Changes

0.18.0 (2025-12-15)

Features

• Support scopes field from impersonated credential json (#13308) (e3f62e1)
• add support for parsing EC private key (#13317) (ea6bc62)
• deprecate unsafe credentials JSON loading options (#13397) (0dd2a3b)

0.17.0 (2025-10-02)

Features

• Add trust boundary support for service accounts and impersonation (HTTP/gRPC) (#11870) (5c2b665)
• add trust boundary support for external accounts (#12864) (a67a146)

0.16.5 (2025-08-14)

Bug Fixes

• auth: Improve error message for unknown credentials type (#12673) (558b164)
• auth: Set Content-Type in userTokenProvider.exchangeToken (#12634) (1197ebc)

0.16.4 (2025-08-06)

Bug Fixes

• auth: Add UseDefaultClient: true to metadata.Options (#12666) (1482191), refs #11078 #12657

0.16.3 (2025-07-17)

Bug Fixes

• auth: Fix race condition in cachedTokenProvider.tokenAsync (#12586) (73867cc)

0.16.2 (2025-06-04)

Bug Fixes

• auth: Add back DirectPath misconfiguration logging (#11162) (8d52da5)
• auth: Remove s2a fallback option (#12354) (d5acc59)

0.16.1 (2025-04-23)

Bug Fixes

• auth: Clone detectopts before assigning TokenBindingType (#11881) (2167b02)

0.16.0 (2025-04-14)

Features

• auth/credentials: Return X.509 certificate chain as subject token (#11948) (d445a3f), refs #11757
• auth: Configure DirectPath bound credentials from AllowedHardBoundTokens (#11665) (0fc40bc)

Bug Fixes

• auth: Allow non-default SA credentials for DP (#11828) (3a996b4)
• auth: Restore calling DialContext (#11930) (9ec9a29), refs #11118

0.15.0 (2025-02-19)

Features

• auth: Add hard-bound token request to compute token provider. (#11588) (0e608bb)

0.14.1 (2025-01-24)

Documentation

• auth: Add warning about externally-provided credentials (#11462) (49fb6ff)

0.14.0 (2025-01-08)

Features

• auth: Add universe domain support to idtoken (#11059) (72add7e)

Bug Fixes

• auth/oauth2adapt: Update golang.org/x/net to v0.33.0 (e9b0b69)
• auth: Fix copy of delegates in impersonate.NewIDTokenCredentials (#11386) (ff7ef8e), refs #11379
• auth: Update golang.org/x/net to v0.33.0 (e9b0b69)

0.13.0 (2024-12-13)

Features

• auth: Add logging support (#11079) (c80e31d)
• auth: Pass logger from auth layer to metadata package (#11288) (b552efd)

Bug Fixes

• auth: Check compute cred type before non-default flag for DP (#11255) (4347ca1)

0.12.1 (2024-12-10)

Bug Fixes

• auth: Correct typo in link (#11160) (af6fb46)

0.12.0 (2024-12-04)

Features

• auth: Add support for providing custom certificate URL (#11006) (ebf3657), refs #11005

Bug Fixes

• auth: Ensure endpoints are present in Validator (#11209) (106cd53), refs #11006 #11190 #11189 #11188

0.11.0 (2024-11-21)

Features

• auth: Add universe domain support to mTLS (#11159) (117748b)

0.10.2 (2024-11-12)

Bug Fixes

• auth: Restore use of grpc.Dial (#11118) (2456b94), refs #7556

0.10.1 (2024-11-06)

Bug Fixes

• auth: Restore Application Default Credentials support to idtoken (#11083) (8771f2e)
• auth: Skip impersonate universe domain check if empty (#11086) (87159c1)

0.10.0 (2024-10-30)

Features

• auth: Add universe domain support to credentials/impersonate (#10953) (e06cb64)

0.9.9 (2024-10-22)

Bug Fixes

• auth: Fallback cert lookups for missing files (#11013) (bd76695), refs #10844
• auth: Replace MDS endpoint universe_domain with universe-domain (#11000) (6a1586f)

0.9.8 (2024-10-09)

