Struct Builder

pub struct Builder { /* private fields */ }

A builder for constructing Credentials instances.

By default (using Builder::default), the builder is configured to load credentials according to the standard Application Default Credentials (ADC) strategy. ADC is the recommended approach for most applications and conforms to AIP-4110. If you need to load credentials from a non-standard location or source, you can provide specific credential JSON directly using Builder::new.

Common use cases where using ADC would is useful include:

• Your application is deployed to a Google Cloud environment such as Google Compute Engine (GCE), Google Kubernetes Engine (GKE), or Cloud Run. Each of these deployment environments provides a default service account to the application, and offers mechanisms to change this default service account without any code changes to your application.
• You are testing or developing the application on a workstation (physical or virtual). These credentials will use your preferences as set with gcloud auth application-default. These preferences can be your own Gooogle Cloud user credentials, or some service account.
• Regardless of where your application is running, you can use the GOOGLE_APPLICATION_CREDENTIALS environment variable to override the defaults. This environment variable should point to a file containing a service account key file, or a JSON object describing your user credentials.

The headers returned by these credentials should be used in the Authorization HTTP header.

The Google Cloud client libraries for Rust will typically find and use these credentials automatically if a credentials file exists in the standard ADC search paths. You might instantiate these credentials either via ADC or a specific JSON file, if you need to:

• Override the OAuth 2.0 scopes being requested for the access token.
• Override the quota project ID for billing and quota management.

Example usage:

Fetching headers using ADC

let credentials = Builder::default()
    .with_quota_project_id("my-project")
    .build()?;
let headers = credentials.headers(Extensions::new()).await?;
println!("Headers: {headers:?}");

Fetching headers using custom JSON

let authorized_user = serde_json::json!({
    "client_id": "YOUR_CLIENT_ID.apps.googleusercontent.com", // Replace with your actual Client ID
    "client_secret": "YOUR_CLIENT_SECRET", // Replace with your actual Client Secret - LOAD SECURELY!
    "refresh_token": "YOUR_REFRESH_TOKEN", // Replace with the user's refresh token - LOAD SECURELY!
    "type": "authorized_user",
    // "quota_project_id": "your-billing-project-id", // Optional: Set if needed
    // "token_uri" : "test-token-uri", // Optional: Set if needed
});

let creds = Builder::new(authorized_user)
    .with_quota_project_id("my-project")
    .build()?;
let headers = creds.headers(Extensions::new()).await?;
println!("Headers: {headers:?}");

Implementations

impl Builder

pub fn new(json: Value) -> Self

Creates a new builder with given credentials json.

Example

let authorized_user = serde_json::json!({ /* add details here */ });
let credentials = Builder::new(authorized_user).build();

pub fn with_quota_project_id<S: Into<String>>(self, quota_project_id: S) -> Self

Sets the quota project for these credentials.

In some services, you can use an account in one project for authentication and authorization, and charge the usage to a different project. This requires that the user has serviceusage.services.use permissions on the quota project.

Example

let credentials = Builder::default()
    .with_quota_project_id("my-project")
    .build();

pub fn with_scopes<I, S>(self, scopes: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Sets the scopes for these credentials.

scopes act as an additional restriction in addition to the IAM permissions granted to the principal (user or service account) that creates the token.

scopes define the permissions being requested for this specific access token when interacting with a service. For example, https://www.googleapis.com/auth/devstorage.read_write.

IAM permissions, on the other hand, define the underlying capabilities the principal possesses within a system. For example, storage.buckets.delete.

The credentials certify that a particular token was created by a certain principal.

When a token generated with specific scopes is used, the request must be permitted by both the the principals’s underlying IAM permissions and the scopes requested for the token.

pub fn build(self) -> Result<Credentials, CredentialsError>

Returns a Credentials instance with the configured settings.

Errors

Returns a CredentialsError if a unsupported credential type is provided or if the json provided to Builder::new cannot be successfully deserialized into the expected format. This typically happens if the JSON value is malformed or missing required fields. For more information, on how to generate json, consult the relevant section in the application-default credentials guide.

Trait Implementations

impl Debug for Builder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Builder

fn default() -> Self

Creates a new builder where credentials will be obtained via application-default login.

Example

let credentials = Builder::default().build();