@@ -84,18 +84,13 @@ const {GoogleAuth} = require('google-auth-library');
84
84
* Instead of specifying the type of client you'd like to use (JWT, OAuth2, etc)
85
85
* this library will automatically choose the right client based on the environment.
86
86
*/
87
- async function main () {
88
- const auth = new GoogleAuth ({
89
- scopes: ' https://www.googleapis.com/auth/cloud-platform'
90
- });
91
- const client = await auth .getClient ();
92
- const projectId = await auth .getProjectId ();
93
- const url = ` https://dns.googleapis.com/dns/v1/projects/${ projectId} ` ;
94
- const res = await client .request ({ url });
95
- console .log (res .data );
96
- }
97
-
98
- main ().catch (console .error );
87
+ const auth = new GoogleAuth ({
88
+ scopes: ' https://www.googleapis.com/auth/cloud-platform'
89
+ });
90
+ const projectId = await auth .getProjectId ();
91
+ const url = ` https://dns.googleapis.com/dns/v1/projects/${ projectId} ` ;
92
+ const res = await auth .fetch (url);
93
+ console .log (res .data );
99
94
```
100
95
101
96
## OAuth2
@@ -125,10 +120,11 @@ const keys = require('./oauth2.keys.json');
125
120
*/
126
121
async function main () {
127
122
const oAuth2Client = await getAuthenticatedClient ();
128
- // Make a simple request to the People API using our pre-authenticated client. The `request()` method
129
- // takes an GaxiosOptions object. Visit https://github.com/JustinBeckwith/gaxios.
123
+ // Make a simple request to the People API using our pre-authenticated client. The `fetch` and
124
+ // `request` methods accept a [`GaxiosOptions`](https://github.com/googleapis/gaxios)
125
+ // object.
130
126
const url = ' https://people.googleapis.com/v1/people/me?personFields=names' ;
131
- const res = await oAuth2Client .request ({ url} );
127
+ const res = await oAuth2Client .fetch ( url);
132
128
console .log (res .data );
133
129
134
130
// After acquiring an access_token, you may want to check on the audience, expiration,
@@ -200,6 +196,7 @@ main().catch(console.error);
200
196
This library will automatically obtain an ` access_token ` , and automatically refresh the ` access_token ` if a ` refresh_token ` is present. The ` refresh_token ` is only returned on the [ first authorization] ( https://github.com/googleapis/google-api-nodejs-client/issues/750#issuecomment-304521450 ) , so if you want to make sure you store it safely. An easy way to make sure you always store the most recent tokens is to use the ` tokens ` event:
201
197
202
198
``` js
199
+ const auth = new GoogleAuth ();
203
200
const client = await auth .getClient ();
204
201
205
202
client .on (' tokens' , (tokens ) => {
@@ -210,9 +207,10 @@ client.on('tokens', (tokens) => {
210
207
console .log (tokens .access_token );
211
208
});
212
209
210
+ const projectId = await auth .getProjectId ();
213
211
const url = ` https://dns.googleapis.com/dns/v1/projects/${ projectId} ` ;
214
- const res = await client .request ({ url });
215
212
// The `tokens` event would now be raised if this was the first request
213
+ const res = await client .fetch (url);
216
214
```
217
215
218
216
#### Retrieve access token
@@ -285,18 +283,14 @@ The Google Developers Console provides a `.json` file that you can use to config
285
283
const {JWT } = require (' google-auth-library' );
286
284
const keys = require (' ./jwt.keys.json' );
287
285
288
- async function main () {
289
- const client = new JWT ({
290
- email: keys .client_email ,
291
- key: keys .private_key ,
292
- scopes: [' https://www.googleapis.com/auth/cloud-platform' ],
293
- });
294
- const url = ` https://dns.googleapis.com/dns/v1/projects/${ keys .project_id } ` ;
295
- const res = await client .request ({url});
296
- console .log (res .data );
297
- }
298
-
299
- main ().catch (console .error );
286
+ const client = new JWT ({
287
+ email: keys .client_email ,
288
+ key: keys .private_key ,
289
+ scopes: [' https://www.googleapis.com/auth/cloud-platform' ],
290
+ });
291
+ const url = ` https://dns.googleapis.com/dns/v1/projects/${ keys .project_id } ` ;
292
+ const res = await client .fetch (url);
293
+ console .log (res .data );
300
294
```
301
295
302
296
The parameters for the JWT auth client including how to use it with a ` .pem ` file are explained in [ samples/jwt.js] ( https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/jwt.js ) .
