Getting an IAM token for a service account

pip3 install PyJWT
pip3 install cryptography

import time
import jwt
import json

# Reading a private key from a JSON file
with open('<JSON_file_with_keys>', 'r') as f: 
  obj = f.read() 
  obj = json.loads(obj)
  private_key = obj['private_key']
  key_id = obj['id']
  service_account_id = obj['service_account_id']

now = int(time.time())
payload = {
        'aud': 'https://iam.api.cloud.yandex.net/iam/v1/tokens',
        'iss': service_account_id,
        'iat': now,
        'exp': now + 3600
      }

# JWT generation.
encoded_token = jwt.encode(
    payload,
    private_key,
    algorithm='PS256',
    headers={'kid': key_id}
  )

#Writing a key to a file
with open('jwt_token.txt', 'w') as j:
   j.write(encoded_token)
   
# Printing to console
print(encoded_token)

package com.mycompany.java.jwt;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemReader;

import java.io.StringReader;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.time.Instant;
import java.util.Date;

public class JavaJwt {

    @JsonIgnoreProperties(ignoreUnknown = true)
    public static class KeyInfo {

        public String id;
        public String service_account_id;
        public String private_key;
    }

    public static void main(String[] args) throws Exception {

        String content = new String(Files.readAllBytes(Paths.get("<JSON_file_with_keys>")));
        KeyInfo keyInfo = (new ObjectMapper()).readValue(content, KeyInfo.class);

        String privateKeyString = keyInfo.private_key;
        String serviceAccountId = keyInfo.service_account_id;
        String keyId = keyInfo.id;

        PemObject privateKeyPem;
        try (PemReader reader = new PemReader(new StringReader(privateKeyString))) {
            privateKeyPem = reader.readPemObject();
        }

        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        PrivateKey privateKey = keyFactory.generatePrivate(new PKCS8EncodedKeySpec(privateKeyPem.getContent()));

        Instant now = Instant.now();

        // JWT generation.
        String encodedToken = Jwts.builder()
                .setHeaderParam("kid", keyId)
                .setIssuer(serviceAccountId)
                .setAudience("https://iam.api.cloud.yandex.net/iam/v1/tokens")
                .setIssuedAt(Date.from(now))
                .setExpiration(Date.from(now.plusSeconds(3600)))
                .signWith(privateKey, SignatureAlgorithm.PS256)
                .compact();
        System.out.println(encodedToken);
    }
}

using System;
using System.Collections.Generic;
using System.IO;
using System.Security.Cryptography;
using Jose;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.Security;

namespace ConsoleApp
{
    class Program
    {
        static void Main(string[] args)
        {
            var serviceAccountId = "<service_account_ID>";
            var keyId = "<public_key_ID>";
            var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

            var headers = new Dictionary<string, object>()
            {
                { "kid", keyId }
            };

            var payload = new Dictionary<string, object>()
            {
                { "aud", "https://iam.api.cloud.yandex.net/iam/v1/tokens" },
                { "iss", serviceAccountId },
                { "iat", now },
                { "exp", now + 3600 }
            };

            RsaPrivateCrtKeyParameters privateKeyParams;
            using (var pemStream = File.OpenText("<private_key_file>"))
            {
                privateKeyParams = new PemReader(pemStream).ReadObject() as RsaPrivateCrtKeyParameters;
            }

            using (var rsa = RSA.Create())
            {
                rsa.ImportParameters(DotNetUtilities.ToRSAParameters(privateKeyParams));
                string encodedToken = Jose.JWT.Encode(payload, rsa, JwsAlgorithm.PS256, headers);
            }
        }
    }
}

using System;
using System.Collections.Generic;
using System.IO;
using System.Security.Cryptography;
using Jose;

namespace ConsoleApp
{
    class Program
    {
        static void Main(string[] args)
        {
            var serviceAccountId = "<service_account_ID>";
            var keyId = "<public_key_ID>";
            var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

            var headers = new Dictionary<string, object>()
            {
                { "kid", keyId }
            };

            var payload = new Dictionary<string, object>()
            {
                { "aud", "https://iam.api.cloud.yandex.net/iam/v1/tokens" },
                { "iss", serviceAccountId },
                { "iat", now },
                { "exp", now + 3600 }
            };

