Class ServiceAccountKey (3.31.0)

public final class ServiceAccountKey extends GeneratedMessageV3 implements ServiceAccountKeyOrBuilder

Represents a service account key.

A service account has two sets of key-pairs: user-managed, and system-managed.

User-managed key-pairs can be created and deleted by users. Users are responsible for rotating these keys periodically to ensure security of their service accounts. Users retain the private key of these key-pairs, and Google retains ONLY the public key.

System-managed keys are automatically rotated by Google, and are used for signing for a maximum of two weeks. The rotation process is probabilistic, and usage of the new key will gradually ramp up and down over the key's lifetime.

If you cache the public key set for a service account, we recommend that you update the cache every 15 minutes. User-managed keys can be added and removed at any time, so it is important to update the cache frequently. For Google-managed keys, Google will publish a key at least 6 hours before it is first used for signing and will keep publishing it for at least 6 hours after it was last used for signing.

Public keys for all service accounts are also published at the OAuth2 Service Account API.

Protobuf type google.iam.admin.v1.ServiceAccountKey

Static Fields

DISABLED_FIELD_NUMBER

public static final int DISABLED_FIELD_NUMBER
Field Value
TypeDescription
int

KEY_ALGORITHM_FIELD_NUMBER

public static final int KEY_ALGORITHM_FIELD_NUMBER
Field Value
TypeDescription
int

KEY_ORIGIN_FIELD_NUMBER

public static final int KEY_ORIGIN_FIELD_NUMBER
Field Value
TypeDescription
int

KEY_TYPE_FIELD_NUMBER

public static final int KEY_TYPE_FIELD_NUMBER
Field Value
TypeDescription
int

NAME_FIELD_NUMBER

public static final int NAME_FIELD_NUMBER
Field Value
TypeDescription
int

PRIVATE_KEY_DATA_FIELD_NUMBER

public static final int PRIVATE_KEY_DATA_FIELD_NUMBER
Field Value
TypeDescription
int

PRIVATE_KEY_TYPE_FIELD_NUMBER

public static final int PRIVATE_KEY_TYPE_FIELD_NUMBER
Field Value
TypeDescription
int

PUBLIC_KEY_DATA_FIELD_NUMBER

public static final int PUBLIC_KEY_DATA_FIELD_NUMBER
Field Value
TypeDescription
int

VALID_AFTER_TIME_FIELD_NUMBER

public static final int VALID_AFTER_TIME_FIELD_NUMBER
Field Value
TypeDescription
int

VALID_BEFORE_TIME_FIELD_NUMBER

public static final int VALID_BEFORE_TIME_FIELD_NUMBER
Field Value
TypeDescription
int

Static Methods

getDefaultInstance()

public static ServiceAccountKey getDefaultInstance()
Returns
TypeDescription
ServiceAccountKey

getDescriptor()

public static final Descriptors.Descriptor getDescriptor()
Returns
TypeDescription
Descriptor

newBuilder()

public static ServiceAccountKey.Builder newBuilder()
Returns
TypeDescription
ServiceAccountKey.Builder

newBuilder(ServiceAccountKey prototype)

public static ServiceAccountKey.Builder newBuilder(ServiceAccountKey prototype)
Parameter
NameDescription
prototypeServiceAccountKey
Returns
TypeDescription
ServiceAccountKey.Builder

parseDelimitedFrom(InputStream input)

public static ServiceAccountKey parseDelimitedFrom(InputStream input)
Parameter
NameDescription
inputInputStream
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
IOException

parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

public static ServiceAccountKey parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)
Parameters
NameDescription
inputInputStream
extensionRegistryExtensionRegistryLite
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
IOException

parseFrom(byte[] data)

public static ServiceAccountKey parseFrom(byte[] data)
Parameter
NameDescription
databyte[]
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
InvalidProtocolBufferException

parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)

public static ServiceAccountKey parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)
Parameters
NameDescription
databyte[]
extensionRegistryExtensionRegistryLite
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
InvalidProtocolBufferException

parseFrom(ByteString data)

public static ServiceAccountKey parseFrom(ByteString data)
Parameter
NameDescription
dataByteString
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
InvalidProtocolBufferException

parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)

public static ServiceAccountKey parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)
Parameters
NameDescription
dataByteString
extensionRegistryExtensionRegistryLite
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
InvalidProtocolBufferException

parseFrom(CodedInputStream input)

