GcpCompute.TokenProvider behaviour (GcpCompute v0.2.0)

Behaviour for minting the OAuth2 access tokens used to authenticate Compute API requests.

The library never hard-depends on a particular auth mechanism. A GcpCompute.Config holds a {module, arg} pair; before each request the configured module.fetch_token(arg) is invoked.

Built-in implementations:

GcpCompute.TokenProvider.Goth — mints tokens via Goth (the arg is the registered Goth name). This is the production default.
GcpCompute.TokenProvider.Static — returns a fixed token, a %{token: ...} map, or the result of a zero-arity function. Handy for tests and the Compute emulator.

Writing your own

defmodule MyApp.WorkloadIdentity do
  @behaviour GcpCompute.TokenProvider

  @impl true
  def fetch_token(_arg) do
    # ... fetch from the metadata server, Vault, etc.
    {:ok, %{token: token, expires: unix_seconds}}
  end
end

then GcpCompute.Config.new(token_provider: {MyApp.WorkloadIdentity, []}, ...).

Summary

Types

token()

A minted token. Only :token is required; :type and :expires are advisory.

Callbacks

fetch_token(arg)

Return a valid access token, or an error.