Bug Fixes

• auth: Restore OpenTelemetry handling in transports (#10968) (08c6d04), refs #10962
• auth: Try talk to plaintext S2A if credentials can not be found for mTLS-S2A (#10941) (0f0bf2d)

0.9.7 (2024-10-01)

Bug Fixes

• auth: Restore support for non-default service accounts for DirectPath (#10937) (a38650e), refs #10907

0.9.6 (2024-09-30)

Bug Fixes

• auth: Make aws credentials provider retrieve fresh credentials (#10920) (250fbf8)

0.9.5 (2024-09-25)

Bug Fixes

• auth: Restore support for GOOGLECLOUDUNIVERSE_DOMAIN env (#10915) (94caaaa)
• auth: Skip directpath credentials overwrite when it's not on GCE (#10833) (7e5e8d1)
• auth: Use new context for non-blocking token refresh (#10919) (cf7102d)

0.9.4 (2024-09-11)

Bug Fixes

• auth: Enable self-signed JWT for non-GDU universe domain (#10831) (f9869f7)

0.9.3 (2024-09-03)

Bug Fixes

• auth: Choose quota project envvar over file when both present (#10807) (2d8dd77), refs #10804

0.9.2 (2024-08-30)

Bug Fixes

• auth: Handle non-Transport DefaultTransport (#10733) (98d91dc), refs #10742
• auth: Make sure quota option takes precedence over env/file (#10797) (f1b050d), refs #10795

Documentation

• auth: Fix Go doc comment link (#10751) (015acfa)

0.9.1 (2024-08-22)

Bug Fixes

• auth: Setting expireEarly to default when the value is 0 (#10732) (5e67869)

0.9.0 (2024-08-16)

Features

• auth: Auth library can talk to S2A over mTLS (#10634) (5250a13)

0.8.1 (2024-08-13)

Bug Fixes

• auth: Make default client creation more lenient (#10669) (1afb9ee), refs #10638

0.8.0 (2024-08-07)

Features

• auth: Adds support for X509 workload identity federation (#10373) (5d07505)

0.7.3 (2024-08-01)

Bug Fixes

• auth/oauth2adapt: Update dependencies (257c40b)
• auth: Disable automatic universe domain check for MDS (#10620) (7cea5ed)
• auth: Update dependencies (257c40b)

0.7.2 (2024-07-22)

Bug Fixes

• auth: Use default client for universe metadata lookup (#10551) (d9046fd), refs #10544

0.7.1 (2024-07-10)

Bug Fixes

• auth: Bump google.golang.org/grpc@v1.64.1 (8ecc4e9)

0.7.0 (2024-07-09)

Features

• auth: Add workload X509 cert provider as a default cert provider (#10479) (c51ee6c)

Bug Fixes

• auth/oauth2adapt: Bump google.golang.org/api@v0.187.0 (8fa9e39)
• auth: Bump google.golang.org/api@v0.187.0 (8fa9e39)
• auth: Check len of slices, not non-nil (#10483) (0a966a1)

0.6.1 (2024-07-01)

Bug Fixes

• auth: Support gRPC API keys (#10460) (daa6646)
• auth: Update http and grpc transports to support token exchange over mTLS (#10397) (c6dfdcf)

0.6.0 (2024-06-25)

Features

• auth: Add non-blocking token refresh for compute MDS (#10263) (9ac350d)

Bug Fixes

• auth: Return error if envvar detected file returns an error (#10431) (e52b9a7)

0.5.2 (2024-06-24)

Bug Fixes

• auth: Fetch initial token when CachedTokenProviderOptions.DisableAutoRefresh is true (#10415) (3266763), refs #10414

0.5.1 (2024-05-31)

Bug Fixes

• auth: Pass through client to 2LO and 3LO flows (#10290) (685784e)

0.5.0 (2024-05-28)

Features

• auth: Adds X509 workload certificate provider (#10233) (17a9db7)

0.4.2 (2024-05-16)

Bug Fixes

• auth: Enable client certificates by default only for GDU (#10151) (7c52978)
• auth: Handle non-Transport DefaultTransport (#10162) (fa3bfdb), refs #10159
• auth: Have refresh time match docs (#10147) (bcb5568)
• auth: Update compute token fetching error with named prefix (#10180) (4573504)

