A service account is a special type of Google account that belongs to your application or a virtual machine (VM), instead of to an individual end user. Your application assumes the identity of the service account to call Google APIs, so that the users aren't directly involved.
Service account credentials are used to temporarily assume the identity of the service account. Supported credential types include OAuth 2.0 access tokens, OpenID Connect ID tokens, self-signed JSON Web Tokens (JWTs), and more. v1
{Promise} - The promise which resolves to an array. The first element of the array is an object representing [GenerateAccessTokenResponse]. Please see the [documentation](https://github.com/googleapis/gax-nodejs/blob/master/client-libraries.md#regular-methods) for more details and examples.
Example
/** * TODO(developer): Uncomment these variables before running the sample. *//** * Required. The resource name of the service account for which the credentials * are requested, in the following format: * `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard * character is required; replacing it with a project ID is invalid. */// const name = 'abc123'/** * The sequence of service accounts in a delegation chain. Each service * account must be granted the `roles/iam.serviceAccountTokenCreator` role * on its next service account in the chain. The last service account in the * chain must be granted the `roles/iam.serviceAccountTokenCreator` role * on the service account that is specified in the `name` field of the * request. * The delegates must have the following format: * `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard * character is required; replacing it with a project ID is invalid. */// const delegates = 'abc123'/** * Required. Code to identify the scopes to be included in the OAuth 2.0 access token. * See https://developers.google.com/identity/protocols/googlescopes for more * information. * At least one value required. */// const scope = 'abc123'/** * The desired lifetime duration of the access token in seconds. * Must be set to a value less than or equal to 3600 (1 hour). If a value is * not specified, the token's lifetime will be set to a default value of one * hour. */// const lifetime = {}// Imports the Credentials libraryconst{IAMCredentialsClient}=require('@google-cloud/iam-credentials').v1;// Instantiates a clientconstcredentialsClient=newIAMCredentialsClient();asyncfunctioncallGenerateAccessToken(){// Construct requestconstrequest={name,scope,};// Run requestconstresponse=awaitcredentialsClient.generateAccessToken(request);console.log(response);}callGenerateAccessToken();
{Promise} - The promise which resolves to an array. The first element of the array is an object representing [GenerateIdTokenResponse]. Please see the [documentation](https://github.com/googleapis/gax-nodejs/blob/master/client-libraries.md#regular-methods) for more details and examples.
Example
/** * TODO(developer): Uncomment these variables before running the sample. *//** * Required. The resource name of the service account for which the credentials * are requested, in the following format: * `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard * character is required; replacing it with a project ID is invalid. */// const name = 'abc123'/** * The sequence of service accounts in a delegation chain. Each service * account must be granted the `roles/iam.serviceAccountTokenCreator` role * on its next service account in the chain. The last service account in the * chain must be granted the `roles/iam.serviceAccountTokenCreator` role * on the service account that is specified in the `name` field of the * request. * The delegates must have the following format: * `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard * character is required; replacing it with a project ID is invalid. */// const delegates = 'abc123'/** * Required. The audience for the token, such as the API or account that this token * grants access to. */// const audience = 'abc123'/** * Include the service account email in the token. If set to `true`, the * token will contain `email` and `email_verified` claims. */// const includeEmail = true// Imports the Credentials libraryconst{IAMCredentialsClient}=require('@google-cloud/iam-credentials').v1;// Instantiates a clientconstcredentialsClient=newIAMCredentialsClient();asyncfunctioncallGenerateIdToken(){// Construct requestconstrequest={name,audience,};// Run requestconstresponse=awaitcredentialsClient.generateIdToken(request);console.log(response);}callGenerateIdToken();
Initialize the client. Performs asynchronous operations (such as authentication) and prepares the client. This function will be called automatically when any class method is called for the first time, but if you need to initialize it before calling an actual method, feel free to call initialize() directly.
You can await on this method if you want to make sure the client is initialized.
Returns
Type
Description
Promise<{
[name: string]: Function;
}>
{Promise} A promise that resolves to an authenticated service stub.
{Promise} - The promise which resolves to an array. The first element of the array is an object representing [SignBlobResponse]. Please see the [documentation](https://github.com/googleapis/gax-nodejs/blob/master/client-libraries.md#regular-methods) for more details and examples.
Example
/** * TODO(developer): Uncomment these variables before running the sample. *//** * Required. The resource name of the service account for which the credentials * are requested, in the following format: * `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard * character is required; replacing it with a project ID is invalid. */// const name = 'abc123'/** * The sequence of service accounts in a delegation chain. Each service * account must be granted the `roles/iam.serviceAccountTokenCreator` role * on its next service account in the chain. The last service account in the * chain must be granted the `roles/iam.serviceAccountTokenCreator` role * on the service account that is specified in the `name` field of the * request. * The delegates must have the following format: * `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard * character is required; replacing it with a project ID is invalid. */// const delegates = 'abc123'/** * Required. The bytes to sign. */// const payload = 'Buffer.from('string')'// Imports the Credentials libraryconst{IAMCredentialsClient}=require('@google-cloud/iam-credentials').v1;// Instantiates a clientconstcredentialsClient=newIAMCredentialsClient();asyncfunctioncallSignBlob(){// Construct requestconstrequest={name,payload,};// Run requestconstresponse=awaitcredentialsClient.signBlob(request);console.log(response);}callSignBlob();
{Promise} - The promise which resolves to an array. The first element of the array is an object representing [SignJwtResponse]. Please see the [documentation](https://github.com/googleapis/gax-nodejs/blob/master/client-libraries.md#regular-methods) for more details and examples.
Example
/** * TODO(developer): Uncomment these variables before running the sample. *//** * Required. The resource name of the service account for which the credentials * are requested, in the following format: * `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard * character is required; replacing it with a project ID is invalid. */// const name = 'abc123'/** * The sequence of service accounts in a delegation chain. Each service * account must be granted the `roles/iam.serviceAccountTokenCreator` role * on its next service account in the chain. The last service account in the * chain must be granted the `roles/iam.serviceAccountTokenCreator` role * on the service account that is specified in the `name` field of the * request. * The delegates must have the following format: * `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard * character is required; replacing it with a project ID is invalid. */// const delegates = 'abc123'/** * Required. The JWT payload to sign: a JSON object that contains a JWT Claims Set. */// const payload = 'abc123'// Imports the Credentials libraryconst{IAMCredentialsClient}=require('@google-cloud/iam-credentials').v1;// Instantiates a clientconstcredentialsClient=newIAMCredentialsClient();asyncfunctioncallSignJwt(){// Construct requestconstrequest={name,payload,};// Run requestconstresponse=awaitcredentialsClient.signJwt(request);console.log(response);}callSignJwt();
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-02-14 UTC."],[],[]]
