Overview ▹

Overview ▾

Package google provides support for making OAuth2 authorized and authenticated HTTP requests to Google APIs. It supports the Web server flow, client-side credentials, service accounts, Google Compute Engine service accounts, Google App Engine service accounts and workload identity federation from non-Google cloud platforms.

A brief overview of the package follows. For more information, please read https://developers.google.com/accounts/docs/OAuth2 and https://developers.google.com/accounts/docs/application-default-credentials. For more information on using workload identity federation, refer to https://cloud.google.com/iam/docs/how-to#using-workload-identity-federation.

OAuth2 Configs

Two functions in this package return golang.org/x/oauth2.Config values from Google credential data. Google supports two JSON formats for OAuth2 credentials: one is handled by ConfigFromJSON, the other by JWTConfigFromJSON. The returned Config can be used to obtain a TokenSource or create an http.Client.

Workload and Workforce Identity Federation

For information on how to use Workload and Workforce Identity Federation, see golang.org/x/oauth2/google/externalaccount.

Credentials

The Credentials type represents Google credentials, including Application Default Credentials.

Use FindDefaultCredentials to obtain Application Default Credentials. FindDefaultCredentials looks in some well-known places for a credentials file, and will call AppEngineTokenSource or ComputeTokenSource as needed.

Application Default Credentials also support workload identity federation to access Google Cloud resources from non-Google Cloud platforms including Amazon Web Services (AWS), Microsoft Azure or any identity provider that supports OpenID Connect (OIDC). Workload identity federation is recommended for non-Google Cloud environments as it avoids the need to download, manage and store service account private keys locally.

DefaultClient and DefaultTokenSource are convenience methods. They first call FindDefaultCredentials, then use the credentials to construct an http.Client or an oauth2.TokenSource.

Use CredentialsFromJSON to obtain credentials from either of the two JSON formats described in OAuth2 Configs, above. The TokenSource in the returned value is the same as the one obtained from the oauth2.Config returned from ConfigFromJSON or JWTConfigFromJSON, but the Credentials may contain additional information that is useful is some circumstances.

▹ Example (ServiceAccount)

▾ Example (ServiceAccount)

Code:

// Your credentials should be obtained from the Google
// Developer Console (https://console.developers.google.com).
conf := &jwt.Config{
    Email: "xxx@developer.gserviceaccount.com",
    // The contents of your RSA private key or your PEM file
    // that contains a private key.
    // If you have a p12 file instead, you
    // can use `openssl` to export the private key into a pem file.
    //
    //    $ openssl pkcs12 -in key.p12 -passin pass:notasecret -out key.pem -nodes
    //
    // The field only supports PEM containers with no passphrase.
    // The openssl command will convert p12 keys to passphrase-less PEM containers.
    PrivateKey: []byte("-----BEGIN RSA PRIVATE KEY-----..."),
    Scopes: []string{
        "https://www.googleapis.com/auth/bigquery",
        "https://www.googleapis.com/auth/blogger",
    },
    TokenURL: google.JWTTokenURL,
    // If you would like to impersonate a user, you can
    // create a transport with a subject. The following GET
    // request will be made on the behalf of user@example.com.
    // Optional.
    Subject: "user@example.com",
}
// Initiate an http.Client, the following GET request will be
// authorized and authenticated on the behalf of user@example.com.
client := conf.Client(oauth2.NoContext)
client.Get("...")

▹ Example (WebServer)

▾ Example (WebServer)

Code:

// Your credentials should be obtained from the Google
// Developer Console (https://console.developers.google.com).
conf := &oauth2.Config{
    ClientID:     "YOUR_CLIENT_ID",
    ClientSecret: "YOUR_CLIENT_SECRET",
    RedirectURL:  "YOUR_REDIRECT_URL",
    Scopes: []string{
        "https://www.googleapis.com/auth/bigquery",
        "https://www.googleapis.com/auth/blogger",
    },
    Endpoint: google.Endpoint,
}
// Redirect user to Google's consent page to ask for permission
// for the scopes specified above.
url := conf.AuthCodeURL("state")
fmt.Printf("Visit the URL for the auth dialog: %v", url)

// Handle the exchange code to initiate a transport.
tok, err := conf.Exchange(oauth2.NoContext, "authorization-code")
if err != nil {
    log.Fatal(err)
}
client := conf.Client(oauth2.NoContext, tok)
client.Get("...")

Name	Synopsis
..
downscope	Package downscope implements the ability to downscope, or restrict, the Identity and Access Management permissions that a short-lived Token can use.
externalaccount	Package externalaccount provides support for creating workload identity federation and workforce identity federation token sources that can be used to access Google Cloud resources from external identity providers.

Package google

Overview ▹

Overview ▾

OAuth2 Configs

Workload and Workforce Identity Federation

Credentials

Index ▹

Index ▾

Examples

Package files

Constants

Variables

func AppEngineTokenSource ¶

func ComputeTokenSource ¶

func ConfigFromJSON ¶

func DefaultClient ¶

func DefaultTokenSource ¶

func JWTAccessTokenSourceFromJSON ¶

func JWTAccessTokenSourceWithScope ¶

func JWTConfigFromJSON ¶

type AuthenticationError ¶

func (*AuthenticationError) Error ¶

func (*AuthenticationError) Temporary ¶

func (*AuthenticationError) Unwrap ¶

type Credentials ¶

func CredentialsFromJSON ¶

func CredentialsFromJSONWithParams ¶

func FindDefaultCredentials ¶

func FindDefaultCredentialsWithParams ¶

func (*Credentials) GetUniverseDomain ¶

func (*Credentials) UniverseDomain ¶

type CredentialsParams ¶

type DefaultCredentials ¶

type SDKConfig ¶

func NewSDKConfig ¶

func (*SDKConfig) Client ¶

func (*SDKConfig) Scopes ¶

func (*SDKConfig) TokenSource ¶

Subdirectories