Cloud Client Libraries for Java uses theGoogle Auth Library for Javato authenticate requests. This library supports multiple authentication types.For more details, see the project'sREADME.mdandjavadoc.

Authentication in a Google Cloud environment

When using Google Cloud libraries from a Google Cloud environment (such asCompute Engine, Google Kubernetes Engine, or App Engine) you don't need to performadditional authentication steps.

An example call without additional authentication:

Storagestorage=StorageOptions.getDefaultInstance().getService();

Authentication in non-Google Cloud environments

To authenticate in a non-Google Cloud environment, there are three commonoptions:

1. (Recommended) Use a service account.
2. Use the Google Cloud SDK with a local test environment.
3. Use an existing OAuth2 access token.

Use a service account

1. Generate a JSON service account key.

2. After downloading the key, you must do one of the following:

   • Define the environment variableGOOGLE_APPLICATION_CREDENTIALS to be thelocation of the key.For example:

   exportGOOGLE_APPLICATION_CREDENTIALS=/path/to/my/key.json

   • Supply the JSON credentials file when building the service options. Forexample, thisStorageobject has the necessary permissions to interact with your Cloud Storagedata:

   Storagestorage=StorageOptions.newBuilder().setCredentials(ServiceAccountCredentials.fromStream(newFileInputStream("/path/to/my/key.json"))).build().getService();

Use the Google Cloud SDK with a local test environment

If you are using a local environment for development or testing, you can use theGoogle Cloud SDK.

Create Application Default Credentials withgcloud auth application-default login. Cloud Client Libraries for Java willautomatically detect these credentials.

Use an existing OAuth2 access token

If you have an OAuth2 access token, you can use it to authenticate. If you do,the access token isn't automatically refreshed:

Credentialscredentials=GoogleCredentials.create(newAccessToken(accessToken,expirationTime));Storagestorage=StorageOptions.newBuilder().setCredentials(credentials).build().getService();

Another example:

Credentialscredentials=GoogleCredentials.create(newAccessToken(accessToken,expirationTime));CloudTasksSettingscloudTasksSettings=CloudTasksSettings.newBuilder().setCredentialProvider(FixedCredentialsProvider.create(credentials)).build();CloudTasksClientcloudTasksClient=CloudTasksClient.create(cloudTasksSettings);

Application Default Credentials

If you don't provide credentials, Cloud Client Libraries for Java will attempt todetect them from the environment usingGoogleCredentials.getApplicationDefault().This method searches for Application Default Credentials in the followinglocations, in order:

1. The credentials file pointed to by theGOOGLE_APPLICATION_CREDENTIALSenvironment variable.
2. Credentials provided by the Google Cloud SDKgcloud auth application-default login command.
3. Google App Engine's built-in credentials.
4. Google Cloud Shell's built-in credentials.
5. Google Compute Engine's built-in service account credentials.

Authentication with an API key

Some Google Cloud APIs supportauthenticating with API keys.

To use an API key with Cloud Client Libraries for Java, you must manually set thex-goog-api-key header for the relevant service client.

For example, to set the API key with theLanguage service:

publicLanguageServiceClientcreateGrpcClientWithApiKey(StringapiKey)throwsException{// Manually set the API key using the headerMap<String,String>header=newHashMap<String,String>(){{put("x-goog-api-key",apiKey);}};FixedHeaderProviderheaderProvider=FixedHeaderProvider.create(header);// Create the clientTransportChannelProvidertransportChannelProvider=InstantiatingGrpcChannelProvider.newBuilder().setHeaderProvider(headerProvider).build();LanguageServiceSettingssettings=LanguageServiceSettings.newBuilder().setTransportChannelProvider(transportChannelProvider).build();LanguageServiceClientclient=LanguageServiceClient.create(settings);returnclient;}

An example instantiation with the Language Client using REST:

publicLanguageServiceClientcreateRestClientWithApiKey(StringapiKey)throwsException{// Manually set the API key headerMap<String,String>header=newHashMap<String,String>(){{put("x-goog-api-key",apiKey);}};FixedHeaderProviderheaderProvider=FixedHeaderProvider.create(header);// Create the clientTransportChannelProvidertransportChannelProvider=InstantiatingHttpJsonChannelProvider.newBuilder().setHeaderProvider(headerProvider).build();LanguageServiceSettingssettings=LanguageServiceSettings.newBuilder().setTransportChannelProvider(transportChannelProvider).build();LanguageServiceClientclient=LanguageServiceClient.create(settings);returnclient;}