# Google Auth Library Client - Class ImpersonatedServiceAccountCredentials (1.50.1)

1.50.1 (latest) 1.50.0 1.49.0 1.48.1 1.47.1 1.46.0 1.45.2 Reference documentation and code samples for the Google Auth Library Client class ImpersonatedServiceAccountCredentials.

**IMPORTANT**:
This class does not validate the credential configuration. A security
risk occurs when a credential configuration configured with malicious urls
is used.

When the credential configuration is accepted from an
untrusted source, you should validate it before creating this class.

## Namespace

Google \\ Auth \\ Credentials

## Methods

### __construct

Instantiate an instance of ImpersonatedServiceAccountCredentials from a credentials file that
has be created with the --impersonate-service-account flag.

| **Parameters** ||
|---|---|
| **Name** | **Description** |
| `scope` | `string|string[]|null` The scope of the access request, expressed either as an array or as a space-delimited string. |
| `jsonKey` | `string|array` JSON credential file path or JSON array credentials { JSON credentials as an associative array. @type string                         $service_account_impersonation_url The URL to the service account @type string|FetchAuthTokenInterface $source_credentials The source credentials to impersonate @type int                            $lifetime The lifetime of the impersonated credentials @type string[]                       $delegates The delegates to impersonate } |
| `targetAudience` | `string|null` The audience to request an ID token. |
| `defaultScope` | `string|string[]|null` The scopes to be used if no "scopes" field exists in the `$jsonKey`. |

### getClientName

Get the client name from the keyfile

In this implementation, it will return the issuers email from the oauth token.

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `unusedHttpHandler` | `callable|null` not used by this credentials type. |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `string` | Token issuer email |

### fetchAuthToken

Fetches the auth tokens based on the current state.

| **Parameter** ||
|---|---|
| **Name** | **Description** |
| `httpHandler` | `callable|null` |

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `array` | { A set of auth related metadata, containing the following @type string $access_token @type int $expires_in @type string $scope @type string $token_type @type string $id_token } |

### getCacheKey

Returns the Cache Key for the credentials
The cache key is the same as the UserRefreshCredentials class

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `string` |   |

### getLastReceivedToken

Returns an associative array with the token and
expiration time.

| **Returns** ||
|---|---|
| **Type** | **Description** |
| `array` |   |

### getUniverseDomain

Get the universe domain from the credential. Defaults to "googleapis.com"
for all credential types which do not support universe domain.