Function default_credentials 

pub fn default_credentials() -> Result<Arc<dyn Credentials>, Error>

The first credentials found, in this order:

1. ORIGINCLOUD_ACCESS_TOKEN: an access token, sent as it is.
2. ORIGINCLOUD_CLIENT_ID and ORIGINCLOUD_CLIENT_SECRET: a service account’s credential, exchanged for access tokens as they expire. Only one of the two set is an error.
3. A CI job’s OIDC token, exchanged at the security token service (Federated): from the file ORIGINCLOUD_OIDC_TOKEN_FILE names, or else from ORIGINCLOUD_OIDC_TOKEN, which holds the token itself (as GitLab CI’s id_tokens set it), or else from GitHub Actions, in a job granted permissions: id-token: write. Once found, its errors are returned, not passed over. ORIGINCLOUD_OIDC_DISABLED=true leaves this step out; ORIGINCLOUD_STS_ENDPOINT asks another address than STS_ENDPOINT, and ORIGINCLOUD_OIDC_AUDIENCE requests GitHub’s token for another audience than OIDC_AUDIENCE.
4. The session the origin CLI stored at its last login (origin id login).
5. The instance’s metadata service, on an instance that runs as a service account (InstanceMetadata). Nothing is requested until a token is; off an instance, that fails with Error::NoCredentials within about two seconds. ORIGINCLOUD_METADATA_DISABLED=true leaves this step out; ORIGINCLOUD_METADATA_ENDPOINT asks another address than METADATA_ENDPOINT.

It fails with Error::NoCredentials when the metadata service is left out and there are no others.