public static ServiceAccountKey parseFrom(CodedInputStream input)
Parameter
NameDescription
inputCodedInputStream
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
IOException

parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

public static ServiceAccountKey parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)
Parameters
NameDescription
inputCodedInputStream
extensionRegistryExtensionRegistryLite
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
IOException

parseFrom(InputStream input)

public static ServiceAccountKey parseFrom(InputStream input)
Parameter
NameDescription
inputInputStream
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
IOException

parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

public static ServiceAccountKey parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)
Parameters
NameDescription
inputInputStream
extensionRegistryExtensionRegistryLite
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
IOException

parseFrom(ByteBuffer data)

public static ServiceAccountKey parseFrom(ByteBuffer data)
Parameter
NameDescription
dataByteBuffer
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
InvalidProtocolBufferException

parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)

public static ServiceAccountKey parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)
Parameters
NameDescription
dataByteBuffer
extensionRegistryExtensionRegistryLite
Returns
TypeDescription
ServiceAccountKey
Exceptions
TypeDescription
InvalidProtocolBufferException

parser()

public static Parser<ServiceAccountKey> parser()
Returns
TypeDescription
Parser<ServiceAccountKey>

Methods

equals(Object obj)

public boolean equals(Object obj)
Parameter
NameDescription
objObject
Returns
TypeDescription
boolean
Overrides

getDefaultInstanceForType()

public ServiceAccountKey getDefaultInstanceForType()
Returns
TypeDescription
ServiceAccountKey

getDisabled()

public boolean getDisabled()

The key status.

bool disabled = 11;

Returns
TypeDescription
boolean

The disabled.

getKeyAlgorithm()

public ServiceAccountKeyAlgorithm getKeyAlgorithm()

Specifies the algorithm (and possibly key size) for the key.

.google.iam.admin.v1.ServiceAccountKeyAlgorithm key_algorithm = 8;

Returns
TypeDescription
ServiceAccountKeyAlgorithm

The keyAlgorithm.

getKeyAlgorithmValue()

public int getKeyAlgorithmValue()

Specifies the algorithm (and possibly key size) for the key.

.google.iam.admin.v1.ServiceAccountKeyAlgorithm key_algorithm = 8;

Returns
TypeDescription
int

The enum numeric value on the wire for keyAlgorithm.

getKeyOrigin()

public ServiceAccountKeyOrigin getKeyOrigin()

The key origin.

.google.iam.admin.v1.ServiceAccountKeyOrigin key_origin = 9;

Returns
TypeDescription
ServiceAccountKeyOrigin

The keyOrigin.

getKeyOriginValue()

public int getKeyOriginValue()

The key origin.

.google.iam.admin.v1.ServiceAccountKeyOrigin key_origin = 9;

Returns
TypeDescription
int

The enum numeric value on the wire for keyOrigin.

getKeyType()

public ListServiceAccountKeysRequest.KeyType getKeyType()

The key type.

.google.iam.admin.v1.ListServiceAccountKeysRequest.KeyType key_type = 10;

Returns
TypeDescription
ListServiceAccountKeysRequest.KeyType

The keyType.

getKeyTypeValue()

public int getKeyTypeValue()

The key type.

.google.iam.admin.v1.ListServiceAccountKeysRequest.KeyType key_type = 10;

Returns
TypeDescription
int

The enum numeric value on the wire for keyType.

getName()

public String getName()

The resource name of the service account key in the following format projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}.

string name = 1;

Returns
TypeDescription
String

The name.

getNameBytes()

public ByteString getNameBytes()

The resource name of the service account key in the following format projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}.

string name = 1;

Returns
TypeDescription
ByteString

The bytes for name.

getParserForType()

public Parser<ServiceAccountKey> getParserForType()
Returns
TypeDescription
Parser<ServiceAccountKey>
Overrides

getPrivateKeyData()

public ByteString getPrivateKeyData()

The private key data. Only provided in CreateServiceAccountKey responses. Make sure to keep the private key data secure because it allows for the assertion of the service account identity. When base64 decoded, the private key data can be used to authenticate with Google API client libraries and with <a href="/sdk/gcloud/reference/auth/activate-service-account">gcloud auth activate-service-account</a>.

bytes private_key_data = 3;

Returns
TypeDescription
ByteString

The privateKeyData.

getPrivateKeyType()

public ServiceAccountPrivateKeyType getPrivateKeyType()

The output format for the private key. Only provided in CreateServiceAccountKey responses, not in GetServiceAccountKey or ListServiceAccountKey responses.

