Fetches the auth tokens from the GCE metadata host if it is available.
If $httpHandler is not specified a the default HttpHandler is used.
Parameters
Name
Description
httpHandler
callable|null
callback which delivers psr7 request
headers
array
[optional] Headers to be inserted
into the token endpoint request present.
Returns
Type
Description
array
{
A set of auth related metadata, based on the token type.
@type string $access_token for access tokens
@type int $expires_in for access tokens
@type string $token_type for access tokens
@type string $id_token for ID tokens
}
getCacheKey
Returns the Cache Key for the credential token.
The format for the cache key is:
TokenURI
Returns
Type
Description
string
getLastReceivedToken
Returns an associative array with the token and
expiration time.
Returns
Type
Description
array|null
getClientName
Get the client name from GCE metadata.
Subsequent calls will return a cached value.
Parameter
Name
Description
httpHandler
callable|null
callback which delivers psr7 request
Returns
Type
Description
string
getProjectId
Fetch the default Project ID from compute engine.
Returns null if called outside GCE.
Parameter
Name
Description
httpHandler
callable|null
Callback which delivers psr7 request
Returns
Type
Description
string|null
getUniverseDomain
Fetch the default universe domain from the metadata server.
Parameter
Name
Description
httpHandler
callable|null
Callback which delivers psr7 request
Returns
Type
Description
string
getQuotaProject
Get the quota project used for this API request
Returns
Type
Description
string|null
setIsOnGce
Set whether or not we've already checked the GCE environment.
Parameter
Name
Description
isOnGce
bool
Returns
Type
Description
void
static::getTokenUri
The full uri for accessing the default token.
Parameter
Name
Description
serviceAccountIdentity
string
[optional] Specify a service
account identity name to use instead of "default".
Returns
Type
Description
string
static::getClientNameUri
The full uri for accessing the default service account.
Parameter
Name
Description
serviceAccountIdentity
string
[optional] Specify a service
account identity name to use instead of "default".
Returns
Type
Description
string
static::onAppEngineFlexible
Determines if this an App Engine Flexible instance, by accessing the
GAE_INSTANCE environment variable.
Returns
Type
Description
bool
true if this an App Engine Flexible Instance, false otherwise
static::onGce
Determines if this a GCE instance, by accessing the expected metadata
host.
If $httpHandler is not specified a the default HttpHandler is used.
Parameter
Name
Description
httpHandler
callable|null
callback which delivers psr7 request
Returns
Type
Description
bool
True if this a GCEInstance, false otherwise
Constants
cacheKey
Value: 'GOOGLE_AUTH_PHP_GCE'
METADATA_IP
Value: '169.254.169.254'
The metadata IP address on appengine instances.
The IP is used instead of the domain 'metadata' to avoid slow responses
when not on Compute Engine.
Note: the explicittimeoutandtriesbelow is a workaround. The underlying
issue is that resolving an unknown host on some networks will take
20-30 seconds; making this timeout short fixes the issue, but
could lead to false negatives in the event that we are on GCE, but
the metadata resolution was particularly slow. The latter case is
"unlikely" since the expected 4-nines time is about 0.5 seconds.
