public final class ServiceAccountKey extends com.google.protobuf.GeneratedMessageV3 implements ServiceAccountKeyOrBuilder
Represents a service account key. A service account has two sets of key-pairs: user-managed, and system-managed. User-managed key-pairs can be created and deleted by users. Users are responsible for rotating these keys periodically to ensure security of their service accounts. Users retain the private key of these key-pairs, and Google retains ONLY the public key. System-managed keys are automatically rotated by Google, and are used for signing for a maximum of two weeks. The rotation process is probabilistic, and usage of the new key will gradually ramp up and down over the key's lifetime. If you cache the public key set for a service account, we recommend that you update the cache every 15 minutes. User-managed keys can be added and removed at any time, so it is important to update the cache frequently. For Google-managed keys, Google will publish a key at least 6 hours before it is first used for signing and will keep publishing it for at least 6 hours after it was last used for signing. Public keys for all service accounts are also published at the OAuth2 Service Account API.Protobuf type
google.iam.admin.v1.ServiceAccountKey| Modifier and Type | Class and Description |
|---|---|
static class |
ServiceAccountKey.Builder
Represents a service account key.
|
com.google.protobuf.GeneratedMessageV3.BuilderParent, com.google.protobuf.GeneratedMessageV3.ExtendableBuilder<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>,BuilderT extends com.google.protobuf.GeneratedMessageV3.ExtendableBuilder<MessageT,BuilderT>>, com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>>, com.google.protobuf.GeneratedMessageV3.ExtendableMessageOrBuilder<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>>, com.google.protobuf.GeneratedMessageV3.FieldAccessorTable, com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter| Modifier and Type | Field and Description |
|---|---|
static int |
DISABLED_FIELD_NUMBER |
static int |
KEY_ALGORITHM_FIELD_NUMBER |
static int |
KEY_ORIGIN_FIELD_NUMBER |
static int |
KEY_TYPE_FIELD_NUMBER |
static int |
NAME_FIELD_NUMBER |
static int |
PRIVATE_KEY_DATA_FIELD_NUMBER |
static int |
PRIVATE_KEY_TYPE_FIELD_NUMBER |
static int |
PUBLIC_KEY_DATA_FIELD_NUMBER |
static int |
VALID_AFTER_TIME_FIELD_NUMBER |
static int |
VALID_BEFORE_TIME_FIELD_NUMBER |
| Modifier and Type | Method and Description |
|---|---|
boolean |
equals(Object obj) |
static ServiceAccountKey |
getDefaultInstance() |
ServiceAccountKey |
getDefaultInstanceForType() |
static com.google.protobuf.Descriptors.Descriptor |
getDescriptor() |
boolean |
getDisabled()
The key status.
|
ServiceAccountKeyAlgorithm |
getKeyAlgorithm()
Specifies the algorithm (and possibly key size) for the key.
|
int |
getKeyAlgorithmValue()
Specifies the algorithm (and possibly key size) for the key.
|
ServiceAccountKeyOrigin |
getKeyOrigin()
The key origin.
|
int |
getKeyOriginValue()
The key origin.
|
ListServiceAccountKeysRequest.KeyType |
getKeyType()
The key type.
|
int |
getKeyTypeValue()
The key type.
|
String |
getName()
The resource name of the service account key in the following format
`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
|
com.google.protobuf.ByteString |
getNameBytes()
The resource name of the service account key in the following format
`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
|
com.google.protobuf.Parser<ServiceAccountKey> |
getParserForType() |
com.google.protobuf.ByteString |
getPrivateKeyData()
The private key data.
|
ServiceAccountPrivateKeyType |
getPrivateKeyType()
The output format for the private key.
|
int |
getPrivateKeyTypeValue()
The output format for the private key.
|
com.google.protobuf.ByteString |
getPublicKeyData()
The public key data.
|
int |
getSerializedSize() |
com.google.protobuf.Timestamp |
getValidAfterTime()
The key can be used after this timestamp.
|
com.google.protobuf.TimestampOrBuilder |
getValidAfterTimeOrBuilder()
The key can be used after this timestamp.
|
com.google.protobuf.Timestamp |
getValidBeforeTime()
The key can be used before this timestamp.
|
com.google.protobuf.TimestampOrBuilder |
getValidBeforeTimeOrBuilder()
The key can be used before this timestamp.
|
int |
hashCode() |
boolean |
hasValidAfterTime()
The key can be used after this timestamp.
