Module credentials 

Credentials: where the access token each call is sent with comes from.

In a browser (wasm32-unknown-unknown) there are AccessToken and the Credentials trait, for credentials of the page’s own. The providers that read the environment, files, a CI job’s token or an instance’s metadata service, and default_credentials, which chains them, are native only: a browser has none of these, and ClientBuilder::build without credentials fails with Error::NoCredentials there. ServiceAccount is there only with the feature service-account-wasm, for runtimes that aren’t a browser.

Structs

AccessToken

An access token, sent as it is. It is not renewed: a service account’s lives five minutes.

CliSession

The session the origin CLI stored at its last login, renewed from its refresh token when its access token has expired. The renewed session stays in memory: the CLI’s file is never written.

Federated

A CI job’s OIDC token, exchanged at the security token service for the access token of the WORKLOAD service account a federated credential trusts the job as. The access token is reused until a minute before it expires; then a fresh job token is fetched and exchanged again, or a token given as it is (Federated::from_token) exchanged again. An exchange the STS can’t check right now (503) is sent again twice.

InstanceMetadata

The credential of the service account the instance runs as, from the instance’s metadata service: a session is opened for six hours, and each access token, which lives five minutes, requested with it a minute before the last one expires. The requests never go through a proxy, which the metadata service refuses, and one it can’t answer right now (503) is sent again twice.

ServiceAccount

A service account’s client ID and secret, exchanged for access tokens with the client credentials grant as they expire.

Constants

METADATA_ENDPOINT

The instance metadata service, which software on an instance reaches at this link-local address.

OIDC_AUDIENCE

The audience a GitHub Actions job’s OIDC token is requested for.

STS_ENDPOINT

The security token service, where a CI job’s OIDC token is exchanged for an access token.

TOKEN_URL

The identity provider’s token endpoint, where service account credentials and the CLI’s session are exchanged for access tokens.

Traits

Credentials

Credentials supply the access token each call is sent with. Send + Sync on every target, so a client can live in a UI framework’s reactive state (Leptos 0.8 keeps memo values Send + Sync even in a browser); only the future token returns is !Send there.

Functions

default_credentials

The first credentials found, in this order:

Type Aliases

TokenFuture

What Credentials::token returns: Send natively; not in a browser, where a fetch is a JavaScript promise.