PyPI History

• Adds support for X509 workload credential type (#1541) (1270217)

• Adds X509 workload cert logic (#1527) (05220e0)

• Added py.typed to MANIFEST.in (#1526) (1829a3b)
• Pass trust_env kwarg to ClientSession (#1533) (6c15c9a), closes #1530

• Add WebAuthn plugin component to handle WebAuthn get assertion request (#1464) (e25f336)
• ECP Provider drop cryptography requirement (#1524) (a821d71)
• Enable webauthn plugin for security keys (#1528) (e2d5e63)

• Fix id_token iam endpoint for non-gdu service credentials (#1506) (93d681e)
• Makes default token_url universe aware (#1514) (045776e)

• Adds support for custom suppliers in AWS and Identity Pool credentials (#1496) (3af1768)

• Refactor tech debt in aws and identity pool credentials (#1501) (ce435b0)

• Remove gce log for expected 404 (#1491) (cb04e49)

• Typo when setting the state for the pickle deserializer. (#1479) (08b5cc3)

• Adding universe domain support for downscroped credentials (#1463) (fa8b7b2)

• Change log level to debug for return_none_for_not_found_error (#1473) (a036b47)
• Make requests import conditional for gce universe domain (#1476) (9bb64c8)

• Add optional account association for Authorized User credentials. (#1458) (988153d)

• Allow custom universe domain for gce creds (#1460) (7db5823)
• Conditionally import requests only if no request was passed by the caller. (#1456) (9cd6742)

• Read universe_domain for external account authorized user (#1450) (1cc7df3)

• Ensure that refresh worker is pickle-able. (#1447) (421c184)

• Add optional non blocking refresh for sync auth code (a6dc2c3)
• Add optional non blocking refresh for sync auth code (#1368) (a6dc2c3)

• External account user cred universe domain support (#1437) (75068f9)
• Guard delete statements. Add default fallback for _use_non_blocking_refresh. (#1445) (776d634)

• Fix user cred universe domain issue (#1436) (ae314a8)

• Fix vm universe_domain bug (#1433) (8683520)

• Add custom tls signer for ECP Provider. (39eb287)
• Add custom tls signer for ECP Provider. (#1402) (39eb287)

• Add with_universe_domain (#1408) (505910c)
• Fixes issue where Python37DeprecationWarning cannot be filtered (#1428) (f22f767)
• Remove broken link in Python37DeprecationWarning (#1430) (e2db602)

• Add support for Python 3.12 (#1421) (307916c)
• Add universe domain support for VM cred (#1409) (7ab0fce)
• Modify the token refresh window (#1419) (c6af1d6)

• Add missing before request to async oauth2 credentials. (#1420) (8eaa878)
• Auto create self signed jwt cred (#1418) (6c610a5)
• Migrate datetime.utcnow for python 3.12 (#1413) (e4d9c27)

• Update user cred doc (#1414) (3f426bc)

• Export detect_gce_residency_linux function (#1403) (809da13)

• Serialize signer keys on getstate for pickling (#1394) (8b783b9), closes #1383

• Support urllib3<2.0 versions (#1390) (07c464a)

• Less restrictive content-type header check for google authentication (ignores charset) (#1382) (7039beb)
• Trust boundary meta header renaming and using the schema from backend team. (#1384) (2503d4a)
• Update urllib3 to >= 2.0.5 (#1389) (a99f3bb)

• Add get_bq_config_path() to _cloud_sdk.py (9f52f66)
• Add get_bq_config_path() to _cloud_sdk.py (#1358) (9f52f66)

• Expose universe domain in credentials (#1380) (8b8fce6)
• Make external_account resistant to string type 'expires_in' responses from non-compliant services (#1379) (01d3770)
• Missing ssj for impersonate cred (#1377) (7d453dc)
• Skip checking projectid on cred if env var is set (#1349) (a4135a3)

• Adding meta header for trust boundary (#1334) (908c8d1)
• Introduce compatibility with native namespace packages (#1205) (2f75922)

• Deprecate UserAccessTokenCredentials (#1344) (5f97fe9)

• Add framework for BYOID metrics headers (#1332) (1a8f50c)

• Pypy unit test build (#1335) (33e4263)

• Add public API load_credentials_from_dict (#1326) (5467ad7)

