Credentials from ParseVertexAICredentials.
Where the key came from (VertexKeySourceOf); only the environment key may name a key file.
Creates the GoogleAuth; the default is google-auth-library's.
The headers that authorize one request, with lower-case names: authorization: Bearer <token>, plus
x-goog-user-project when the credentials name a quota project. Only a new or expiring token costs a round trip
to Google.
The request URL; the library uses it as the audience of a self-signed JWT.
Mints the request headers that authorize a call to Vertex AI. The
GoogleAuthwraps the clientCreateVertexAuthClientbuilds (an inline service account, or a key file from the environment key), or, with no credentials, resolves Application Default Credentials (workload identity on GKE and Cloud Run, the metadata server on GCE,GOOGLE_APPLICATION_CREDENTIALS), always with thecloud-platformscope. It is created on first use and kept, so the library caches the token until shortly before it expires.