use rustls::pemfile;
use jsonwebtoken::encode;

let private_key = "/* service account JSON private key here */";

let mut certs = pemfile::pkcs8_private_keys(&mut private_key.as_bytes())?;

// Get the first cert, don't care if it errors
let key = certs.remove(0);

let token = encode(
    &header,
    &claims,
    &key.0
)

// Could also use the pem crate, but that seems overly complicated for just the specific
// case of GCP keys
let key_string = self.sa_key.private_key.splitn(5, "-----").nth(2).ok_or_else(|| "invalid key format")?;
// Skip the leading `\n`
let key_bytes = base64::decode_config(key_string[1..].as_bytes(), base64::MIME)?;

let auth_request_jwt = jwt::encode(
    &jwt::Header::new(jwt::Algorithm::RS256),
    &jwt_claims,
    &key_bytes,
)?;