{"id":22292631,"url":"https://github.com/ericnorris/gcp-auth-contrib","last_synced_at":"2025-07-27T18:14:34.574Z","repository":{"id":56978831,"uuid":"297838213","full_name":"ericnorris/gcp-auth-contrib","owner":"ericnorris","description":"Unofficial PHP library for GCP Authentication.","archived":false,"fork":false,"pushed_at":"2020-09-27T00:50:29.000Z","size":134,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-05-28T14:06:43.930Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ericnorris.png","metadata":{"files":{"readme":"README.asciidoc","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-09-23T03:11:59.000Z","updated_at":"2024-04-18T15:09:32.000Z","dependencies_parsed_at":"2022-08-21T10:50:11.340Z","dependency_job_id":null,"html_url":"https://github.com/ericnorris/gcp-auth-contrib","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/ericnorris/gcp-auth-contrib","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgcp-auth-contrib","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgcp-auth-contrib/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgcp-auth-contrib/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgcp-auth-contrib/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ericnorris","download_url":"https://codeload.github.com/ericnorris/gcp-auth-contrib/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericnorris%2Fgcp-auth-contrib/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267400718,"owners_count":24081186,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-27T02:00:11.917Z","response_time":82,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-03T17:23:13.053Z","updated_at":"2025-07-27T18:14:34.522Z","avatar_url":"https://github.com/ericnorris.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"= gcp-auth-contrib\n// asciidoc settings\n:toc:\n:toc-placement!:\n:toc-title!:\n\n[.lead]\nimage:https://github.com/ericnorris/gcp-auth-contrib/workflows/CI/badge.svg[CI status, link=https://github.com/ericnorris/gcp-auth-contrib/actions?query=workflow%3ACI]\nimage:https://coveralls.io/repos/github/ericnorris/gcp-auth-contrib/badge.svg[Coveralls.io coverage percentage, link=https://coveralls.io/github/ericnorris/gcp-auth-contrib]\nimage:https://shepherd.dev/github/ericnorris/gcp-auth-contrib/coverage.svg[Psalm type coverage percentage, link=https://shepherd.dev/github/ericnorris/gcp-auth-contrib]\n\n`gcp-auth-contrib` is an unofficial PHP library for authenticating with Google Cloud Platform products that focuses on sane defaults, correctness, and speed.\n\n- Safely caches all authentication IO to reduce latency across requests when running PHP in a web server context\n- All IO is done lazily, avoids link:https://github.com/googleapis/google-auth-library-php/issues/297[accidentally DoSing the metadata server] by not performing any IO during initialization\n- Supports link:https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials[service account impersonation] out of the box\n- Clear distinction between fetching OAuth2 access tokens and OIDC identity tokens to make it simple to call link:https://cloud.google.com/functions/docs/securing/authenticating#service-to-function[Cloud Functions], link:https://cloud.google.com/functions/docs/securing/authenticating#service-to-function[Cloud Run], and similar products\n- Fully typed via link:https://github.com/vimeo/psalm[Psalm]\n\n[source, php]\n....\n\n$fetcher = \\ericnorris\\GCPAuthContrib\\OpinionatedDefaults::get()-\u003emakeCredentialsFetcher();\n\n$storageClient = new \\Google\\Cloud\\Storage\\StorageClient([\n    \"credentialsFetcher\" =\u003e $fetcher,\n]);\n\n// ...\n....\n\ntoc::[]\n\n== Installation\n\n....\ncomposer require ericnorris/gcp-auth-contrib\n....\n\n== Usage\n\nThe following examples all make use of the link:/src/OpinionatedDefaults.php[OpinionatedDefaults] class. The defaults are:\n\n- Use a plain link:https://github.com/guzzle/guzzle/tree/master[Guzzle] HTTP client. This means exceptions will be thrown for HTTP errors, e.g. for `500s`.\n- Use the link:https://cloud.google.com/docs/authentication/production#automatically[Application Default Credentials] pattern for finding credentials. *Note:* you *DO NOT* need to provide a service account key file if you are running your code on a Google Cloud Platform product. Using this library (and the opinionated defaults) will authenticate automatically using the metadata server of the product you are running on.