cloud Shell Credentials OAuth2 credentials representing the built-in service account for Google Cloud Shell.
    com. google. auth. oauth2. Cloud Shell Credentials. Builder
    com. google. auth. oauth2. Compute Engine Credentials OAuth2 credentials representing the built-in service account for a Google Compute Engine VM.

    Fetches access tokens from the Google Compute Engine metadata server.
    com. google. auth. oauth2. Compute Engine Credentials. Builder
    com. google. auth. oauth2. Credential Access Boundary Defines an upper bound of permissions available for a GCP credential via AccessBoundaryRule s.

    See for more information.

    com. google. auth. oauth2. Credential Access Boundary. Access Boundary Rule Defines an upper bound of permissions on a particular resource.

    The following snippet shows an AccessBoundaryRule that applies to the Cloud Storage bucket bucket-one to set the upper bound of permissions to those defined by the
    com. google. auth. oauth2. Credential Access Boundary. Access Boundary Rule. Availability Condition An optional condition that can be used as part of a AccessBoundaryRule to further restrict permissions.

    For example, you can define an AvailabilityCondition that applies to a set of Cloud
    com. google. auth. oauth2. Credential Access Boundary. Access Boundary Rule. Availability Condition. Builder
    com. google. auth. oauth2. Credential Access Boundary. Access Boundary Rule. Builder
    com. google. auth. oauth2. Credential Access Boundary. Builder
    com. google. auth. oauth2. DefaultPKCE Provider Implements PKCE using only the Java standard library. See https://www.rfc-editor.org/rfc/rfc7636 .

    https://developers.google.com/identity/protocols/oauth2/native-app#step1-code-verifier .
    com. google. auth. oauth2. Downscoped Credentials DownscopedCredentials enables the ability to downscope, or restrict, the Identity and Access Management (IAM) permissions that a short-lived credential can use for Cloud Storage.

    This class provides a server-side approach for generating downscoped tokens, suitable for
    com. google. auth. oauth2. Downscoped Credentials. Builder
    com. google. auth. oauth2. External Account Authorized User Credentials OAuth2 credentials sourced using external identities through Workforce Identity Federation.

    Obtaining the initial access and refresh token can be done through the Google Cloud CLI.
    com. google. auth. oauth2. External Account Authorized User Credentials. Builder Builder for ExternalAccountAuthorizedUserCredentials .
    com. google. auth. oauth2. External Account Credentials Base external account credentials class.

    Handles initializing external credentials, calls to the Security Token Service, and service account impersonation.
    com. google. auth. oauth2. External Account Credentials. Builder Base builder for external account credentials.
    com. google. auth. oauth2. External Account Supplier Context Context object to pass relevant variables from external account credentials to suppliers. This will be passed on any call made to IdentityPoolSubjectTokenSupplier or AwsSecurityCredentialsSupplier .
    com. google. auth. oauth2. Gdch Credentials
    com. google. auth. oauth2. Gdch Credentials. Builder
    com. google. auth. oauth2. Google Auth Utils This public class provides shared utilities for common OAuth2 utils or ADC. It also exposes convenience methods such as a getter for well-known Application Default Credentials file path
    com. google. auth. oauth2. Google Credentials Base type for credentials for authorizing calls to Google APIs using OAuth2.
    com. google. auth. oauth2. Google Credentials. Builder
    com. google. auth. oauth2. Id Token Represents a temporary IdToken and its JsonWebSignature object
    com. google. auth. oauth2. Id Token Credentials IdTokenCredentials provides a Google Issued OpenIdConnect token.
    Use an ID token to access services that require presenting an ID token for authentication such as Cloud Functions or Cloud Run.
    The following Credential subclasses support IDTokens: ServiceAccountCredentials,
    com. google. auth. oauth2. Id Token Credentials. Builder
    com. google. auth. oauth2. Identity Pool Credential Source The IdentityPool credential source. Dictates the retrieval method of the external credential, which can either be through a metadata server or a local file.
    com. google. auth. oauth2. Identity Pool Credential Source. Certificate Config Represents the configuration options for X.509-based workload credentials (mTLS). It specifies how to locate and use the client certificate, private key, and optional trust chain for mutual TLS authentication.
    com. google. auth. oauth2. Identity Pool Credentials Url-sourced, file-sourced, or user provided supplier method-sourced external account credentials.

