{
    "type": "gdch_service_account",
    "format_version": "1",
    "project": "<project name>",
    "private_key_id": "<key id>",
    "private_key": "-----BEGIN EC PRIVATE KEY-----\n<key bytes>\n-----END EC PRIVATE KEY-----\n",
    "name": "<service identity name>",
    "ca_cert_path": "<CA cert path>",
    "token_uri": "https://service-identity.<Domain>/authenticate"
}

git clone https://github.com/googleapis/google-auth-library-python.git
cd google-auth-library-python
git checkout gdch_jwt
python -m pip install -e .
python -m pip install requests
python -m pip install cryptography

import google.auth
from google.auth.transport import requests

api_endpoint = "<fill in the api endpoint>"

creds, project_id = google.auth.default()
creds = creds.with_gdch_audience(api_endpoint)

def test_get_token():
    req = requests.Request()
    creds.refresh(req)
    print(creds.token)

def test_call_api(ca_cert_path=None):
    authed_session = requests.AuthorizedSession(creds)
    response = authed_session.request("GET", api_endpoint, verify=ca_cert_path)
    print(response.status_code)
    print(response.text)

if __name__=="__main__":
    # If you want to test if a token can be obtained, run test_get_token
    test_get_token()

    # if you also want to test if we can call the api endpoint, run test_call_api.
    # provide the CA cert via ca_cert_path parameter if needed.
    # (note that test_get_token is not necessary, since when we call the api
    # endpoint, token will be automatically refreshed)
    test_call_api(ca_cert_path=None)