Arke.Utils.Gcp.Auth (Arke v0.8.0)

Copy Markdown View Source

Google credentials for Arke.Utils.Gcp.

Resolves application default credentials, then either mints an OAuth access token (token/0) or returns the service account key to sign blobs with (signer/0).

Credentials are resolved on every call, first hit wins:

  1. config :arke, :gcp_credentials — a JSON string, {:system, "VAR"}, or a decoded map
  2. GOOGLE_APPLICATION_CREDENTIALS — path to the key file
  3. GOOGLE_APPLICATION_CREDENTIALS_JSON — inline JSON
  4. application_default_credentials.json in the gcloud config dir ($CLOUDSDK_CONFIG, defaulting to ~/.config/gcloud) — gcloud ADC
  5. the GCE metadata server

Summary

Functions

private_key(pem)

Decodes a PEM private key into the term :public_key.sign/3 expects.

signer()

The service account able to sign blobs: {client_email, private_key_pem}.

token()

An OAuth access token for the resolved credentials.

Functions

private_key(pem)

Decodes a PEM private key into the term :public_key.sign/3 expects.

signer()

The service account able to sign blobs: {client_email, private_key_pem}.

Only service account credentials carry a private key; metadata server and gcloud user credentials return {:error, :no_private_key}.

token()

An OAuth access token for the resolved credentials.