1. class
  2. Google
  3. \
  4. Auth
  5. \
  6. Credentials
  7. \
  8. ServiceAccountCredentials

ServiceAccountCredentials

class ServiceAccountCredentials extends CredentialsLoader implements GetQuotaProjectInterface, SignBlobInterface, ProjectIdProviderInterface (View source)

ServiceAccountCredentials supports authorization using a Google service account.

(cf https://developers.google.com/accounts/docs/OAuth2ServiceAccount)

It's initialized using the json key file that's downloadable from developer console, which should contain a private_key and client_email fields that it uses.

Use it with AuthTokenMiddleware to authorize http requests:

use Google\Auth\Credentials\ServiceAccountCredentials; use Google\Auth\Middleware\AuthTokenMiddleware; use GuzzleHttp\Client; use GuzzleHttp\HandlerStack;

$sa = new ServiceAccountCredentials( 'https://www.googleapis.com/auth/taskqueue', '/path/to/your/json/key_file.json' ); $middleware = new AuthTokenMiddleware($sa); $stack = HandlerStack::create(); $stack->push($middleware);

$client = new Client([ 'handler' => $stack, 'base_uri' => 'https://www.googleapis.com/taskqueue/v1beta2/projects/', 'auth' => 'google_auth' // authorize all requests ]);

$res = $client->get('myproject/taskqueues/myqueue');

Traits

ServiceAccountSignerTrait

Sign a string using a Service Account private key.

Constants

TOKEN_CREDENTIAL_URI

ENV_VAR

WELL_KNOWN_PATH

NON_WINDOWS_WELL_KNOWN_PATH_BASE

AUTH_METADATA_KEY

Properties

protected OAuth2 $auth

The OAuth2 instance used to conduct authorization.
protected string $quotaProject

The quota project associated with the JSON credentials
protected $projectId

Methods

static array
fromEnv()

Load a JSON key from the path specified in the environment.

from  CredentialsLoader
static array
fromWellKnownFile()

Load a JSON key from a well known path.

from  CredentialsLoader
static ServiceAccountCredentials|UserRefreshCredentials
makeCredentials(string|array $scope, array $jsonKey)

Create a new Credentials instance.

from  CredentialsLoader
static Client
makeHttpClient(FetchAuthTokenInterface $fetcher, array $httpClientOptions = [], callable $httpHandler = null, callable $tokenCallback = null)

Create an authorized HTTP Client from an instance of FetchAuthTokenInterface.

from  CredentialsLoader
static InsecureCredentials
makeInsecureCredentials()

Create a new instance of InsecureCredentials.

from  CredentialsLoader
array
getUpdateMetadataFunc()

export a callback function which updates runtime metadata.

from  CredentialsLoader
array
updateMetadata(array $metadata, string $authUri = null, callable $httpHandler = null)

Updates metadata with the authorization token.

string
signBlob(string $stringToSign, bool $forceOpenssl = false)

Sign a string using the service account private key.

from  ServiceAccountSignerTrait
__construct(string|array $scope, string|array $jsonKey, string $sub = null, string $targetAudience = null)

Create a new ServiceAccountCredentials.

array
fetchAuthToken(callable $httpHandler = null)

No description

string
getCacheKey()

No description

null|array
getLastReceivedToken()

No description

string|null
getProjectId(callable $httpHandler = null)

Get the project ID from the service account keyfile.

setSub(string $sub)

No description

string
getClientName(callable $httpHandler = null)

Get the client name from the keyfile.

string|null
getQuotaProject()

Get the quota project used for this API request

Details

in CredentialsLoader at line 66
static array fromEnv()

Load a JSON key from the path specified in the environment.

Load a JSON key from the path specified in the environment variable GOOGLE_APPLICATION_CREDENTIALS. Return null if GOOGLE_APPLICATION_CREDENTIALS is not specified.

Return Value

array

JSON key | null

in CredentialsLoader at line 91
static array fromWellKnownFile()

Load a JSON key from a well known path.

The well known path is OS dependent:

  • windows: %APPDATA%/gcloud/application_default_credentials.json
  • others: $HOME/.config/gcloud/application_default_credentials.json

If the file does not exists, this returns null.

Return Value

array

JSON key | null

in CredentialsLoader at line 116
static ServiceAccountCredentials|UserRefreshCredentials makeCredentials(string|array $scope, array $jsonKey)

Create a new Credentials instance.

Parameters

string|array $scope

the scope of the access request, expressed either as an Array or as a space-delimited String.
array $jsonKey

the JSON credentials.

Return Value

ServiceAccountCredentials|UserRefreshCredentials

in CredentialsLoader at line 143
static Client makeHttpClient(FetchAuthTokenInterface $fetcher, array $httpClientOptions = [], callable $httpHandler = null, callable $tokenCallback = null)

Create an authorized HTTP Client from an instance of FetchAuthTokenInterface.

Parameters

FetchAuthTokenInterface $fetcher

is used to fetch the auth token
array $httpClientOptions
callable $httpHandler

(optional) http client to fetch the token.
callable $tokenCallback

(optional) function to be called when a new token is fetched.

Return Value

Client

in CredentialsLoader at line 185
static InsecureCredentials makeInsecureCredentials()

Create a new instance of InsecureCredentials.

Return Value

InsecureCredentials

in CredentialsLoader at line 195
array getUpdateMetadataFunc()

export a callback function which updates runtime metadata.

Return Value

array

updateMetadata function

at line 205
array updateMetadata(array $metadata, string $authUri = null, callable $httpHandler = null)

Updates metadata with the authorization token.

Parameters

array $metadata

metadata hashmap
string $authUri

optional auth uri
callable $httpHandler

callback which delivers psr7 request

Return Value

array

updated metadata hashmap

in ServiceAccountSignerTrait at line 35
string signBlob(string $stringToSign, bool $forceOpenssl = false)

Sign a string using the service account private key.

Parameters

string $stringToSign
bool $forceOpenssl

Whether to use OpenSSL regardless of whether phpseclib is installed. Defaults to false.

Return Value

string

at line 98
__construct(string|array $scope, string|array $jsonKey, string $sub = null, string $targetAudience = null)

Create a new ServiceAccountCredentials.

Parameters

string|array $scope

the scope of the access request, expressed either as an Array or as a space-delimited String.
string|array $jsonKey

JSON credential file path or JSON credentials as an associative array
string $sub

an email address account to impersonate, in situations when the service account has been delegated domain wide access.
string $targetAudience

The audience for the ID token.

at line 157
array fetchAuthToken(callable $httpHandler = null)

No description

Parameters

callable $httpHandler

callback which delivers psr7 request

Return Value

array

a hash of auth tokens

at line 165
string getCacheKey()

No description

Return Value

string

a key that may be used to cache the auth token.

at line 178
null|array getLastReceivedToken()

No description

Return Value

null|array

{ The last received access token.

at line 191
string|null getProjectId(callable $httpHandler = null)

Get the project ID from the service account keyfile.

Returns null if the project ID does not exist in the keyfile.

Parameters

callable $httpHandler

Callback which delivers psr7 request

Return Value

string|null

at line 230
setSub(string $sub)

No description

Parameters

string $sub

an email address account to impersonate, in situations when the service account has been delegated domain wide access.

at line 243
string getClientName(callable $httpHandler = null)

Get the client name from the keyfile.

In this case, it returns the keyfile's client_email key.

Parameters

callable $httpHandler

callback which delivers psr7 request, if one is required to obtain a client name.

Return Value

string

at line 253
string|null getQuotaProject()

Get the quota project used for this API request

Return Value

string|null