            using (var rsa = RSA.Create())
            {
                rsa.ImportFromPem(File.ReadAllText("<private_key_file>").ToCharArray());
                string encodedToken = Jose.JWT.Encode(payload, rsa, JwsAlgorithm.PS256, headers);
            }
        }
    }
}

install jwt v5
go get -u github.com/golang-jwt/jwt/v5

package main  

import (
	"crypto/rsa"
	"encoding/json"
	"log"
	"os"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

func main() {
  // Getting a token
	 token := signedToken()
  // Saving the token to a file
	 err := os.WriteFile("jwt_token.txt", []byte(token), 0644)
	 if err != nil {
		log.Fatal(err)
	 }
	 // Printing the token to console
	 fmt.Println("Here is token:")
	 fmt.Println(token)
}

const (
  keyID            = "<public_key_ID>"
  serviceAccountID = "<service_account_ID>"
  keyFile          = "<JSON_file_with_keys>"
)

// JWT generation.
func signedToken() string {
	 claims := jwt.RegisteredClaims{
	 	Issuer:    serviceAccountID,
	 	ExpiresAt: jwt.NewNumericDate(time.Now().UTC().Add(1 * time.Hour)),
	 	IssuedAt:  jwt.NewNumericDate(time.Now().UTC()),
	 	NotBefore: jwt.NewNumericDate(time.Now().UTC()),
	 	Audience:  []string{"https://iam.api.cloud.yandex.net/iam/v1/tokens"},
	 }
	 token := jwt.NewWithClaims(jwt.SigningMethodPS256, claims)
	 token.Header["kid"] = keyID

	 privateKey := loadPrivateKey()
	 signed, err := token.SignedString(privateKey)
	 if err != nil {
		panic(err)
	 }
	 return signed
}

type keyFileStruct struct {
	 PrivateKey string `json:"private_key"`
}

func loadPrivateKey() *rsa.PrivateKey {
	 data, err := os.ReadFile(keyFile)
	 if err != nil {
		panic(err)
	 }

	 var keyData keyFileStruct
	 if err := json.Unmarshal(data, &keyData); err != nil {
		panic(err)
	 }

	 rsaPrivateKey, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(keyData.PrivateKey))
	 if err != nil {
		panic(err)
	 }
	 return rsaPrivateKey
}

var jose = require('node-jose');
var fs = require('fs');

var json = JSON.parse(fs.readFileSync(require.resolve('<JSON_file_with_keys>')));

var key = json.private_key;
var serviceAccountId = json.service_account_id;
var keyId = json.id;

var now = Math.floor(new Date().getTime() / 1000);

var payload = {
   aud: "https://iam.api.cloud.yandex.net/iam/v1/tokens",
   iss: serviceAccountId,
   iat: now,
   exp: now + 3600
};

jose.JWK.asKey(key, 'pem', { kid: keyId, alg: 'PS256' })
   .then(function (result) {
      jose.JWS.createSign({ format: 'compact' }, result)
         .update(JSON.stringify(payload))
         .final()
         .then(function (result) {
            console.log(result);
         });
   });

require 'vendor/autoload.php';

use Jose\Component\Core\AlgorithmManager;
use Jose\Component\KeyManagement\JWKFactory;
use Jose\Component\Signature\Algorithm\PS256;
use Jose\Component\Signature\JWSBuilder;
use Jose\Component\Signature\Serializer\CompactSerializer;

// Reading data from a file
$keyData = json_decode(file_get_contents("<JSON_file_with_keys>"), true);
$privateKeyPem = $keyData['private_key'];
$keyId = $keyData['id'];
$serviceAccountId = $keyData['service_account_id'];

// You need to delete header/metadata from the private key
if (strpos($privateKeyPem, "PLEASE DO NOT REMOVE THIS LINE!") === 0) {
    $privateKeyPem = substr($privateKeyPem, strpos($privateKeyPem, "\n") + 1);
}

$jwk = JWKFactory::createFromKey(
    $privateKeyPem, 
    null, 
    [
        'alg' => 'PS256',
        'use' => 'sig',
        'kid' => $keyId,
    ]
);