    By default, attempts to exchange the external credential for a GCP access token.
    com. google. auth. oauth2. Identity Pool Credentials. Builder
    com. google. auth. oauth2. Impersonated Credentials ImpersonatedCredentials allowing credentials issued to a user or service account to impersonate another. The source project using ImpersonatedCredentials must enable the "IAMCredentials" API. Also, the target service account must grant the originating principal the "Service Account Token Creator" IAM role.
    com. google. auth. oauth2. Impersonated Credentials. Builder
    com. google. auth. oauth2. Jwt Claims Value class representing the set of fields used as the payload of a JWT token.

    To create and customize claims, use the builder:
    com. google. auth. oauth2. Jwt Claims. Builder
    com. google. auth. oauth2. Jwt Credentials Credentials class for calling Google APIs using a JWT with custom claims.

    Uses a JSON Web Token (JWT) directly in the request metadata to provide authorization.
    com. google. auth. oauth2. Jwt Credentials. Builder
    com. google. auth. oauth2. Memory Tokens Storage Represents an in-memory storage of tokens.
    com. google. auth. oauth2.O Auth2 Credentials Base type for Credentials using OAuth2.
    com. google. auth. oauth2.O Auth2 Credentials. Builder
    com. google. auth. oauth2.O Auth2 Credentials With Refresh A refreshable alternative to OAuth2Credentials .

    To enable automatic token refreshes, you must provide an OAuth2RefreshHandler .
    com. google. auth. oauth2.O Auth2 Credentials With Refresh. Builder
    com. google. auth. oauth2.O Auth2 Utils Internal utilities for the com.google.auth.oauth2 namespace.

    These classes are marked public but should be treated effectively as internal classes only. They are not subject to any backwards compatibility guarantees and might change or be removed at
    com. google. auth. oauth2. Pluggable Auth Credential Source Encapsulates the credential source portion of the configuration for PluggableAuthCredentials.

    Command is the only required field. If timeout_millis is not specified, the library will default to a 30 second timeout.
    com. google. auth. oauth2. Pluggable Auth Credentials PluggableAuthCredentials enables the exchange of workload identity pool external credentials for Google access tokens by retrieving 3rd party tokens through a user supplied executable. These scripts/executables are completely independent of the Google Cloud Auth libraries. These credentials plug into ADC and will call the specified executable to retrieve the 3rd party token
    com. google. auth. oauth2. Pluggable Auth Credentials. Builder
    com. google. auth. oauth2. Secure Session Agent Utilities to fetch the S2A (Secure Session Agent) address from the mTLS configuration.

    mTLS configuration is queried from the MDS MTLS Autoconfiguration endpoint. See https://google.aip.dev/auth/4115 for details.
    com. google. auth. oauth2. Secure Session Agent. Builder
    com. google. auth. oauth2. Secure Session Agent Config Holds an mTLS configuration (consists of address of S2A) retrieved from the Metadata Server.
    com. google. auth. oauth2. Secure Session Agent Config. Builder
    com. google. auth. oauth2. Service Account Credentials OAuth2 credentials representing a Service Account for calling Google APIs.

    By default uses a JSON Web Token (JWT) to fetch access tokens.
    com. google. auth. oauth2. Service Account Credentials. Builder
    com. google. auth. oauth2. Service Account Jwt Access Credentials Service Account credentials for calling Google APIs using a JWT directly for access.

    Uses a JSON Web Token (JWT) directly in the request metadata to provide authorization.
    com. google. auth. oauth2. Service Account Jwt Access Credentials. Builder
    com. google. auth. oauth2. Sts Request Handler Implements the OAuth 2.0 token exchange based on RFC 8693 .