• Expiry in compute_engine.IDTokenCredentials (#1327) (56a6159), closes #1323
• Expiry in impersonated_credentials.IDTokenCredentials (#1330) (d1b887c)
• Invalid dev version identifiers in setup.py (#1322) (a9b8f12), closes #1321

• Check id token error response (#1315) (2a71f7b)
• Fix "AttributeError: 'str' object has no attribute 'get'" (dac7cc3)

• Replacing abc.com with example.com (dac7cc3)

• Add metrics (part 1) (#1298) (246dd07)
• Add metrics (part 2) (#1303) (ebd5af7)
• Add metrics (part 3) (#1305) (c7011b6)
• Expose universe_domain for external account creds (#1296) (ee07053)
• Remove python 2.7 from setup.py and nox tests (#1301) (8437490)

• Self signed jwt token should be string type (#1294) (17356fd)

• Add smbios check to detect GCE residency (#1276) (22d241b)
• Universe domain support for service account (#1286) (821c1b6)

• Add useEmailAzp claim for id token iam flow (#1270) (7a9c6f2)

• Do not create new JWT credentials if they make the same claims as the existing. (#1267) (eebb7b6)

• Print out reauth plugin error and raise if challenge output is None (#1265) (08d22fe)

• Experimental service account iam endpoint flow for id token (#1258) (8ff0de5)

• Python: Remove aws url validation (#1254) (20a966b)

• Read both applicationId and relyingPartyId. (#1246) (e125dfe)

• Call gcloud config get project to get project for user cred (#1243) (c078a13)
• Do not use hardcoded string 'python', when you mean sys.executable. (#1233) (91ac8e6)
• Don't retry if error or error_description is not string (#1241) (e2d263a)
• Improve ADC related errors and warnings (#1237) (2dfa213)

• Add support for python 3.11 (#1212) (1fc95e3)
• Remove 3PI config url validation (#1220) (8b95515)
• Update the docs generator interpreter to unblock documentation build (#1218) (9d36c2f)

• AwsCredentials should not call metadata server if security creds and region are retrievable through the environment variables (#1195) (5e27c8f)
• Wrap all python built-in exceptions into library excpetions (#1191) (a83af39)

• Allow get_project_id to take a request (#1203) (9a4d23a)
• Make OAUTH2.0 client resistant to string type 'expires_in' responses from non-compliant services (#1208) (9fc7b1c)

• Add api_key credentials (#1184) (370293e)
• Introduce a way to provide scopes granted by user (#1189) (189f504)

• Allow mtls sts endpoint for external account token urls. (#1185) (c86dd69)
• CI broken by removal of py.path (#1194) (f719415)
• Ensure JWT segments have the right types (#1162) (fc843cd)
• Updated the lower bound of interactive timeout and fix the kwarg… (#1182) (50c0fd2)

• Apply quota project for compute cred in adc (#1177) (b9aa92a)
• Update minimum required version of cryptography in pyopenssl extra (#1176) (e9e76d1)
• Validate url domain for aws metadata urls (#1174) (f9d7d77)

• Add token_info_url to external account credentials (#1168) (9adee75)
• Read Quota Project from Environment Variable (#1163) (57b3e42)

• Adding more properties to external_account_authorized_user (#1169) (a12b96d)

• Adds new external account authorized user credentials (#1160) (523f811)
• Implement pluggable auth interactive mode (#1131) (44a189f)
• Introduce the functionality to override token_uri in credentials (#1159) (73bc7e9)

• Adding one more pattern to relax the regex check for sts and impersonation url endpoints (#1158) (75326e3)

• Retry behavior (#1113) (78d3790)

• Modify RefreshError exception to use gcloud ADC command. (#1149) (059fd35)
• Revert "Update token refresh threshold from 20 seconds to 5 minutes". (186464b)

• Fix socket leak in impersonated_credentials (#1123) (b1eb467), closes #1122
• Make pluggable auth tests work in all environments (#1114) (bb5c979)
• Skip oauth2client adapter tests if oauth2client is not installed (#1132) (d15092f)
• Update token refresh threshold from 20 seconds to 5 minutes (#1146) (261a561)

• samples: Add auth samples and tests (#1102) (ac87520)

• add integration tests for configurable token lifespan (#1103) (124bae6)