$algorithmManager = new AlgorithmManager([new PS256()]);
$jwsBuilder = new JWSBuilder($algorithmManager);

$payload = json_encode([
    'iss' => $serviceAccountId,
    'aud' => "https://iam.api.cloud.yandex.net/iam/v1/tokens",
    'iat' => time(),
    'nbf' => time(),
    'exp' => time() + 3600,
]);

$jws = $jwsBuilder
    ->create()
    ->withPayload($payload)
    ->addSignature($jwk, ['alg' => 'PS256', 'typ'=>'JWT', 'kid' => $keyId])
    ->build();


$serializer = new CompactSerializer();
$token = $serializer->serialize($jws, 0); 

// Saving the token to a file
file_put_contents('jwt_token.txt', $token);
// Printing the token to console
echo "JWT Token: " . $token . PHP_EOL;

#include <chrono>
#include <fstream>
#include <iterator>

#include "jwt-cpp/jwt.h"

int main()
{
    std::ifstream key_file("<JSON_file_with_keys>");
    std::string content((std::istreambuf_iterator<char>(key_file)),
        (std::istreambuf_iterator<char>()));

    picojson::value v;
    std::string err = picojson::parse(v, content);
    auto privateKey = v.get("private_key").to_str();
    auto serviceAccountId = v.get("service_account_id").to_str();
    auto keyId = v.get("id").to_str();

    auto now = std::chrono::system_clock::now();
    auto expires_at = now + std::chrono::hours(1);
    picojson::array audience_array;
    audience_array.push_back(picojson::value("https://iam.api.cloud.yandex.net/iam/v1/tokens"));
    auto algorithm = jwt::algorithm::ps256(
        "",
        privateKey);

    // JWT generation.
    auto encoded_token = jwt::create()
        .set_key_id(keyId)
        .set_issuer(serviceAccountId)
        .set_audience(audience_array)
        .set_issued_at(now)
        .set_expires_at(expires_at)
        .sign(algorithm);

    std::cout << encoded_token;
}

gem install jwt

require 'jwt'
require 'json'
require 'time'

KEY_FILE = '<JSON_file_with_keys>'
KEY_DATA = JSON.parse(File.read(KEY_FILE))
KEY_ID = KEY_DATA['id']
SERVICE_ACCOUNT_ID = KEY_DATA['service_account_id']

def load_private_key
  OpenSSL::PKey::RSA.new(KEY_DATA['private_key'])
rescue IOError, JSON::ParserError, OpenSSL::PKey::RSAError => e
  raise "Failed to load or parse private key: #{e.message}"
end

def signed_token
  payload = {
    iss: SERVICE_ACCOUNT_ID,
    exp: Time.now.to_i + 3600,
    iat: Time.now.to_i,
    nbf: Time.now.to_i,
    aud: "https://iam.api.cloud.yandex.net/iam/v1/tokens"
  }

  header = {
    kid: KEY_ID
  }

  private_key = load_private_key

  JWT.encode(payload, private_key, 'PS256', header)
end

# Main execution
begin
  token = signed_token
  File.write('jwt_token.txt', token)
  # Or, alternatively, print the token to the console
  # puts "Here is the token:"
  # puts token
rescue => e
  puts "An error occurred: #{e.message}"
end

import (
  "encoding/json"
  "fmt"
  "io/ioutil"
  "net/http"
  "strings"
)

func getIAMToken() string {
  jot := signedToken()
  fmt.Println(jot)
  resp, err := http.Post(
      "https://iam.api.cloud.yandex.net/iam/v1/tokens",
      "application/json",
      strings.NewReader(fmt.Sprintf(`{"jwt":"%s"}`, jot)),
  )
  if err != nil {
      panic(err)
  }
  defer resp.Body.Close()
  if resp.StatusCode != http.StatusOK {
      body, _ := ioutil.ReadAll(resp.Body)
      panic(fmt.Sprintf("%s: %s", resp.Status, body))
  }
  var data struct {
      IAMToken string `json:"iamToken"`
  }
  err = json.NewDecoder(resp.Body).Decode(&data)
  if err != nil {
      panic(err)
  }
  return data.IAMToken
}