    This class handles the process of exchanging one type of token for another using the Security Token Service (STS). It constructs and sends the token exchange request to the STS endpoint and
    com. google. auth. oauth2. Sts Request Handler. Builder
    com. google. auth. oauth2. Sts Token Exchange Request Represents an OAuth 2.0 token exchange request, as defined in RFC 8693, Section 2.1 .

    This class encapsulates the parameters necessary for making a token exchange request to Google Security Token Service (STS). It includes the subject token, subject token type, optional
    com. google. auth. oauth2. Sts Token Exchange Request. Builder
    com. google. auth. oauth2. Sts Token Exchange Response Represents a successful OAuth 2.0 token exchange response from the Google Security Token Service (STS), as defined in RFC 8693, Section 2.2.1 .
    com. google. auth. oauth2. Sts Token Exchange Response. Builder
    com. google. auth. oauth2. System Environment Provider Represents the default system environment provider.

    For internal use only.
    com. google. auth. oauth2. System Property Provider Represents the default system property provider.

    For internal use only.
    com. google. auth. oauth2. Token Verifier Handle verification of Google-signed JWT tokens.
    com. google. auth. oauth2. Token Verifier. Builder
    com. google. auth. oauth2. User Authorizer Handles an interactive 3-Legged-OAuth2 (3LO) user consent authorization.
    com. google. auth. oauth2. User Authorizer. Builder
    com. google. auth. oauth2. User Authorizer. Token Response With Config Represents the response from an OAuth token exchange, including configuration details used to initiate the flow.

    This response can be used to initialize the following credentials types:
    com. google. auth. oauth2. User Credentials OAuth2 Credentials representing a user's identity and consent.
    com. google. auth. oauth2. User Credentials. Builder

    Interfaces

    Interface Description
    com. google. auth. oauth2. Aws Security Credentials Supplier Supplier for retrieving AWS Security credentials for AwsCredentials to exchange for GCP access tokens.
    com. google. auth. oauth2. Environment Provider Interface for an environment provider.

    For internal use only.
    com. google. auth. oauth2. Id Token Provider Interface for an Google OIDC token provider. This type represents a google issued OIDC token.
    com. google. auth. oauth2. Identity Pool Subject Token Supplier
    com. google. auth. oauth2. Jwt Provider Interface for creating custom JWT tokens
    com. google. auth. oauth2.O Auth2 Credentials. Credentials Changed Listener Listener for changes to credentials.

    This is called when token content changes, such as when the access token is refreshed. This is typically used by code caching the access token.
    com. google. auth. oauth2.O Auth2 Credentials With Refresh.O Auth2 Refresh Handler Interface for the refresh handler.
    com. google. auth. oauth2.PKCE Provider
    com. google. auth. oauth2. Property Provider Interface for a system property provider.

    For internal use only.
    com. google. auth. oauth2. Quota Project Id Provider Interface for GoogleCredentials that return a quota project ID.
    com. google. auth. oauth2. Token Store Interface for long term storage of tokens

    Enums

    Enum Description
    com. google. auth. oauth2. Compute Engine Credentials. Binding Enforcement Experimental Feature.

    BindingEnforcement specifies how binding info in tokens will be enforced.
    com. google. auth. oauth2. Compute Engine Credentials. Google Auth Transport Experimental Feature.

    GoogleAuthTransport specifies how to authenticate to Google APIs.
    com. google. auth. oauth2. External Account Credentials. Subject Token Types Enum specifying values for the subjectTokenType field in ExternalAccountCredentials .
    com. google. auth. oauth2. Id Token Provider. Option Enum of various credential-specific options to apply to the token.

    ComputeEngineCredentials

    com. google. auth. oauth2. User Authorizer. Client Authentication Type Represents the client authentication types as specified in RFC 7591.

    For more details, see RFC 7591 .

    Exceptions

    Exception Description
    com. google. auth. oauth2. Token Verifier. Verification Exception Custom exception for wrapping all verification errors.
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: