ai.internal._gcp_access_token

(internal) Mints a Google Cloud OAuth2 access token for `scope`, returning the bare token (the caller builds the `Bearer` header).

Reference version

Signature

function ai.internal._gcp_access_token(

credentials_json: string | null,

scope: string

) -> string throws baml.errors.Io | baml.errors.AccessError

(internal) Mints a Google Cloud OAuth2 access token for scope, returning the bare token (the caller builds the Bearer header).

credentials_json is an inline credential JSON document — service account, authorized user, workload identity federation, or impersonated service account: the same documents GOOGLE_APPLICATION_CREDENTIALS accepts. It is used as-is: a broken document raises instead of silently falling back. null runs the Application Default Credentials chain (GOOGLE_APPLICATION_CREDENTIALS, the well-known ADC config file, the gcloud config file, then the GCE metadata server).

Tokens are cached process-wide until shortly before expiry, so repeated calls with the same credentials and scope do not re-mint.

Source:<builtin>/ai/ns_internal/auth.bamlbytes 1295–1458