feat(auth): add Application Default Credentials (ADC) auth mode#357
Merged
steipete merged 4 commits intoopenclaw:mainfrom Mar 8, 2026
Merged
feat(auth): add Application Default Credentials (ADC) auth mode#357steipete merged 4 commits intoopenclaw:mainfrom
steipete merged 4 commits intoopenclaw:mainfrom
Conversation
When GOG_AUTH_MODE=adc, the CLI authenticates using ambient credentials (GKE Workload Identity, GOOGLE_APPLICATION_CREDENTIALS, or gcloud ADC) instead of the keyring-based OAuth flow. This enables use in environments like GKE pods where the service account accesses resources explicitly shared with it — no domain-wide delegation or user impersonation needed. The account email is no longer required in ADC mode; requireAccount() returns "adc" as a placeholder when no --account/GOG_ACCOUNT is set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
39b77da to
0545735
Compare
Collaborator
|
Landed after manual rebase/conflict resolution onto main.
Thanks @tengis617! |
klodr
pushed a commit
to klodr/gogcli
that referenced
this pull request
Apr 22, 2026
…claw#357) * feat: add Application Default Credentials (ADC) auth mode When GOG_AUTH_MODE=adc, the CLI authenticates using ambient credentials (GKE Workload Identity, GOOGLE_APPLICATION_CREDENTIALS, or gcloud ADC) instead of the keyring-based OAuth flow. This enables use in environments like GKE pods where the service account accesses resources explicitly shared with it — no domain-wide delegation or user impersonation needed. The account email is no longer required in ADC mode; requireAccount() returns "adc" as a placeholder when no --account/GOG_ACCOUNT is set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(auth): add ADC mode (openclaw#357) (thanks @tengis617) * fix(auth): satisfy ADC lint on landed branch (openclaw#357) * test(auth): fix ADC test whitespace lint (openclaw#357) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Peter Steinberger <steipete@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GOG_AUTH_MODE=adcenvironment variable that switches the CLI to use Application Default Credentials instead of the keyring-based OAuth flowgcloud auth application-default login— no OAuth client credentials or keyring needed--account/GOG_ACCOUNTis optional (defaults to"adc"label); the service account accesses only resources explicitly shared with itChanges
internal/googleapi/client.go—IsADCMode()helper;optionsForAccountScopesshort-circuits togoogle.DefaultTokenSourcewhen ADC is active, skipping keyring/OAuth entirely.newADCTokenSourcepackage-var follows existing testability pattern.internal/cmd/account.go—requireAccountreturns early in ADC mode so no email or keyring lookup is required.internal/googleapi/client_more_test.go— Tests forIsADCMode(3 cases) and the fulloptionsForAccountScopesADC path, asserting that keyring and client credentials are never touched.Test plan
TestIsADCMode— empty,"adc", and"oauth"valuesTestOptionsForAccountScopes_ADCMode— verifies ADC token source is called with correct scopes and keyring/credentials helpers are not invokedmake fmtpassesmake testpasses for./internal/googleapi/🤖 Generated with Claude Code