Gcloud Token

A read-only swamp vault that mints a fresh Google OAuth access token on every read by shelling out to the gcloud CLI. Google access tokens expire after about an hour; this vault never stores one, so long-running, multi-day automations never carry a stale credential.

• Never stale — the token is derived at read time from your active gcloud session.
• Nothing to leak — the vault holds no secret material; put() is refused and list() advertises only the single ACCESS_TOKEN key.
• No credential plumbing — no service-account key file, refresh token, or OAuth consent flow to manage.

Handles corporate TLS-inspecting-proxy (Zscaler, Netskope) CA trust through optional pythonPath and caCertsFile config, so gcloud's bundled Python trusts the corporate root.

Use

swamp extension pull @atalanta/gcloud-token
swamp vault create @atalanta/gcloud-token google-docs-token \
  --config '{"gcloudPath":"/path/to/gcloud","scopes":"https://www.googleapis.com/auth/drive"}'

Then wire ${{ vault.get(google-docs-token, ACCESS_TOKEN) }} into a Google API model's globalArguments as the bearer credential. See docs/ for the full guides.

Initial release. Read-only vault that mints a fresh Google OAuth access token per read via gcloud; no stored secret. Optional pythonPath/caCertsFile for corporate TLS-inspecting proxies. Full Diátaxis docs included.