Struct Credential 

pub struct Credential {
    pub service_account: Option<ServiceAccount>,
    pub token: Option<Token>,
    pub signer_email: Option<String>,
}

Credential represents Google credentials that may contain a service account, token, and provider-discovered signer identity.

IMPORTANT: This is a specially designed structure that can hold both ServiceAccount and Token simultaneously. This design is intentional and critical for Google’s authentication:

• Service account only: Used for signed URL generation and JWT-based authentication
• Token only: Used for Bearer authentication (e.g., from metadata server, OAuth2)
• Token with signer email: Also supports query signing through IAMCredentials signBlob
• Both: The RequestSigner is responsible for exchanging service account for tokens when needed, and can use cached tokens when available to avoid unnecessary exchanges

The RequestSigner implementation handles the logic of when to use which credential type and when to perform token exchanges. Discovery providers should return credentials as they receive them without trying to perform exchanges themselves. Explicit conversion providers may return a new variant, such as a token-only credential produced from a service account.

Fields

service_account: Option<ServiceAccount>

Service account information, if available.

token: Option<Token>

OAuth2 access token, if available.

signer_email: Option<String>

Service account email authorized to sign with the token, if known by the provider.

This identity is used only for query signing and does not affect Bearer authentication.

Implementations

impl Credential

pub fn with_service_account(service_account: ServiceAccount) -> Self

Create a credential with only a service account.

pub fn with_token(token: Token) -> Self

Create a credential with a token.

pub fn with_signer_email(self, signer_email: impl Into<String>) -> Self

Set the service account email authorized to sign with this credential’s token.

This identity is used only for query signing and does not affect Bearer authentication.

pub fn has_service_account(&self) -> bool

Check if the credential has a service account.

pub fn has_token(&self) -> bool

Check if the credential has a token.

pub fn has_valid_token(&self) -> bool

Check if the credential has a valid token.

Trait Implementations

impl Clone for Credential

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Credential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Credential

fn default() -> Self

Returns the “default value” for a type.

impl SigningCredential for Credential

fn is_valid(&self) -> bool

Return whether a cached credential can be reused without refreshing it.

fn is_valid_at(&self, timestamp: Timestamp) -> bool

Return whether the credential is usable at this exact timestamp.