Class ComputeEngineCredentials (1.24.1) 

publicclass ComputeEngineCredentialsextendsGoogleCredentialsimplementsServiceAccountSigner,IdTokenProvider

OAuth2 credentials representing the built-in service account for a Google Compute Engine VM.

Fetches access tokens from the Google Compute Engine metadata server.

These credentials use the IAM API to sign data. See #sign(byte[]) for more details.

Inheritance

Object > Credentials > OAuth2Credentials > GoogleCredentials > ComputeEngineCredentials

Inherited Members

Static Methods

create()

publicstaticComputeEngineCredentialscreate()

Create a new ComputeEngineCredentials instance with default behavior.

Returns
Type Description
ComputeEngineCredentials

new ComputeEngineCredentials

getIdentityDocumentUrl()

publicstaticStringgetIdentityDocumentUrl()
Returns
Type Description
String

getMetadataServerUrl()

publicstaticStringgetMetadataServerUrl()
Returns
Type Description
String

getMetadataServerUrl(DefaultCredentialsProvider provider)

publicstaticStringgetMetadataServerUrl(DefaultCredentialsProviderprovider)
Parameter
Name Description
provider com.google.auth.oauth2.DefaultCredentialsProvider
Returns
Type Description
String

getServiceAccountsUrl()

publicstaticStringgetServiceAccountsUrl()
Returns
Type Description
String

getTokenServerEncodedUrl()

publicstaticStringgetTokenServerEncodedUrl()
Returns
Type Description
String

getTokenServerEncodedUrl(DefaultCredentialsProvider provider)

publicstaticStringgetTokenServerEncodedUrl(DefaultCredentialsProviderprovider)
Parameter
Name Description
provider com.google.auth.oauth2.DefaultCredentialsProvider
Returns
Type Description
String

getUniverseDomainUrl()

publicstaticStringgetUniverseDomainUrl()
Returns
Type Description
String

newBuilder()

publicstaticComputeEngineCredentials.BuildernewBuilder()
Returns
Type Description
ComputeEngineCredentials.Builder

Methods

createScoped(Collection<String> newScopes)

publicGoogleCredentialscreateScoped(Collection<String>newScopes)

Clones the compute engine account with the specified scopes.

Parameter
Name Description
newScopes Collection<String>
Returns
Type Description
GoogleCredentials
Overrides

createScoped(Collection<String> newScopes, Collection<String> newDefaultScopes)

publicGoogleCredentialscreateScoped(Collection<String>newScopes,Collection<String>newDefaultScopes)

Clones the compute engine account with the specified scopes and default scopes.

Parameters
Name Description
newScopes Collection<String>
newDefaultScopes Collection<String>
Returns
Type Description
GoogleCredentials
Overrides

equals(Object obj)

publicbooleanequals(Objectobj)
Parameter
Name Description
obj Object
Returns
Type Description
boolean
Overrides

getAccount()

publicStringgetAccount()

Returns the email address associated with the GCE default service account.

Returns
Type Description
String

getScopes()

publicfinalCollection<String>getScopes()
Returns
Type Description
Collection<String>

getUniverseDomain()

publicStringgetUniverseDomain()

Gets the universe domain from the GCE metadata server.

Returns an explicit universe domain if it was provided during credential initialization.

Returns the Credentials#GOOGLE_DEFAULT_UNIVERSE if universe domain endpoint is not found (404) or returns an empty string.

Otherwise, returns universe domain from GCE metadata service.

Any above value is cached for the credential lifetime.

Returns
Type Description
String

string representing a universe domain in the format some-domain.xyz
Overrides
Exceptions
Type Description
IOException

if a call to GCE metadata service was unsuccessful. Check if exception implements the Retryable and isRetryable() will return true if the operation may be retried.

hashCode()

publicinthashCode()
Returns
Type Description
int
Overrides

idTokenWithAudience(String targetAudience, List<IdTokenProvider.Option> options)

publicIdTokenidTokenWithAudience(StringtargetAudience,List<IdTokenProvider.Option>options)

Returns a Google ID Token from the metadata server on ComputeEngine

Parameters
Name Description
targetAudience String

the aud: field the IdToken should include
options List<Option>

list of Credential specific options for the token. For example, an IDToken for a ComputeEngineCredential could have the full formatted claims returned if IdTokenProvider.Option.FORMAT_FULL) is provided as a list option. Valid option values are:
IdTokenProvider.Option.FORMAT_FULL
IdTokenProvider.Option.LICENSES_TRUE
If no options are set, the defaults are "&format=standard&licenses=false"
Returns
Type Description
IdToken

IdToken object which includes the raw id_token, JsonWebSignature
Exceptions
Type Description
IOException

if the attempt to get an IdToken failed

refreshAccessToken()

publicAccessTokenrefreshAccessToken()

Refresh the access token by getting it from the GCE metadata server

Returns
Type Description
AccessToken
Overrides
Exceptions
Type Description
IOException

sign(byte[] toSign)

publicbyte[]sign(byte[]toSign)

Signs the provided bytes using the private key associated with the service account.

The Compute Engine's project must enable the Identity and Access Management (IAM) API and the instance's service account must have the iam.serviceAccounts.signBlob permission. See Also: Blob Signing

Parameter
Name Description
toSign byte[]

bytes to sign
Returns
Type Description
byte[]

signed bytes

toBuilder()

publicComputeEngineCredentials.BuildertoBuilder()
Returns
Type Description
ComputeEngineCredentials.Builder
Overrides

toStringHelper()

protectedMoreObjects.ToStringHelpertoStringHelper()

A helper for overriding the toString() method. This allows inheritance of super class fields. Extending classes can override this implementation and call super implementation and add more fields. Same cannot be done with overriding the toString() directly.

Returns
Type Description
com.google.common.base.MoreObjects.ToStringHelper
Overrides

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025年10月30日 UTC.