@@ -332,16 +326,12 @@ if (!keysEnvVar) {
332
326
}
333
327
const keys = JSON .parse (keysEnvVar);
334
328
335
- async function main () {
336
- // load the JWT or UserRefreshClient from the keys
337
- const client = auth .fromJSON (keys);
338
- client .scopes = [' https://www.googleapis.com/auth/cloud-platform' ];
339
- const url = ` https://dns.googleapis.com/dns/v1/projects/${ keys .project_id } ` ;
340
- const res = await client .request ({url});
341
- console .log (res .data );
342
- }
343
-
344
- main ().catch (console .error );
329
+ // load the JWT or UserRefreshClient from the keys
330
+ const client = auth .fromJSON (keys);
331
+ client .scopes = [' https://www.googleapis.com/auth/cloud-platform' ];
332
+ const url = ` https://dns.googleapis.com/dns/v1/projects/${ keys .project_id } ` ;
333
+ const res = await client .fetch (url);
334
+ console .log (res .data );
345
335
```
346
336
347
337
** Important** : If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to [ Validate credential configurations from external sources] ( https://cloud.google.com/docs/authentication/external/externally-sourced-credentials ) .
@@ -357,18 +347,14 @@ If your application is running on Google Cloud Platform, you can authenticate us
357
347
``` js
358
348
const {auth , Compute } = require (' google-auth-library' );
359
349
360
- async function main () {
361
- const client = new Compute ({
362
- // Specifying the service account email is optional.
363
- serviceAccountEmail
: ' [email protected] '
364
- });
365
- const projectId = await auth .getProjectId ();
366
- const url = ` https://dns.googleapis.com/dns/v1/projects/${ projectId} ` ;
367
- const res = await client .request ({url});
368
- console .log (res .data );
369
- }
370
-
371
- main ().catch (console .error );
350
+ const client = new Compute ({
351
+ // Specifying the service account email is optional.
352
+ serviceAccountEmail
: ' [email protected] '
353
+ });
354
+ const projectId = await auth .getProjectId ();
355
+ const url = ` https://dns.googleapis.com/dns/v1/projects/${ projectId} ` ;
356
+ const res = await client .fetch (url);
357
+ console .log (res .data );
372
358
```
373
359
374
360
## Workload Identity Federation
@@ -1067,17 +1053,14 @@ export GOOGLE_APPLICATION_CREDENTIALS=/path/to/config.json
1067
1053
The library can now automatically choose the right type of client and initialize credentials from the context provided in the configuration file.
1068
1054
1069
1055
``` js
1070
- async function main () {
1071
- const auth = new GoogleAuth ({
1072
- scopes: ' https://www.googleapis.com/auth/cloud-platform'
1073
- });
1074
- const client = await auth .getClient ();
1075
- const projectId = await auth .getProjectId ();
1076
- // List all buckets in a project.
1077
- const url = ` https://storage.googleapis.com/storage/v1/b?project=${ projectId} ` ;
1078
- const res = await client .request ({ url });
1079
- console .log (res .data );
1080
- }
1056
+ const auth = new GoogleAuth ({
1057
+ scopes: ' https://www.googleapis.com/auth/cloud-platform'
1058
+ });
1059
+ const projectId = await auth .getProjectId ();
1060
+ // List all buckets in a project.