\n- Cache authentication IO using a link:https://symfony.com/doc/current/components/cache.html[Symfony] in-memory and filesystem cache. Access and identity tokens are cached for as long as they are valid, and other requests are cached permanently when it is safe to do so.\n\nIf these defaults do not work for you, the link:/src/Credentials[Credentials] directory has a flexible set of classes you may use for authentication. It is strongly encouraged that you wrap any such classes with a link:/src/Credentials/CachedCredentials.php[CachedCredentials] instance to avoid unecessary IO.\n\n=== Authenticating with Google Cloud Platform APIs\n\nThe Google Cloud Platform PHP library generally requires a class implementing the link:https://github.com/googleapis/google-auth-library-php/blob/9ccaea6037abff9a99b8a58891b9dc8fe0f0d1b8/src/FetchAuthTokenInterface.php[FetchAuthTokenInterface] interface to be passed in to their client via the `credentials` or `credentialsFetcher` option array key. This depends on the particular client, see link:https://googleapis.github.io/google-cloud-php/#/[the docs] for your particular client to know which one to use.\n\nYou can retrieve a `FetchAuthTokenInterface` compatible interface by calling `makeCredentialsFetcher` on the `OpinionatedDefaults` class.\n\n[source, php]\n....\n$fetcher = \\ericnorris\\GCPAuthContrib\\OpinionatedDefaults::get()-\u003emakeCredentialsFetcher();\n\n// the StorageClient class takes the parameter as a \"credentialsFetcher\" option\n$storageClient = new \\Google\\Cloud\\Storage\\StorageClient([\n    \"credentialsFetcher\" =\u003e $fetcher,\n]);\n\n// the BigtableClient class takes the parameter as a \"credentials\" option\n$bigtableClient = new \\Google\\Cloud\\Bigtable\\BigtableClient([\n    \"credentials\" =\u003e $fetcher,\n]);\n\n// ...\n....\n\n=== Authenticating with Google Cloud Platform serverless products\n\nCalling authenticated Cloud Run or Cloud Function services requires an OIDC identity token. All instances of link:https://github.com/ericnorris/gcp-auth-contrib/blob/master/src/Contracts/Credentials.php[Credentials] in this library offer a separate `fetchIdentityToken(string $audience)` method for exactly this purpose.\n\n*Note:* This includes the link:https://github.com/ericnorris/gcp-auth-contrib/blob/master/src/Credentials/AuthorizedUserCredentials.php[AuthorizedUserCredentials]! You can use a user's OAuth credentials (via `gcloud auth application-default login` or by doing the OAuth2 flow yourself) to call authenticated serverless products.\n\n[source, php]\n....\n$credentials = \\ericnorris\\GCPAuthContrib\\OpinionatedDefaults::get()-\u003emakeCredentials();\n\n$identityTokenResponse = $credentials-\u003efetchIdentityToken(\"https://your-cloud-function-or-run-url-here\");\n\n$headers = [\n    \"Authorization: Bearer {$identityTokenResponse-\u003egetIdentityToken()}\",\n];\n\n$curl = curl_init();\n\ncurl_setopt($curl, CURLOPT_URL, \"https://your-cloud-function-or-run-url-here\");\ncurl_setopt($curl, CURLOPT_HTTPHEADER, $headers);\n\n// ...\n....\n\n=== Impersonating service accounts\n\nYou may impersonate another Google Cloud Platform service account using the link:https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials[service account impersonation] flow. Assuming the service account running the below code has the `roles/iam.serviceAccountTokenCreator` IAM role on an imaginary service account `other-account@some-project-id.iam.gserviceaccount.com`:\n\n[source, php]\n....\n$fetcher = \\ericnorris\\GCPAuthContrib\\OpinionatedDefaults::get()-\u003emakeImpersonatedCredentialsFetcher(\n    \"other-account@some-project-id.iam.gserviceaccount.com\",\n);\n\n// calls will be authenticated using the other account's credentials\n$storageClient = new \\Google\\Cloud\\Storage\\StorageClient([\n    \"credentialsFetcher\" =\u003e $fetcher,\n]);\n\n// ...\n....\n\n=== Determining the project ID\n\nMay not be supported by all credential types.\n\n[source, php]\n....\n$credentials = \\ericnorris\\GCPAuthContrib\\OpinionatedDefaults::get()-\u003emakeCredentials();\n\necho \"project ID: {$credentials-\u003efetchProjectID()}\";\n....\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fericnorris%2Fgcp-auth-contrib","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fericnorris%2Fgcp-auth-contrib","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fericnorris%2Fgcp-auth-contrib/lists"}