PHPFUI/InstaDoc
 
Copied!

IMPORTANT: This class does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used.

When the credential configuration is accepted from an untrusted source, you should validate it before creating this class.

  • see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials
CloneableInstantiable
Constants
public Google\Auth\UpdateMetadataInterface::AUTH_METADATA_KEY = 'authorization'
public Google\Auth\GetUniverseDomainInterface::DEFAULT_UNIVERSE_DOMAIN = 'googleapis.com'
public Google\Auth\GetQuotaProjectInterface::X_GOOG_USER_PROJECT_HEADER = 'X-Goog-User-Project'
Methods
public __construct( $scope, array $jsonKey)
 
  • param string|string[] $scope The scope of the access request, expressed either as an array or as a space-delimited string.
  • param array $jsonKey JSON credentials as an associative array.
public fetchAuthToken(?callable $httpHandler = NULL, array $headers = [])
 
  • param callable|null $httpHandler
  • param array $headers [optional] Metrics headers to be inserted into the token endpoint request present.
  • return array { A set of auth related metadata, containing the following 
    @type string $access_token
@type int $expires_at (impersonated service accounts only)
@type int $expires_in (identity pool only)
@type string $issued_token_type (identity pool only)
@type string $token_type (identity pool only)
    }
public getCacheKey() : ?string
 

Get the cache token key for the credentials.

The cache token key format depends on the type of source The format for the cache key one of the following: FetcherCacheKey.Scope.[ServiceAccount].[TokenType].[WorkforcePoolUserProject] FetcherCacheKey.Audience.[ServiceAccount].[TokenType].[WorkforcePoolUserProject]

  • @return
public getLastReceivedToken()
public getProjectId(?callable $httpHandler = NULL, ?string $accessToken = NULL)
 

Get the project ID.

  • param callable|null $httpHandler Callback which delivers psr7 request
  • param string|null $accessToken The access token to use to sign the blob. If provided, saves a call to the metadata server for a new access token. Defaults to null.
  • return string|null
public getQuotaProject()
 

Get the quota project used for this API request

  • return string|null
public getUniverseDomain() : string
 

Get the universe domain used for this API request

  • return string
public getUpdateMetadataFunc()
 

export a callback function which updates runtime metadata.

  • return callable updateMetadata function
  • deprecated
public updateMetadata( $metadata, $authUri = NULL, ?callable $httpHandler = NULL)
 

Updates metadata with the authorization token.

  • param array $metadata metadata hashmap
  • param string $authUri optional auth uri
  • param callable|null $httpHandler callback which delivers psr7 request
  • return array updated metadata hashmap
Properties
protected static $metricMetadataKey = 'x-goog-api-client'
 
  • var string The header key for the observability metrics.
Methods
protected applyServiceApiUsageMetrics( $metadata)
 
  • param array $metadata The metadata to update and return.
  • return array The updated metadata.
protected applyTokenEndpointMetrics( $metadata, $authRequestType)
 
  • param array $metadata The metadata to update and return.
  • param string $authRequestType The auth request type. Possible values are 'at', 'it', 'mds'.
  • return array The updated metadata.
protected getCredType() : string
protected static getMetricsHeader( $credType = '', $authRequestType = '') : string
 
  • param string $credType [Optional] The credential type. Empty value will not add any credential type to the header. Should be one of 'sa', 'jwt', 'imp', 'mds', 'u'.
  • param string $authRequestType [Optional] The auth request type. Empty value will not add any auth request type to the header. Should be one of 'at', 'it', 'mds'.
  • return string The header value for the observability metrics.
protected static getVersion() : string
Constants
private Google\Auth\Credentials\ExternalAccountCredentials::CLOUD_RESOURCE_MANAGER_URL = 'https://cloudresourcemanager.UNIVERSE_DOMAIN/v1/projects/%s'
private Google\Auth\Credentials\ExternalAccountCredentials::EXTERNAL_ACCOUNT_TYPE = 'external_account'
Properties
private Google\Auth\OAuth2 $auth
private ?array $lastImpersonatedAccessToken
 
  • var array
private ?string $projectId
private ?string $quotaProject
private ?string $serviceAccountImpersonationUrl
private string $universeDomain
private static $version = NULL
 
  • var string The version of the auth library php.
private ?string $workforcePoolUserProject
Methods
private static buildCredentialSource(array $jsonKey) : Google\Auth\ExternalAccountCredentialSourceInterface
 
  • param array $jsonKey
private getImpersonatedAccessToken(string $stsToken, ?callable $httpHandler = NULL) : array
 
  • param string $stsToken
  • param callable|null $httpHandler
  • return array { A set of auth related metadata, containing the following 
    @type string $access_token
@type int $expires_at
    }
private getProjectNumber() : ?string
private isWorkforcePool() : bool
Properties
protected static $metricMetadataKey = 'x-goog-api-client'
 
  • var string The header key for the observability metrics.
private static $version = NULL
 
  • var string The version of the auth library php.
Methods
private static buildCredentialSource(array $jsonKey) : Google\Auth\ExternalAccountCredentialSourceInterface
 
  • param array $jsonKey
protected static getMetricsHeader( $credType = '', $authRequestType = '') : string
 
  • param string $credType [Optional] The credential type. Empty value will not add any credential type to the header. Should be one of 'sa', 'jwt', 'imp', 'mds', 'u'.
  • param string $authRequestType [Optional] The auth request type. Empty value will not add any auth request type to the header. Should be one of 'at', 'it', 'mds'.
  • return string The header value for the observability metrics.
protected static getVersion() : string
© 2025 Bruce Wells
Search Namespaces \ Classes
Configuration