1061
+ const url = ` https://storage.googleapis.com/storage/v1/b?project=${ projectId} ` ;
1062
+ const res = await client .fetch (url);
1063
+ console .log (res .data );
1081
1064
```
1082
1065
1083
1066
When using external identities with Application Default Credentials in Node.js, the ` roles/browser ` role needs to be granted to the service account.
@@ -1100,14 +1083,12 @@ You can also explicitly initialize external account clients using the generated
1100
1083
const {ExternalAccountClient } = require (' google-auth-library' );
1101
1084
const jsonConfig = require (' /path/to/config.json' );
1102
1085
1103
- async function main () {
1104
- const client = ExternalAccountClient .fromJSON (jsonConfig);
1105
- client .scopes = [' https://www.googleapis.com/auth/cloud-platform' ];
1106
- // List all buckets in a project.
1107
- const url = ` https://storage.googleapis.com/storage/v1/b?project=${ projectId} ` ;
1108
- const res = await client .request ({url});
1109
- console .log (res .data );
1110
- }
1086
+ const client = ExternalAccountClient .fromJSON (jsonConfig);
1087
+ client .scopes = [' https://www.googleapis.com/auth/cloud-platform' ];
1088
+ // List all buckets in a project.
1089
+ const url = ` https://storage.googleapis.com/storage/v1/b?project=${ projectId} ` ;
1090
+ const res = await client .fetch (url);
1091
+ console .log (res .data );
1111
1092
```
1112
1093
1113
1094
#### Security Considerations
@@ -1131,15 +1112,11 @@ IAM permission.
1131
1112
// Make a request to a protected Cloud Run service.
1132
1113
const {GoogleAuth } = require (' google-auth-library' );
1133
1114
1134
- async function main () {
1135
- const url = ' https://cloud-run-1234-uc.a.run.app' ;
1136
- const auth = new GoogleAuth ();
1137
- const client = await auth .getIdTokenClient (url);
1138
- const res = await client .request ({url});
1139
- console .log (res .data );
1140
- }
1141
-
1142
- main ().catch (console .error );
1115
+ const url = ' https://cloud-run-1234-uc.a.run.app' ;
1116
+ const auth = new GoogleAuth ();
1117
+ const client = await auth .getIdTokenClient (url);
1118
+ const res = await client .fetch (url);
1119
+ console .log (res .data );
1143
1120
```
1144
1121
1145
1122
A complete example can be found in [ ` samples/idtokens-serverless.js ` ] ( https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/idtokens-serverless.js ) .
@@ -1151,16 +1128,12 @@ used when you set up your protected resource as the target audience.
1151
1128
// Make a request to a protected Cloud Identity-Aware Proxy (IAP) resource
1152
1129
const {GoogleAuth } = require (' google-auth-library' );
1153
1130
1154
- async function main ()
1155
- const targetAudience = 'iap-client-id';
1156
- const url = 'https:// iap-url.com';
1157
- const auth = new GoogleAuth();
1158
- const client = await auth.getIdTokenClient(targetAudience);
1159
- const res = await client.request({url});
1160
- console .log (res .data );
1161
- }
1162
-
1163
- main ().catch (console .error );
1131
+ const targetAudience = ' iap-client-id' ;
1132
+ const url = ' https://iap-url.com' ;
1133
+ const auth = new GoogleAuth ();
1134
+ const client = await auth .getIdTokenClient (targetAudience);
1135
+ const res = await client .fetch (url);
1136
+ console .log (res .data );
1164
1137
```
1165
1138
1166
1139
A complete example can be found in [ ` samples/idtokens-iap.js ` ] ( https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/idtokens-iap.js ) .
@@ -1233,7 +1206,7 @@ async function main() {
1233
1206
1234
1207
// Use impersonated credentials:
1235
1208
const url = ' https://www.googleapis.com/storage/v1/b?project=anotherProjectID'
1236
- const resp = await targetClient .request ({ url } );
1209
+ const resp = await targetClient .fetch ( url);
1237
1210
for (const bucket of resp .data .items ) {
1238
1211
console .log (bucket .name );
1239
1212
}
0 commit comments