1. class
  2. Google
  3. \
  4. Auth
  5. \
  6. Credentials
  7. \
  8. UserRefreshCredentials

UserRefreshCredentials

class UserRefreshCredentials extends CredentialsLoader implements GetQuotaProjectInterface (View source)

Authenticates requests using User Refresh credentials.

This class allows authorizing requests from user refresh tokens.

This the end of the result of a 3LO flow. E.g, the end result of 'gcloud auth login' saves a file with these contents in well known location

Traits

UpdateMetadataTrait

Provides shared methods for updating request metadata (request headers).

MetricsTrait

Trait containing helper methods required for enabling observability metrics in the library.

Constants

TOKEN_CREDENTIAL_URI

ENV_VAR

QUOTA_PROJECT_ENV_VAR

WELL_KNOWN_PATH

NON_WINDOWS_WELL_KNOWN_PATH_BASE

MTLS_WELL_KNOWN_PATH

MTLS_CERT_ENV_VAR

private CRED_TYPE

Used in observability metric headers

Properties

static protected string $metricMetadataKey from  MetricsTrait
protected OAuth2 $auth

The OAuth2 instance used to conduct authorization.
protected string $quotaProject

The quota project associated with the JSON credentials

Methods

static string
getMetricsHeader(string $credType = '', string $authRequestType = '')

No description

from  MetricsTrait
array
applyServiceApiUsageMetrics(array $metadata)

No description

from  MetricsTrait
array
applyTokenEndpointMetrics(array $metadata, string $authRequestType)

No description

from  MetricsTrait
static string
getVersion()

No description

from  MetricsTrait
string
getCredType()

No description

callable
getUpdateMetadataFunc() deprecated

export a callback function which updates runtime metadata.

from  UpdateMetadataTrait
array
updateMetadata(array $metadata, string $authUri = null, callable|null $httpHandler = null)

Updates metadata with the authorization token.

from  UpdateMetadataTrait
static array|null
fromEnv()

Load a JSON key from the path specified in the environment.

from  CredentialsLoader
static array|null
fromWellKnownFile()

Load a JSON key from a well known path.

from  CredentialsLoader
static ServiceAccountCredentials|UserRefreshCredentials|ImpersonatedServiceAccountCredentials|ExternalAccountCredentials
makeCredentials(string|string[] $scope, array $jsonKey, string|string[] $defaultScope = null)

Create a new Credentials instance.

from  CredentialsLoader
static Client
makeHttpClient(FetchAuthTokenInterface $fetcher, array $httpClientOptions = [], callable|null $httpHandler = null, callable|null $tokenCallback = null)

Create an authorized HTTP Client from an instance of FetchAuthTokenInterface.

from  CredentialsLoader
static InsecureCredentials
makeInsecureCredentials()

Create a new instance of InsecureCredentials.

from  CredentialsLoader
static string|null
quotaProjectFromEnv()

Fetch a quota project from the environment variable GOOGLE_CLOUD_QUOTA_PROJECT. Return null if GOOGLE_CLOUD_QUOTA_PROJECT is not specified.

from  CredentialsLoader
static callable|null
getDefaultClientCertSource()

Gets a callable which returns the default device certification.

from  CredentialsLoader
static bool
shouldLoadClientCertSource()

Determines whether or not the default device certificate should be loaded.

from  CredentialsLoader
string
getUniverseDomain()

Get the universe domain from the credential. Defaults to "googleapis.com" for all credential types which do not support universe domain.

from  CredentialsLoader
__construct(string|string[]|null $scope, string|array $jsonKey, string|null $targetAudience = null)

Create a new UserRefreshCredentials.

array
fetchAuthToken(callable|null $httpHandler = null, array $headers = [])

No description

string
getCacheKey()

Return the Cache Key for the credentials.

null|array
getLastReceivedToken()

No description

string|null
getQuotaProject()

Get the quota project used for this API request

string|null
getGrantedScope()

Get the granted scopes (if they exist) for the last fetched token.

Details

in MetricsTrait at line 47
static protected string getMetricsHeader(string $credType = '', string $authRequestType = '')

No description

Parameters

string $credType

[Optional] The credential type. Empty value will not add any credential type to the header. Should be one of 'sa', 'jwt', 'imp', 'mds', 'u'.
string $authRequestType

[Optional] The auth request type. Empty value will not add any auth request type to the header. Should be one of 'at', 'it', 'mds'.

Return Value

string

The header value for the observability metrics.

in MetricsTrait at line 72
protected array applyServiceApiUsageMetrics(array $metadata)

No description

Parameters

array $metadata

The metadata to update and return.

Return Value

array

The updated metadata.

in MetricsTrait at line 98
protected array applyTokenEndpointMetrics(array $metadata, string $authRequestType)

No description

Parameters

array $metadata

The metadata to update and return.
string $authRequestType

The auth request type. Possible values are 'at', 'it', 'mds'.

