I see in example Java codes there are possibilities to add scopes when one is requesting a refresh of a token:
credential.createScoped(Arrays.asList("someapi")).refreshToken
I saw the same in Python. But there is no configuration option for scopes in the cli.
gcloud auth application-default print-access-token
There is no gcloud auth --scopes="someapi" application-default print-access-token
Do you know how do I set up an access key for custom scopes in the cli?
I believe requesting custom scopes through the gcloud auth application-default print-access-token command is not available by design.
The reason is that you can login to Google Cloud SDK with either a user account or a service account. If you are logged in to a user account using gcloud auth application-default login, the Cloud SDK only requests for scopes for full access to GCP APIs.
Thus, when you run gcloud auth application-default print-access-token, the Google Cloud SDK does not have access to any APIs other than GCP through your logged in account and thus, it can't print an access token with custom scopes.
In the API, as in the gcloud auth print-access-token command, if you set a scope on a user account, it will fail. Only the service account can be scoped, not the user account.
In fact you can set scope on your user account credential like that gcloud auth application-default login --scopes=... And then, when you will generate a token, it will be automatically scoped correctly.
Keep in mind that you especially need to scope your credentials to access to no Google Cloud API (Workspace, Maps, Youtube,...)
The following tool helps obtaning a Bearer token that is working with the API:
oauth2l header --json PATH_TO_SERVICE_ACCOUNT_KEY businesscommunications
[ brew install oauth2l or https://github.com/google/oauth2l ]