• Async certificate retrieving (#1101) (05f125d)

• add integration tests for pluggable auth (#1073) (f8d776a)
• support for configurable token lifetime (0dc6a9a)
• support for configurable token lifetime (#1079) (0dc6a9a)

• async certificate decoding (#1085) (741c6c6)
• Async system tests were not unwrapping async_generators (#1086) (29d248a)
• Fix IDTokenCredentials update bug (#1072) (b62c25c)
• make expiration_time optional in response schema (#1091) (032fb8d)
• refactor credential subclass parameters (#1095) (8d15f69)

• there was a raise missing for throwing exceptions (#1077) (d1f17b0)

• pluggable auth support (#1045) (de14f4e)

• add experimental GDCH support (#1044) (94fb5e2)

• add experimental enterprise cert support (#1052) (dda7dda)
• add experimental GDCH support (#1022) (5367aac)
• Pluggable auth support (#995) (62daa73)

• validate urls for external accounts (#1031) (61b1f15)

• pluggable auth support #995 (#1039) (513d999)
• revert experimental GDCH support (#1022) (#1042) (c720995)

• fix changelog header to consistent size (#1046) (e64d084)

• silence TypeError during tear down stage (#1027) (952a6aa)

• add additional missing import in _default.py (#1018) (638331b)

• fix missing import in _default.py (#1015) (63f4e38)

• change requests lib import place (#1010) (c753c08)
• clean up HTTP session and pool during tear down phase (#1007) (d057376)
• pin click version and update sys test creds (#1008) (ae2804b)

• Rename aws imdsv2 url field and update token lifetime (#982) (818e6d2)

• let release-please finish the release (#991) (d2bdc9a)

• Add AWS session token to metadata requests (#958) (5c7f734)

• ADC can load an impersonated service account credentials. (#962) (52c8ef9)

• revert "feat: add api key support (#826)" (#964) (f9f23f4)

• ADC can load an impersonated service account credentials. (#956) (a8eb4c8)

• urllib3 import (#953) (c8b5cae)

• add 'py.typed' declaration (#919) (c993504)
• add api key support (#826) (3b15092)

• deps: allow cachetools 5.0 for python 3.7+ (#937) (1eae37d)
• fix the message format for metadata server exception (#916) (e756f08)

• fix intersphinx link for 'requests-oauthlib' (#921) (967be4f)
• note ValueError in verify_oauth2_token (#928) (82bc5f0)

• add fetch_id_token_credentials (#866) (8f1e9cf)
• fix error in sign_bytes (#905) (ef31284)
• use 'int.to_bytes' and 'int.from_bytes' for py3 (#904) (bd0ccc5)

• add clock_skew_in_seconds to verify_token functions (#894) (8e95c1e)

• add back python 2.7 for gcloud usage only (#892) (5bd5ccf)

• Fix formatting of GCE_METADATA_HOST (#890) (e2b3c98)

• add support for Python 3.10 (#882) (19d41f8)

• ADC with impersonated workforce pools (#877) (10bd9fb)

• disable self signed jwt for domain wide delegation (#873) (0cd15e2)

• add support for workforce pool credentials (#868) (993bab2)

• Improve handling of clock skew (#858) (45c4491)

• add SAML challenge to reauth (#819) (13aed5f)
• disable warning if quota project id provided to auth.default() (#856) (11ebaeb)
• rename CLOCK_SKEW and separate client/server user case (#863) (738611b)

• use 'int.to_bytes' rather than deprecated crypto wrapper (#848) (b79b554)
• use int.from_bytes (#846) (466aed9)

• normalize AWS paths correctly on windows (#842) (4e0fb1c)

• drop support for Python 2.7 (#778) (560cf1e)

• service account is able to use a private token endpoint (#835) (20b817a)

• downscoping documentation bugs (#830) (da8bb13)
• Fix missing space in error message. (#821) (7b03988)

• update user guide/references for downscoped creds (#827) (d1840dc)

• drop support for Python 2.7 (#778) (560cf1e)

• support refresh callable on google.oauth2.credentials.Credentials (#812) (ec2fb18)

• do not use the GAE APIs on gen2+ runtimes (#807) (7f7d92d)

• fallback to source creds expiration in downscoped tokens (#805) (dfad661)

