google.internal.gcp_access_token

Mints a Google Cloud OAuth2 access token for `scope`, returning the bare token (build `Bearer ${token}` yourself). Raises if no usable credential is found.

Reference version

Signature

function google.internal.gcp_access_token(

credentials_json: string | null,

scope: string

) -> string throws baml.errors.AccessError | baml.errors.Io

Mints a Google Cloud OAuth2 access token for scope, returning the bare token (build Bearer ${token} yourself). Raises if no usable credential is found.

credentials_json is an inline credential JSON document — service account, authorized user, workload identity federation, or impersonated service account: the same documents GOOGLE_APPLICATION_CREDENTIALS accepts. It is used as-is, so a broken document raises rather than silently falling back. null runs the Application Default Credentials chain (GOOGLE_APPLICATION_CREDENTIALS, the well-known ADC config file, the gcloud config file, then the GCE metadata server).

Tokens are cached process-wide until shortly before expiry, so calling this per request is cheap.

Source:<builtin>/google/ns_internal/auth.bamlbytes 1286–1426