This allows us to limit the total ping maximum timeout to 1.5 seconds
for developer desktop scenarios.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,["# Google Auth Library Client - Class GCECredentials (1.47.1)\n\nVersion latestkeyboard_arrow_down\n\n- [1.47.1 (latest)](/php/docs/reference/auth/latest/Credentials.GCECredentials)\n- [1.47.0](/php/docs/reference/auth/1.47.0/Credentials.GCECredentials)\n- [1.46.0](/php/docs/reference/auth/1.46.0/Credentials.GCECredentials)\n- [1.45.2](/php/docs/reference/auth/1.45.2/Credentials.GCECredentials) \nReference documentation and code samples for the Google Auth Library Client class GCECredentials.\n\nGCECredentials supports authorization on Google Compute Engine.\n\nIt can be used to authorize requests using the AuthTokenMiddleware, but will\nonly succeed if being run on GCE:\n\nuse Google\\\\Auth\\\\Credentials\\\\GCECredentials;\nuse Google\\\\Auth\\\\Middleware\\\\AuthTokenMiddleware;\nuse GuzzleHttp\\\\Client;\nuse GuzzleHttp\\\\HandlerStack;\n\n$gce = new GCECredentials();\n$middleware = new AuthTokenMiddleware($gce);\n$stack = HandlerStack::create();\n$stack-\\\u003epush($middleware);\n\n$client = new Client(\\[\n'handler' =\\\u003e $stack,\n'base_uri' =\\\u003e '\u003chttps://www.googleapis.com/taskqueue/v1beta2/projects/\u003e',\n'auth' =\\\u003e 'google_auth'\n\\]);\n\n$res = $client-\\\u003eget('myproject/taskqueues/myqueue');\n\nNamespace\n---------\n\nGoogle \\\\ Auth \\\\ Credentials\n\nMethods\n-------\n\n### __construct\n\n### fetchAuthToken\n\nImplements FetchAuthTokenInterface#fetchAuthToken.\n\nFetches the auth tokens from the GCE metadata host if it is available.\nIf $httpHandler is not specified a the default HttpHandler is used.\n\n### getCacheKey\n\nReturns the Cache Key for the credential token.\n\nThe format for the cache key is:\nTokenURI\n\n### getLastReceivedToken\n\nReturns an associative array with the token and\nexpiration time.\n\n### getClientName\n\nGet the client name from GCE metadata.\n\nSubsequent calls will return a cached value.\n\n### getProjectId\n\nFetch the default Project ID from compute engine.\n\nReturns null if called outside GCE.\n\n### getUniverseDomain\n\nFetch the default universe domain from the metadata server.\n\n### getQuotaProject\n\nGet the quota project used for this API request\n\n### setIsOnGce\n\nSet whether or not we've already checked the GCE environment.\n\n### static::getTokenUri\n\nThe full uri for accessing the default token.\n\n### static::getClientNameUri\n\nThe full uri for accessing the default service account.\n\n### static::onAppEngineFlexible\n\nDetermines if this an App Engine Flexible instance, by accessing the\nGAE_INSTANCE environment variable.\n\n### static::onGce\n\nDetermines if this a GCE instance, by accessing the expected metadata\nhost.\n\nIf $httpHandler is not specified a the default HttpHandler is used.\n\nConstants\n---------\n\n### cacheKey\n\n Value: 'GOOGLE_AUTH_PHP_GCE'\n\n### METADATA_IP\n\n Value: '169.254.169.254'\n\nThe metadata IP address on appengine instances.\n\nThe IP is used instead of the domain 'metadata' to avoid slow responses\nwhen not on Compute Engine.\n\n### TOKEN_URI_PATH\n\n Value: 'v1/instance/service-accounts/default/token'\n\nThe metadata path of the default token.\n\n### ID_TOKEN_URI_PATH\n\n Value: 'v1/instance/service-accounts/default/identity'\n\nThe metadata path of the default id token.\n\n### CLIENT_ID_URI_PATH\n\n Value: 'v1/instance/service-accounts/default/email'\n\nThe metadata path of the client ID.\n\n### PROJECT_ID_URI_PATH\n\n Value: 'v1/project/project-id'\n\nThe metadata path of the project ID.\n\n### UNIVERSE_DOMAIN_URI_PATH\n\n Value: 'v1/universe/universe-domain'\n\nThe metadata path of the project ID.\n\n### FLAVOR_HEADER\n\n Value: 'Metadata-Flavor'\n\nThe header whose presence indicates GCE presence.\n\n### MAX_COMPUTE_PING_TRIES\n\n Value: 3\n\nNote: the explicit `timeout` and `tries` below is a workaround. The underlying\nissue is that resolving an unknown host on some networks will take\n20-30 seconds; making this timeout short fixes the issue, but\ncould lead to false negatives in the event that we are on GCE, but\nthe metadata resolution was particularly slow. The latter case is\n\"unlikely\" since the expected 4-nines time is about 0.5 seconds.\n\nThis allows us to limit the total ping maximum timeout to 1.5 seconds\nfor developer desktop scenarios.\n\n### COMPUTE_PING_CONNECTION_TIMEOUT_S\n\n Value: 0.5"]]