• revert "feat: service account is able to use a private token endpoint (#784)" (#808) (d94e65c)

• define CredentialAccessBoundary classes (#793) (d883921)
• define google.auth.downscoped.Credentials class (#801) (2f5c3a6)
• service account is able to use a private token endpoint (#784) (0e26409)

• fix fetch_id_token credential lookup order to match adc (#748) (c34452e)

• fix code block formatting in 'user-guide.rst' (#794) (4fd84bd)

• avoid leaking sub-session created for '_auth_request' (#789) (2079ab5)

• allow scopes for self signed jwt (#776) (2cfe655)

• define useful properties on google.auth.external_account.Credentials (#770) (f97499c)

• avoid deleting items while iterating (#772) (a5e6b65)

• dependencies: add urllib3 and requests to aiohttp extra (#755) (a923442)
• enforce constraints during unit tests (#760) (1a6496a), closes #759
• session object was never used in aiohttp request (#700) (#701) (09e0389)

• allow user to customize context aware metadata path in _mtls_helper (#754) (e697687)
• fix function name in signing error message (#751) (e9ca25f)

• add reauth support to async user credentials for gcloud (#738) (9e10823). This internal feature is for gcloud developers only.

• add reauth feature to user credentials for gcloud (#727) (82293fe). This internal feature is for gcloud developers only.

• Allow multiple audiences for id_token.verify_token (#733) (56c3946)

• support custom alg in jwt header for signing (#729) (0a83706)

• allow the AWS_DEFAULT_REGION environment variable (#721) (199da47)
• expose library version at google.auth.__version (#683) (a2cbc32)

• fix unit tests so they can work in g3 (#714) (d80c85f)

• ignore gcloud warning when getting project id (#708) (3f2f3ea)
• use gcloud creds flow (#705) (333cb76)

• workload identity federation support (#698) (d4d7f38)

• add pyopenssl as extra dependency (#697) (aeab5d0)

• fix a typo in the user guide (avaiable -> available) (#680) (684457a)

• revert workload identity federation support (#691)

• workload identity federation support (#686) (5dcd2b1)

• support self-signed jwt in requests and urllib3 transports (#679) (7a94acb)
• use self-signed jwt for service account (#665) (bf5ce0c)

• add Python 3.9 support, drop Python 3.5 support (#655) (6de753d), closes #654

• avoid losing the original '_include_email' parameter in impersonated credentials (#626) (fd9b5b1)

• fix typo in import (#651) (3319ea8), closes #650

• Add custom scopes for access tokens from the metadata service (#633) (0323cf3)

• deps: Revert "fix: pin 'aoihttp < 3.7.0dev' (#634)" (#632) (#640) (b790e65)
• pin 'aoihttp < 3.7.0dev' (#634) (05f9524)
• remove checks for ancient versions of Cryptography (#596) (6407258), closes /github.com/googleapis/google-auth-library-python/issues/595#issuecomment-683903062

• move aiohttp to extra as it is currently internal surface (#619) (a924011), closes #618

• add asyncio based auth flow (#612) (7e15258), closes #572

• fix expiry for to_json() (#589) (d0e0aba), closes /github.com/googleapis/oauth2client/blob/master/oauth2client/client.py#L55

• migrate signBlob to iamcredentials.googleapis.com (#600) (694d83f)

• dummy commit to trigger a auto release (#597) (d32f7df)

• add GOOGLE_API_USE_CLIENT_CERTIFICATE support (#592) (c0c995f)

• reduce refresh clock skew to 10 seconds (#581) (42321ba)
• set Content-Type header in the request to signBlob API to avoid Invalid JSON payload error (#439) (20f82e2)

• Add debug logging that can help with diagnosing auth lib. path (#473) (ecd88d4)
• Show the transport exception that happened for GCE Metadata (#474) (23919bb)
• packaging: add support for Python 3.8 (#569) (1aad54a), closes #568

• Revert "fix: migrate signBlob to iamcredentials.googleapis.com" (#563) (a48b5b)

• don't add empty quota project (#560) (ab2be5d)

• add quota project to base credentials class (#546) (3dda7b2)
• check 'iss' in verify_oauth2_token (#500) (c05b8b5)

• migrate signBlob to iamcredentials.googleapis.com (#553) (038ae1b)