Google never exposes system-managed private keys, and never retains user-managed private keys.

.google.iam.admin.v1.ServiceAccountPrivateKeyType private_key_type = 2;

Returns
TypeDescription
ServiceAccountPrivateKeyType

The privateKeyType.

getPrivateKeyTypeValue()

public int getPrivateKeyTypeValue()

The output format for the private key. Only provided in CreateServiceAccountKey responses, not in GetServiceAccountKey or ListServiceAccountKey responses.

Google never exposes system-managed private keys, and never retains user-managed private keys.

.google.iam.admin.v1.ServiceAccountPrivateKeyType private_key_type = 2;

Returns
TypeDescription
int

The enum numeric value on the wire for privateKeyType.

getPublicKeyData()

public ByteString getPublicKeyData()

The public key data. Only provided in GetServiceAccountKey responses.

bytes public_key_data = 7;

Returns
TypeDescription
ByteString

The publicKeyData.

getSerializedSize()

public int getSerializedSize()
Returns
TypeDescription
int
Overrides

getValidAfterTime()

public Timestamp getValidAfterTime()

The key can be used after this timestamp.

.google.protobuf.Timestamp valid_after_time = 4;

Returns
TypeDescription
Timestamp

The validAfterTime.

getValidAfterTimeOrBuilder()

public TimestampOrBuilder getValidAfterTimeOrBuilder()

The key can be used after this timestamp.

.google.protobuf.Timestamp valid_after_time = 4;

Returns
TypeDescription
TimestampOrBuilder

getValidBeforeTime()

public Timestamp getValidBeforeTime()

The key can be used before this timestamp. For system-managed key pairs, this timestamp is the end time for the private key signing operation. The public key could still be used for verification for a few hours after this time.

.google.protobuf.Timestamp valid_before_time = 5;

Returns
TypeDescription
Timestamp

The validBeforeTime.

getValidBeforeTimeOrBuilder()

public TimestampOrBuilder getValidBeforeTimeOrBuilder()

The key can be used before this timestamp. For system-managed key pairs, this timestamp is the end time for the private key signing operation. The public key could still be used for verification for a few hours after this time.

.google.protobuf.Timestamp valid_before_time = 5;

Returns
TypeDescription
TimestampOrBuilder

hasValidAfterTime()

public boolean hasValidAfterTime()

The key can be used after this timestamp.

.google.protobuf.Timestamp valid_after_time = 4;

Returns
TypeDescription
boolean

Whether the validAfterTime field is set.

hasValidBeforeTime()

public boolean hasValidBeforeTime()

The key can be used before this timestamp. For system-managed key pairs, this timestamp is the end time for the private key signing operation. The public key could still be used for verification for a few hours after this time.

.google.protobuf.Timestamp valid_before_time = 5;

Returns
TypeDescription
boolean

Whether the validBeforeTime field is set.

hashCode()

public int hashCode()
Returns
TypeDescription
int
Overrides

internalGetFieldAccessorTable()

protected GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()
Returns
TypeDescription
FieldAccessorTable
Overrides

isInitialized()

public final boolean isInitialized()
Returns
TypeDescription
boolean
Overrides

newBuilderForType()

public ServiceAccountKey.Builder newBuilderForType()
Returns
TypeDescription
ServiceAccountKey.Builder

newBuilderForType(GeneratedMessageV3.BuilderParent parent)

protected ServiceAccountKey.Builder newBuilderForType(GeneratedMessageV3.BuilderParent parent)
Parameter
NameDescription
parentBuilderParent
Returns
TypeDescription
ServiceAccountKey.Builder
Overrides

newInstance(GeneratedMessageV3.UnusedPrivateParameter unused)

protected Object newInstance(GeneratedMessageV3.UnusedPrivateParameter unused)
Parameter
NameDescription
unusedUnusedPrivateParameter
Returns
TypeDescription
Object
Overrides

toBuilder()

public ServiceAccountKey.Builder toBuilder()
Returns
TypeDescription
ServiceAccountKey.Builder

writeTo(CodedOutputStream output)

public void writeTo(CodedOutputStream output)
Parameter
NameDescription
outputCodedOutputStream
Overrides
Exceptions
TypeDescription
IOException