|
boolean |
hasValidBeforeTime()
The key can be used before this timestamp.
|
protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable |
internalGetFieldAccessorTable() |
boolean |
isInitialized() |
static ServiceAccountKey.Builder |
newBuilder() |
static ServiceAccountKey.Builder |
newBuilder(ServiceAccountKey prototype) |
ServiceAccountKey.Builder |
newBuilderForType() |
protected ServiceAccountKey.Builder |
newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) |
protected Object |
newInstance(com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter unused) |
static ServiceAccountKey |
parseDelimitedFrom(InputStream input) |
static ServiceAccountKey |
parseDelimitedFrom(InputStream input,
com.google.protobuf.ExtensionRegistryLite extensionRegistry) |
static ServiceAccountKey |
parseFrom(byte[] data) |
static ServiceAccountKey |
parseFrom(byte[] data,
com.google.protobuf.ExtensionRegistryLite extensionRegistry) |
static ServiceAccountKey |
parseFrom(ByteBuffer data) |
static ServiceAccountKey |
parseFrom(ByteBuffer data,
com.google.protobuf.ExtensionRegistryLite extensionRegistry) |
static ServiceAccountKey |
parseFrom(com.google.protobuf.ByteString data) |
static ServiceAccountKey |
parseFrom(com.google.protobuf.ByteString data,
com.google.protobuf.ExtensionRegistryLite extensionRegistry) |
static ServiceAccountKey |
parseFrom(com.google.protobuf.CodedInputStream input) |
static ServiceAccountKey |
parseFrom(com.google.protobuf.CodedInputStream input,
com.google.protobuf.ExtensionRegistryLite extensionRegistry) |
static ServiceAccountKey |
parseFrom(InputStream input) |
static ServiceAccountKey |
parseFrom(InputStream input,
com.google.protobuf.ExtensionRegistryLite extensionRegistry) |
static com.google.protobuf.Parser<ServiceAccountKey> |
parser() |
ServiceAccountKey.Builder |
toBuilder() |
void |
writeTo(com.google.protobuf.CodedOutputStream output) |
canUseUnsafe, computeStringSize, computeStringSizeNoTag, emptyBooleanList, emptyDoubleList, emptyFloatList, emptyIntList, emptyList, emptyLongList, getAllFields, getDescriptorForType, getField, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof, internalGetMapField, internalGetMapFieldReflection, isStringEmpty, makeExtensionsImmutable, makeMutableCopy, makeMutableCopy, mergeFromAndMakeImmutableInternal, mutableCopy, mutableCopy, mutableCopy, mutableCopy, mutableCopy, newBooleanList, newBuilderForType, newDoubleList, newFloatList, newIntList, newLongList, parseDelimitedWithIOException, parseDelimitedWithIOException, parseUnknownField, parseUnknownFieldProto3, parseWithIOException, parseWithIOException, parseWithIOException, parseWithIOException, serializeBooleanMapTo, serializeIntegerMapTo, serializeLongMapTo, serializeStringMapTo, writeReplace, writeString, writeStringNoTagfindInitializationErrors, getInitializationErrorString, hashBoolean, hashEnum, hashEnumList, hashFields, hashLong, toStringaddAll, addAll, checkByteStringIsUtf8, toByteArray, toByteString, writeDelimitedTo, writeToclone, finalize, getClass, notify, notifyAll, wait, wait, waitpublic static final int NAME_FIELD_NUMBER
public static final int PRIVATE_KEY_TYPE_FIELD_NUMBER
public static final int KEY_ALGORITHM_FIELD_NUMBER
public static final int PRIVATE_KEY_DATA_FIELD_NUMBER
public static final int PUBLIC_KEY_DATA_FIELD_NUMBER
public static final int VALID_AFTER_TIME_FIELD_NUMBER
public static final int VALID_BEFORE_TIME_FIELD_NUMBER
public static final int KEY_ORIGIN_FIELD_NUMBER
public static final int KEY_TYPE_FIELD_NUMBER
public static final int DISABLED_FIELD_NUMBER
protected Object newInstance(com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter unused)
newInstance in class com.google.protobuf.GeneratedMessageV3public static final com.google.protobuf.Descriptors.Descriptor getDescriptor()
protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()
internalGetFieldAccessorTable in class com.google.protobuf.GeneratedMessageV3public String getName()
The resource name of the service account key in the following format
`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
string name = 1;getName in interface ServiceAccountKeyOrBuilderpublic com.google.protobuf.ByteString getNameBytes()
The resource name of the service account key in the following format
`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
string name = 1;getNameBytes in interface ServiceAccountKeyOrBuilderpublic int getPrivateKeyTypeValue()
The output format for the private key. Only provided in `CreateServiceAccountKey` responses, not in `GetServiceAccountKey` or `ListServiceAccountKey` responses. Google never exposes system-managed private keys, and never retains user-managed private keys.