• remove 3.4 from supported versions list (#549) (8c84d0f)

• make load_credentials_from_file a public method (#530) (15d5fa9)

• no warning if quota_project_id is given (#537) (f30b45a)

• dependencies: Further restrict RSA versions (#532) (46677a0), closes #528

• narrow acceptable RSA versions to maintain Python 2 compatability (#528) (9434868)

• add quota_project_id to service accounts; add with_quota_project methods (#519) (b12488c)

• fix impersonated cred exception doc (#521) (9d5a9a9)
• replace environment variable GCE_METADATA_ROOT with GCE_METADATA_HOST (#433) (8ffb4d3), closes #339

• add helper func to for default encrypted cert (#514) (f282aa4)

• fix impersonated cred for gcloud (#516) (eb7be3f)

• encrypted mtls private key support (#496) (9dc9e9f)

• signBytes for impersonated credentials (#506) (ca8d98a), closes #338

• catch exceptions.RefreshError (#508) (3d672e9)

• support string type response.data (#504) (9b7228e)

• support es256 raw format signature (#490) (cf2c0a9)

• add default client cert source util (#486) (ed41b49)

• invalid expiry type (#481) (7ae9a28)

• add access token credentials (#476) (772dac6)
• add fetch_id_token to support id_token adc (#469) (506c565)
• consolidate mTLS channel errors (#480) (e83d446)
• Implement ES256 for JWT verification (#340) (e290a3d)

• add mTLS ADC support for HTTP (#457) (bb9215a)
• add SslCredentials class for mTLS ADC (#448) (dafb41f)
• fetch id token from GCE metadata server (#462) (97e7700)

• don't use threads for gRPC AuthMetadataPlugin (#467) (ee373f8)
• make ThreadPoolExecutor a class var (#461) (b526473)

• fix the scopes so test can pass for a local run (#450) (b2dd77f)
• only add IAM scope to credentials that can change scopes (#451) (82e224b)

• Revert "fix: update _GOOGLE_OAUTH2_CERTS_URL (#365)" (#444) (901c259), closes #365 #444

• compute engine id token credentials "with_target_audience" method (#438) (bc0ec93)
• update _GOOGLE_OAUTH2_CERTS_URL (#365) (054db75)

• add non-None default timeout to AuthorizedSession.request() (#435) (d274a3a), closes #434 googleapis/google-cloud-python#10182
• distinguish transport and execution time timeouts (#424) (52a733d), closes #423

• make collections import compatible across Python versions (#419) (c5a3395), closes #418

• google.auth.compute_engine.metadata: add retry to google.auth.compute_engine._metadata.get() (#398) (af29c1a), closes #211 #323 #323 #211
• always pass body of type bytes to google.auth.transport.Request (#421) (a57a770), closes #318

• send quota project id in x-goog-user-project for OAuth2 credentials (#412) (32d71a5), closes #400

• add timeout parameter to AuthorizedSession.request() (#406) (d86d7b8)

• revert "feat: send quota project id in x-goog-user-project header for OAuth2 credentials (#400)" (#407) (25ea942)

• revert "feat: add timeout to AuthorizedSession.request() (#397)" (#401) (451ecbd)

• add to_json method to google.oauth2.credentials.Credentials (#367) (bfb1f8c)
• add timeout to AuthorizedSession.request() (#397) (381dd40)
• send quota project id in x-goog-user-project header for OAuth2 credentials (#400) (ab3dc1e)

• in token endpoint request, do not decode the response data if it is not encoded (#393) (3b5d3e2)
• make gRPC auth plugin non-blocking + add default timeout value for requests transport (#390) (0c33e9c), closes #351

• change 'internal_failure' condition to also use `error' field (#387) (46bb58e)

10-30-2019 17:11 PDT

• Add retry loop for fetching authentication token if any 'Internal Failure' occurs (#368)
• Use cls parameter instead of class (#341)

• Add support for impersonated_credentials.Sign, IDToken (#348)
• Add downscoping to OAuth2 credentials (#309)

• Update dependency cachetools to v3 (#357)
• Update dependency rsa to v4 (#358)
• Set an upper bound on dependencies version (#352)
• Require a minimum version of setuptools (#322)

