GcpServiceAccountCredentials class

A GcpCredentialsProvider backed by a service account key — the standard JSON file gcloud iam service-accounts keys create produces.

This is the provider to use when the registry runs anywhere other than on Google Cloud, and the only one that can sign download URLs.

final credentials = GcpServiceAccountCredentials.fromJson(
  jsonDecode(File('service-account.json').readAsStringSync()),
);

Access tokens are obtained by the standard JWT bearer grant: a short-lived assertion is signed with the account's private key and exchanged at Google's token endpoint. Tokens are cached until shortly before they expire, and concurrent refreshes collapse onto one exchange.

Implemented types

Constructors

GcpServiceAccountCredentials({required String clientEmail, required RSAPrivateKey privateKey, List<String> scopes = const [storageScope], Uri? tokenUri, Client? httpClient})
Creates credentials from an already-parsed key.
GcpServiceAccountCredentials.fromJson(Map<String, dynamic> json, {List<String> scopes = const [storageScope], Client? httpClient})
Parses a service account key JSON document.
factory
GcpServiceAccountCredentials.fromJsonString(String source, {List<String> scopes = const [storageScope], Client? httpClient})
Parses a service account key from its raw JSON source.
factory

Properties

canSignUrls → bool
Whether this provider can sign V4 URLs locally — that is, whether it holds an RSA private key rather than just a bearer token.
no setteroverride
clientEmail → String
The service account's e-mail address.
final
hashCode → int
The hash code for this object.
no setterinherited
privateKey → RSAPrivateKey
The account's RSA private key.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
scopes → List<String>
The OAuth scopes requested for access tokens.
final
tokenUri → Uri
The token exchange endpoint.
final

Methods

accessToken() → Future<GcpAccessToken>
A valid access token, refreshed if necessary.
override
close() → Future<void>
Releases any resources held (an HTTP client used for token exchange).
override
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
signRsaSha256(Uint8List data) → Future<Uint8List>
Signs data with RSASSA-PKCS1-v1_5 over SHA-256.
override
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited

Static Methods

parsePrivateKeyPem(String pem) → RSAPrivateKey
Parses a PEM-encoded PKCS#8 (BEGIN PRIVATE KEY) or PKCS#1 (BEGIN RSA PRIVATE KEY) RSA private key.

Constants

storageScope → const String
The scope granting read/write access to Cloud Storage.