.google.iam.admin.v1.ServiceAccountPrivateKeyType private_key_type = 2;getPrivateKeyTypeValue in interface ServiceAccountKeyOrBuilderpublic ServiceAccountPrivateKeyType getPrivateKeyType()
The output format for the private key. Only provided in `CreateServiceAccountKey` responses, not in `GetServiceAccountKey` or `ListServiceAccountKey` responses. Google never exposes system-managed private keys, and never retains user-managed private keys.
.google.iam.admin.v1.ServiceAccountPrivateKeyType private_key_type = 2;getPrivateKeyType in interface ServiceAccountKeyOrBuilderpublic int getKeyAlgorithmValue()
Specifies the algorithm (and possibly key size) for the key.
.google.iam.admin.v1.ServiceAccountKeyAlgorithm key_algorithm = 8;getKeyAlgorithmValue in interface ServiceAccountKeyOrBuilderpublic ServiceAccountKeyAlgorithm getKeyAlgorithm()
Specifies the algorithm (and possibly key size) for the key.
.google.iam.admin.v1.ServiceAccountKeyAlgorithm key_algorithm = 8;getKeyAlgorithm in interface ServiceAccountKeyOrBuilderpublic com.google.protobuf.ByteString getPrivateKeyData()
The private key data. Only provided in `CreateServiceAccountKey` responses. Make sure to keep the private key data secure because it allows for the assertion of the service account identity. When base64 decoded, the private key data can be used to authenticate with Google API client libraries and with <a href="/sdk/gcloud/reference/auth/activate-service-account">gcloud auth activate-service-account</a>.
bytes private_key_data = 3;getPrivateKeyData in interface ServiceAccountKeyOrBuilderpublic com.google.protobuf.ByteString getPublicKeyData()
The public key data. Only provided in `GetServiceAccountKey` responses.
bytes public_key_data = 7;getPublicKeyData in interface ServiceAccountKeyOrBuilderpublic boolean hasValidAfterTime()
The key can be used after this timestamp.
.google.protobuf.Timestamp valid_after_time = 4;hasValidAfterTime in interface ServiceAccountKeyOrBuilderpublic com.google.protobuf.Timestamp getValidAfterTime()
The key can be used after this timestamp.
.google.protobuf.Timestamp valid_after_time = 4;getValidAfterTime in interface ServiceAccountKeyOrBuilderpublic com.google.protobuf.TimestampOrBuilder getValidAfterTimeOrBuilder()
The key can be used after this timestamp.
.google.protobuf.Timestamp valid_after_time = 4;getValidAfterTimeOrBuilder in interface ServiceAccountKeyOrBuilderpublic boolean hasValidBeforeTime()
The key can be used before this timestamp. For system-managed key pairs, this timestamp is the end time for the private key signing operation. The public key could still be used for verification for a few hours after this time.
.google.protobuf.Timestamp valid_before_time = 5;hasValidBeforeTime in interface ServiceAccountKeyOrBuilderpublic com.google.protobuf.Timestamp getValidBeforeTime()
The key can be used before this timestamp. For system-managed key pairs, this timestamp is the end time for the private key signing operation. The public key could still be used for verification for a few hours after this time.
.google.protobuf.Timestamp valid_before_time = 5;getValidBeforeTime in interface ServiceAccountKeyOrBuilderpublic com.google.protobuf.TimestampOrBuilder getValidBeforeTimeOrBuilder()
The key can be used before this timestamp. For system-managed key pairs, this timestamp is the end time for the private key signing operation. The public key could still be used for verification for a few hours after this time.
.google.protobuf.Timestamp valid_before_time = 5;getValidBeforeTimeOrBuilder in interface ServiceAccountKeyOrBuilderpublic int getKeyOriginValue()
The key origin.
.google.iam.admin.v1.ServiceAccountKeyOrigin key_origin = 9;getKeyOriginValue in interface ServiceAccountKeyOrBuilderpublic ServiceAccountKeyOrigin getKeyOrigin()
The key origin.