• Add busunkim96 as maintainer (#373)
• Update user-guide.rst (#337)
• Fix typo in jwt docs (#332)
• Clarify which SA has Token Creator role (#330)

• Change 'name' to distribution name (#379)
• Fix system tests, move to Kokoro (#372)
• Blacken (#375)
• Rename nox.py -> noxfile.py (#369)
• Add initial renovate config (#356)
• Use new pytest api to keep building with pytest 5 (#353)

02-15-2019 9:31 PST

• follow rfc 7515 : strip padding from JWS segments (#324)
• Add retry to _metadata.ping() (#323)

12-17-2018 10:51 PST

• Announce deprecation of Python 2.7 (#311)
• Link all the PRs in CHANGELOG (#307)

11-12-2018 10:10 PST

• Automatically refresh impersonated credentials (#304)

11-09-2018 11:07 PST

• Add google.auth.impersonated_credentials (#299)

• Update link to documentation for default credentials (#296)
• Update github issue templates (#300)
• Remove punctuation which becomes part of the url (#284)

• Update trampoline.sh (302)
• Enable static type checking with pytype (#298)
• Make classifiers in setup.py an array. (#280)

• Fix check for error text on Python 3.7. (#278)
• Use new Auth URIs. (#281)
• Add code-of-conduct document. (#270)
• Fix some typos in test_urllib3.py (#268)

• Warn when using user credentials from the Cloud SDK (#266)
• Add compute engine-based IDTokenCredentials (#236)
• Corrected some typos (#265)

• Raise a helpful exception when trying to refresh credentials without a refresh token. (#262)
• Fix links to README and CONTRIBUTING in docs/index.rst. (#260)
• Fix a typo in credentials.py. (#256)
• Use pytest instead of py.test per upstream recommendation, #dropthedot. (#255)
• Fix typo on exemple of jwt usage (#245)

• Added a check for the cryptography version before attempting to use it. (#243)

• Added cryptography-based RSA signer and verifier. (#185)
• Added google.oauth2.service_account.IDTokenCredentials. (#234)
• Improved documentation around ID Tokens (#224)

• Added google.oauth2.credentials.Credentials.from_authorized_user_file (#226)
• Dropped direct pyasn1 dependency in favor of letting pyasn1-modules specify the right version. (#230)
• default() now checks for the project ID environment var before warning about missing project ID. (#227)
• Fixed the docstrings for has_scopes() and with_scopes(). (#228)
• Fixed example in docstring for ReadOnlyScoped. (#219)
• Made transport.requests use timeouts and retries to improve reliability. (#220)

• Excluded compiled Python files in source distributions. (#215)
• Updated docs for creating RSASigner from string. (#213)
• Use six.raise_from wherever possible. (#212)
• Fixed a typo in a comment seconds not sections. (#210)

• Added google.auth.credentials.AnonymousCredentials. (#206)
• Updated the documentation to link to the Google Cloud Platform Python setup guide (#204)

• google.oauth.credentials.Credentials now correctly inherits from ReadOnlyScoped instead of Scoped. (#200)

• Added service_account.Credentials.project_id. (#187)
• Move read-only methods of credentials.Scoped into new interface credentials.ReadOnlyScoped. (#195, #196)
• Make compute_engine.Credentials derive from ReadOnlyScoped instead of Scoped. (#195)
• Fix App Engine's expiration calculation (#197)
• Split crypt module into a package to allow alternative implementations. (#189)
• Add error message to handle case of empty string or missing file for GOOGLE_APPLICATION_CREDENTIALS (#188)

• Fixed a bug where the Cloud SDK executable could not be found on Windows, leading to project ID detection failing. (#179)
• Fixed a bug where the timeout argument wasn't being passed through the httplib transport correctly. (#175)
• Added documentation for using the library on Google App Engine standard. (#172)
• Testing style updates. (#168)
• Added documentation around the oauth2client deprecation. (#165)
• Fixed a few lint issues caught by newer versions of pylint. (#166)

• Fixed a bug in the clock skew accommodation logic where expired credentials could be used for up to 5 minutes. (#158)