Return Value

array

The updated metadata.

in MetricsTrait at line 107
static protected string getVersion()

No description

Return Value

string

at line 198
protected string getCredType()

No description

Return Value

string

in UpdateMetadataTrait at line 37
callable getUpdateMetadataFunc() deprecated

deprecated

export a callback function which updates runtime metadata.

Return Value

callable

updateMetadata function

in UpdateMetadataTrait at line 50
array updateMetadata(array $metadata, string $authUri = null, callable|null $httpHandler = null)

Updates metadata with the authorization token.

Parameters

array $metadata

metadata hashmap
string $authUri

optional auth uri
callable|null $httpHandler

callback which delivers psr7 request

Return Value

array

updated metadata hashmap

in CredentialsLoader at line 77
static array|null fromEnv()

Load a JSON key from the path specified in the environment.

Load a JSON key from the path specified in the environment variable GOOGLE_APPLICATION_CREDENTIALS. Return null if GOOGLE_APPLICATION_CREDENTIALS is not specified.

Return Value

array|null

JSON key | null

in CredentialsLoader at line 104
static array|null fromWellKnownFile()

Load a JSON key from a well known path.

The well known path is OS dependent:

  • windows: %APPDATA%/gcloud/application_default_credentials.json
  • others: $HOME/.config/gcloud/application_default_credentials.json

If the file does not exist, this returns null.

Return Value

array|null

JSON key | null

in CredentialsLoader at line 132
static ServiceAccountCredentials|UserRefreshCredentials|ImpersonatedServiceAccountCredentials|ExternalAccountCredentials makeCredentials(string|string[] $scope, array $jsonKey, string|string[] $defaultScope = null)

Create a new Credentials instance.

Parameters

string|string[] $scope

the scope of the access request, expressed either as an Array or as a space-delimited String.
array $jsonKey

the JSON credentials.
string|string[] $defaultScope

The default scope to use if no user-defined scopes exist, expressed either as an Array or as a space-delimited string.

Return Value

ServiceAccountCredentials|UserRefreshCredentials|ImpersonatedServiceAccountCredentials|ExternalAccountCredentials

in CredentialsLoader at line 173
static Client makeHttpClient(FetchAuthTokenInterface $fetcher, array $httpClientOptions = [], callable|null $httpHandler = null, callable|null $tokenCallback = null)

Create an authorized HTTP Client from an instance of FetchAuthTokenInterface.

Parameters

FetchAuthTokenInterface $fetcher

is used to fetch the auth token
array $httpClientOptions

(optional) Array of request options to apply.
callable|null $httpHandler

(optional) http client to fetch the token.
callable|null $tokenCallback

(optional) function to be called when a new token is fetched.

Return Value

Client

in CredentialsLoader at line 198
static InsecureCredentials makeInsecureCredentials()

Create a new instance of InsecureCredentials.

Return Value

InsecureCredentials

in CredentialsLoader at line 210
static string|null quotaProjectFromEnv()

Fetch a quota project from the environment variable GOOGLE_CLOUD_QUOTA_PROJECT. Return null if GOOGLE_CLOUD_QUOTA_PROJECT is not specified.

Return Value

string|null

in CredentialsLoader at line 221
static callable|null getDefaultClientCertSource()

Gets a callable which returns the default device certification.

Return Value

callable|null

Exceptions

UnexpectedValueException

in CredentialsLoader at line 246
static bool shouldLoadClientCertSource()

Determines whether or not the default device certificate should be loaded.

Return Value

bool

in CredentialsLoader at line 285
string getUniverseDomain()

Get the universe domain from the credential. Defaults to "googleapis.com" for all credential types which do not support universe domain.

Return Value

string

at line 75
__construct(string|string[]|null $scope, string|array $jsonKey, string|null $targetAudience = null)

Create a new UserRefreshCredentials.

Parameters

string|string[]|null $scope

the scope of the access request, expressed either as an Array or as a space-delimited String.
string|array $jsonKey

JSON credential file path or JSON credentials as an associative array
string|null $targetAudience

The audience for the ID token.

at line 144
array fetchAuthToken(callable|null $httpHandler = null, array $headers = [])

No description

Parameters

callable|null $httpHandler

callback which delivers psr7 request
array $headers

[optional] Metrics headers to be inserted into the token endpoint request present. This could be passed from ImersonatedServiceAccountCredentials as it uses UserRefreshCredentials as source credentials.

Return Value

array

a hash of auth tokens

at line 160
string getCacheKey()

Return the Cache Key for the credentials.

The format for the Cache key is one of the following: ClientId.Scope ClientId.Audience

Return Value

string

a key that may be used to cache the auth token.

at line 173
null|array getLastReceivedToken()

No description

Return Value

null|array

{ The last received access token.

@type string $access_token The access token string.
@type int $expires_at The time the token expires as a UNIX timestamp.

}

at line 183
string|null getQuotaProject()

Get the quota project used for this API request

Return Value

string|null

at line 193
string|null getGrantedScope()

Get the granted scopes (if they exist) for the last fetched token.

Return Value

string|null