.google.iam.admin.v1.ServiceAccountKeyOrigin key_origin = 9;getKeyOrigin in interface ServiceAccountKeyOrBuilderpublic int getKeyTypeValue()
The key type.
.google.iam.admin.v1.ListServiceAccountKeysRequest.KeyType key_type = 10;getKeyTypeValue in interface ServiceAccountKeyOrBuilderpublic ListServiceAccountKeysRequest.KeyType getKeyType()
The key type.
.google.iam.admin.v1.ListServiceAccountKeysRequest.KeyType key_type = 10;getKeyType in interface ServiceAccountKeyOrBuilderpublic boolean getDisabled()
The key status.
bool disabled = 11;getDisabled in interface ServiceAccountKeyOrBuilderpublic final boolean isInitialized()
isInitialized in interface com.google.protobuf.MessageLiteOrBuilderisInitialized in class com.google.protobuf.GeneratedMessageV3public void writeTo(com.google.protobuf.CodedOutputStream output)
throws IOException
writeTo in interface com.google.protobuf.MessageLitewriteTo in class com.google.protobuf.GeneratedMessageV3IOExceptionpublic int getSerializedSize()
getSerializedSize in interface com.google.protobuf.MessageLitegetSerializedSize in class com.google.protobuf.GeneratedMessageV3public boolean equals(Object obj)
equals in interface com.google.protobuf.Messageequals in class com.google.protobuf.AbstractMessagepublic int hashCode()
hashCode in interface com.google.protobuf.MessagehashCode in class com.google.protobuf.AbstractMessagepublic static ServiceAccountKey parseFrom(ByteBuffer data) throws com.google.protobuf.InvalidProtocolBufferException
com.google.protobuf.InvalidProtocolBufferExceptionpublic static ServiceAccountKey parseFrom(ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
com.google.protobuf.InvalidProtocolBufferExceptionpublic static ServiceAccountKey parseFrom(com.google.protobuf.ByteString data) throws com.google.protobuf.InvalidProtocolBufferException
com.google.protobuf.InvalidProtocolBufferExceptionpublic static ServiceAccountKey parseFrom(com.google.protobuf.ByteString data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
com.google.protobuf.InvalidProtocolBufferExceptionpublic static ServiceAccountKey parseFrom(byte[] data) throws com.google.protobuf.InvalidProtocolBufferException
com.google.protobuf.InvalidProtocolBufferExceptionpublic static ServiceAccountKey parseFrom(byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
com.google.protobuf.InvalidProtocolBufferExceptionpublic static ServiceAccountKey parseFrom(InputStream input) throws IOException
IOExceptionpublic static ServiceAccountKey parseFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
IOExceptionpublic static ServiceAccountKey parseDelimitedFrom(InputStream input) throws IOException
IOExceptionpublic static ServiceAccountKey parseDelimitedFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
IOExceptionpublic static ServiceAccountKey parseFrom(com.google.protobuf.CodedInputStream input) throws IOException
IOExceptionpublic static ServiceAccountKey parseFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
IOExceptionpublic ServiceAccountKey.Builder newBuilderForType()
newBuilderForType in interface com.google.protobuf.MessagenewBuilderForType in interface com.google.protobuf.MessageLitepublic static ServiceAccountKey.Builder newBuilder()
public static ServiceAccountKey.Builder newBuilder(ServiceAccountKey prototype)
public ServiceAccountKey.Builder toBuilder()
toBuilder in interface com.google.protobuf.MessagetoBuilder in interface com.google.protobuf.MessageLiteprotected ServiceAccountKey.Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent)
newBuilderForType in class com.google.protobuf.GeneratedMessageV3public static ServiceAccountKey getDefaultInstance()
public static com.google.protobuf.Parser<ServiceAccountKey> parser()
public com.google.protobuf.Parser<ServiceAccountKey> getParserForType()
getParserForType in interface com.google.protobuf.MessagegetParserForType in interface com.google.protobuf.MessageLitegetParserForType in class com.google.protobuf.GeneratedMessageV3public ServiceAccountKey getDefaultInstanceForType()
getDefaultInstanceForType in interface com.google.protobuf.MessageLiteOrBuildergetDefaultInstanceForType in interface com.google.protobuf.MessageOrBuilderCopyright © 2025 Google LLC. All rights reserved.