Milestone release for v1.0.0. No significant changes since v0.10.0

• Added jwt.OnDemandCredentials. (#142)
• Added new public property id_token to oauth2.credentials.Credentials. (#150)
• Added the ability to set the address used to communicate with the Compute Engine metadata server via the GCE_METADATA_ROOT and GCE_METADATA_IP environment variables. (#148)
• Changed the way cloud project IDs are ascertained from the Google Cloud SDK. (#147)
• Modified expiration logic to add a 5 minute clock skew accommodation. (#145)

• Added service_account.Credentials.with_claims. (#140)
• Moved google.auth.oauthlib and google.auth.flow to a new separate package google_auth_oauthlib. (#137, #139, #135, #126)
• Added InstalledAppFlow to google_auth_oauthlib. (#128)
• Fixed some packaging and documentation issues. (#131)
• Added a helpful error message when importing optional dependencies. (#125)
• Made all properties required to reconstruct google.oauth2.credentials.Credentials public. (#124)
• Added official Python 3.6 support. (#102)
• Added jwt.Credentials.from_signing_credentials and removed service_account.Credentials.to_jwt_credentials. (#120)

• Removed one-time token behavior from jwt.Credentials, audience claim is now required and fixed. (#117)
• crypt.Signer and crypt.Verifier are now abstract base classes. The concrete implementations have been renamed to crypt.RSASigner and crypt.RSAVerifier. app_engine.Signer and iam.Signer now inherit from crypt.Signer. (#115)
• transport.grpc now correctly calls Credentials.before_request. (#116)

• Added google.auth.iam.Signer. (#108)
• Fixed issue where google.auth.app_engine.Signer erroneously returns a tuple from sign(). (#109)
• Added public property google.auth.credentials.Signing.signer. (#110)

• Added experimental integration with requests-oauthlib in google.oauth2.oauthlib and google.oauth2.flow. (#100, #105, #106)
• Fixed typo in google_auth_httplib2's README. (#105)

• Added app_engine.Signer. (#97)
• Added crypt.Signer.from_service_account_file. (#95)
• Fixed error handling in the oauth2 client. (#96)
• Fixed the App Engine system tests.

• transports.grpc.secure_authorized_channel now passes kwargs to grpc.secure_channel. (#90)
• Added new property credentials.Singing.signer_email which can be used to identify the signer of a message. (#89)
• (google_auth_httplib2) Added a proxy to httplib2.Http.connections.

• Fixed an issue where an ImportError would occur if google.oauth2 was imported before google.auth. (#88)

• Fixed a bug where non-padded base64 encoded strings were not accepted. (#87)
• Fixed a bug where ID token verification did not correctly call the HTTP request function. (#87)

• Added Google ID token verification helpers. (#82)
• Swapped the target and request argument order for grpc.secure_authorized_channel. (#81)
• Added a user's guide. (#79)
• Made service_account_email a public property on several credential classes. (#76)
• Added a scope argument to google.auth.default. (#75)
• Added support for the GCLOUD_PROJECT environment variable. (#73)

• Added gRPC support. (#67)
• Added Requests support. (#66)
• Added google.auth.credentials.with_scopes_if_required helper. (#65)
• Added private helper for oauth2client migration. (#70)

First release with core functionality available. This version is ready for initial usage and testing.

• Added google.auth.credentials, public interfaces for Credential types. (#8)
• Added google.oauth2.credentials, credentials that use OAuth 2.0 access and refresh tokens (#24)
• Added google.oauth2.service_account, credentials that use Service Account private keys to obtain OAuth 2.0 access tokens. (#25)
• Added google.auth.compute_engine, credentials that use the Compute Engine metadata service to obtain OAuth 2.0 access tokens. (#22)
• Added google.auth.jwt.Credentials, credentials that use a JWT as a bearer token.
• Added google.auth.app_engine, credentials that use the Google App Engine App Identity service to obtain OAuth 2.0 access tokens. (#46)
• Added google.auth.default(), an implementation of Google Application Default Credentials that supports automatic Project ID detection. (#32)
• Added system tests for all credential types. (#51, #54, #56, #58, #59, #60, #61, #62)
• Added google.auth.transports.urllib3.AuthorizedHttp, an HTTP client that includes authentication provided by credentials. (#19)
• Documentation style and formatting updates.

Initial release with foundational functionality for cryptography and JWTs.

• google.auth.crypt for creating and verifying cryptographic signatures.
• google.auth.jwt for creating (encoding) and verifying (decoding) JSON Web tokens.