gcloud auth application-default print-access-token - print an access token for your current Application Default Credentials

gcloud auth application-default print-access-token[--lifetime=LIFETIME][--scopes=SCOPE,[SCOPE,…]][GCLOUD_WIDE_FLAG …]

The access token generated by gcloud auth application-default print-access-tokenis useful for manually testing APIs via curl or similar tools.

In order to print details of the access token, such as the associated accountand the token's expiration time in seconds, run:

curl-H"Content-Type: application/x-www-form-urlencoded"-d"access_token=$(gcloudauthapplication-defaultprint-access-token)"https://www.googleapis.com/oauth2/v1/tokeninfo

Note that token itself may not be enough to access some services. If you use thetoken with curl or similar tools, you may see permission errors similar to "Yourapplication has authenticated using end user credentials from the Google CloudSDK or Google Cloud Shell". If it happens, you may need to provide a quotaproject in the "X-Goog-User-Project" header. For example,

curl-H"X-Goog-User-Project: your-project"-H"Authorization: Bearer$(gcloudauthapplication-defaultprint-access-token)"foo.googleapis.com

The identity that granted the token must have the serviceusage.services.usepermission on the provided project. Seehttps://cloud.google.com/apis/docs/system-parametersfor more information.

--lifetime=LIFETIME

Access token lifetime. The default access token lifetime is 3600 seconds, butyou can use this flag to reduce the lifetime or extend it up to 43200 seconds(12 hours). The org policy constraintconstraints/iam.allowServiceAccountCredentialLifetimeExtension mustbe set if you want to extend the lifetime beyond 3600 seconds. Note that thisflag is for service account impersonation only, so it only works when either--impersonate-service-account flag orauth/impersonate_service_account property is set.

--scopes=SCOPE,[SCOPE,…]

The scopes to authorize for. This flag is supported for user accounts andservice accounts only. The list of possible scopes can be found at:https://developers.google.com/identity/protocols/googlescopes.

For end-user accounts, the provided scopes must be from [openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/sqlservice.login], or the scopespreviously specified throughgcloud auth application-default login--scopes.

Run$gcloud help for details.