Enum Credentials 

pub enum Credentials {
    ApiKey(Secret),
    OauthClient {
        client_id: String,
        client_secret: Secret,
        scopes: Vec<String>,
    },
    Federated {
        client_id: Option<String>,
        jwt_file: PathBuf,
        scopes: Vec<String>,
    },
}

How this server proves who it is to the control plane.

Variants

ApiKey(Secret)

A user’s own API access token, sent as a bearer token. It expires on the day the admin console gave it and is never renewed from this side.

Named for TAILSCALE_API_KEY, the variable it comes from.

OauthClient

An OAuth client, exchanged for a short-lived access token.

Fields

client_id: String

client_secret: Secret

scopes: Vec<String>

Federated

A workload identity: a JWT written by the platform, exchanged for an access token. The file is read at exchange time, never cached, because the platform rotates it underneath us.

Fields

client_id: Option<String>

jwt_file: PathBuf

scopes: Vec<String>

Implementations

impl Credentials

pub fn from_env() -> Option<Self>

Read a credential from the process environment.

pub fn from_source(source: impl Fn(&str) -> Option<String>) -> Option<Self>

Read a credential from an arbitrary source.

Setting an environment variable is unsafe in this edition and the workspace forbids unsafe, so the tests go through here instead.

pub const fn kind(&self) -> &'static str

How this credential is described in diagnostics. Never the value.

Trait Implementations

impl Clone for Credentials

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Credentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.