0.4.1 (2024-05-09)

Bug Fixes

• auth: Don't try to detect default creds it opt configured (#10143) (804632e)

0.4.0 (2024-05-07)

Features

• auth: Enable client certificates by default (#10102) (9013e52)

Bug Fixes

• auth: Get s2a logic up to date (#10093) (4fe9ae4)

0.3.0 (2024-04-23)

Features

• auth/httptransport: Add ability to customize transport (#10023) (72c7f6b), refs #9812 #9814

Bug Fixes

• auth/credentials: Error on bad file name if explicitly set (#10018) (55beaa9), refs #9809

0.2.2 (2024-04-19)

Bug Fixes

• auth: Add internal opt to skip validation on transports (#9999) (9e20ef8), refs #9823
• auth: Set secure flag for gRPC conn pools (#10002) (14e3956), refs #9833

0.2.1 (2024-04-18)

Bug Fixes

• auth: Default gRPC token type to Bearer if not set (#9800) (5284066)

0.2.0 (2024-04-15)

Breaking Changes

In the below mentioned commits there were a few large breaking changes since the last release of the module.

1. The Credentials type has been moved to the root of the module as it is

becoming the core abstraction for the whole module.

1. Because of the above mentioned change many functions that previously

returned a TokenProvider now return Credentials. Similarly, these functions have been renamed to be more specific.

1. Most places that used to take an optional TokenProvider now accept

Credentials. You can make a Credentials from a TokenProvider using the constructor found in the auth package.

1. The detect package has been renamed to credentials. With this change some

function signatures were also updated for better readability.

1. Derivative auth flows like impersonate and downscope have been moved to

be under the new credentials package.

Although these changes are disruptive we think that they are for the best of the long-term health of the module. We do not expect any more large breaking changes like these in future revisions, even before 1.0.0. This version will be the first version of the auth library that our client libraries start to use and depend on.

Features

• auth/credentials/externalaccount: Add default TokenURL (#9700) (81830e6)
• auth: Add downscope.Options.UniverseDomain (#9634) (52cf7d7)
• auth: Add universe domain to grpctransport and httptransport (#9663) (67d353b), refs #9670
• auth: Add UniverseDomain to DetectOptions (#9536) (3618d3f)
• auth: Make package externalaccount public (#9633) (a0978d8)
• auth: Move credentials to base auth package (#9590) (1a04baf)
• auth: Refactor public sigs to use Credentials (#9603) (69cb240)

Bug Fixes

• auth/oauth2adapt: Update protobuf dep to v1.33.0 (30b038d)
• auth: Fix uint32 conversion (9221c7f)
• auth: Port sts expires fix (#9618) (7bec97b)
• auth: Read universe_domain from all credentials files (#9632) (16efbb5)
• auth: Remove content-type header from idms get requests (#9508) (8589f41)
• auth: Update protobuf dep to v1.33.0 (30b038d)

0.1.1 (2024-03-10)

Bug Fixes

• auth/impersonate: Properly send default detect params (#9529) (5b6b8be), refs #9136
• auth: Update grpc-go to v1.56.3 (343cea8)
• auth: Update grpc-go to v1.59.0 (81a97b0)

0.1.0 (2023-10-18)

Features

• auth: Add base auth package (#8465) (6a45f26)
• auth: Add cert support to httptransport (#8569) (37e3435)
• auth: Add Credentials.UniverseDomain() (#8654) (af0aa1e)
• auth: Add detect package (#8491) (d977419)
• auth: Add downscope package (#8532) (dda9bff)
• auth: Add grpctransport package (#8625) (69a8347)
• auth: Add httptransport package (#8567) (6898597)
• auth: Add idtoken package (#8580) (a79e693)
• auth: Add impersonate package (#8578) (e29ba0c)
• auth: Add support for external accounts in detect (#8508) (62210d5)
• auth: Port external account changes (#8697) (5823db5)

Bug Fixes

• auth/oauth2adapt: Update golang.org/x/net to v0.17.0 (174da47)
• auth: Update golang.org/x/net to v0.17.0 (174da47)