This takes the metadata auth token in a Google Compute Engine instance as authentication source

  service_account = "default",
  scopes = ""



Specify a different service account from the default


Scopes for the authentication


A token


service_account is default or the service account email e.g. ""

Google Compute Engine instances come with their own authentication tokens.

It has no refresh token so you need to call for a fresh token after approx. one hour. The metadata token will refresh itself when it has about 60 seconds left.

You can only use for scopes specified when creating the instance.

If you want to use them make sure their service account email is added to accounts you want to get data from.

See also