Getting an IAM token for a service account

pip3 install PyJWT
pip3 install cryptography

import time
import jwt
import json

key_path = '<JSON_file_with_keys>'

# Reading a private key from a JSON file
with open(key_path, 'r') as f:
  obj = f.read() 
  obj = json.loads(obj)
  private_key = obj['private_key']
  key_id = obj['id']
  service_account_id = obj['service_account_id']

sa_key = {
    "id": key_id,
    "service_account_id": service_account_id,
    "private_key": private_key
}

def create_jwt():
    now = int(time.time())
    payload = {
            'aud': 'https://iam.api.cloud.yandex.net/iam/v1/tokens',
            'iss': service_account_id,
            'iat': now,
            'exp': now + 3600
        }

    # JWT generation.
    encoded_token = jwt.encode(
        payload,
        private_key,
        algorithm='PS256',
        headers={'kid': key_id}
    )

    print(encoded_token)

    return encoded_token

create_jwt()

package com.mycompany.java.jwt;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemReader;

import java.io.StringReader;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.time.Instant;
import java.util.Date;

public class JavaJwt {

    @JsonIgnoreProperties(ignoreUnknown = true)
    public static class KeyInfo {

        public String id;
        public String service_account_id;
        public String private_key;
    }

    public static void main(String[] args) throws Exception {

        String content = new String(Files.readAllBytes(Paths.get("<JSON_file_with_keys>")));
        KeyInfo keyInfo = (new ObjectMapper()).readValue(content, KeyInfo.class);

        String privateKeyString = keyInfo.private_key;
        String serviceAccountId = keyInfo.service_account_id;
        String keyId = keyInfo.id;

        PemObject privateKeyPem;
        try (PemReader reader = new PemReader(new StringReader(privateKeyString))) {
            privateKeyPem = reader.readPemObject();
        }

        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        PrivateKey privateKey = keyFactory.generatePrivate(new PKCS8EncodedKeySpec(privateKeyPem.getContent()));

        Instant now = Instant.now();

        // JWT generation.
        String encodedToken = Jwts.builder()
                .setHeaderParam("kid", keyId)
                .setIssuer(serviceAccountId)
                .setAudience("https://iam.api.cloud.yandex.net/iam/v1/tokens")
                .setIssuedAt(Date.from(now))
                .setExpiration(Date.from(now.plusSeconds(3600)))
                .signWith(privateKey, SignatureAlgorithm.PS256)
                .compact();
        System.out.println(encodedToken);
    }
}

using System;
using System.Collections.Generic;
using System.IO;
using System.Security.Cryptography;
using Jose;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.Security;

namespace ConsoleApp
{
    class Program
    {
        static void Main(string[] args)
        {
            var serviceAccountId = "<service_account_ID>";
            var keyId = "<public_key_ID>";
            var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

            var headers = new Dictionary<string, object>()
            {
                { "kid", keyId }
            };

            var payload = new Dictionary<string, object>()
            {
                { "aud", "https://iam.api.cloud.yandex.net/iam/v1/tokens" },
                { "iss", serviceAccountId },
                { "iat", now },
                { "exp", now + 3600 }
            };

            RsaPrivateCrtKeyParameters privateKeyParams;
            using (var pemStream = File.OpenText("<private_key_file>"))
            {
                privateKeyParams = new PemReader(pemStream).ReadObject() as RsaPrivateCrtKeyParameters;
            }

            using (var rsa = RSA.Create())
            {
                rsa.ImportParameters(DotNetUtilities.ToRSAParameters(privateKeyParams));
                string encodedToken = Jose.JWT.Encode(payload, rsa, JwsAlgorithm.PS256, headers);
            }
        }
    }
}

using System;
using System.Collections.Generic;
using System.IO;
using System.Security.Cryptography;
using Jose;

namespace ConsoleApp
{
    class Program
    {
        static void Main(string[] args)
        {
            var serviceAccountId = "<service_account_ID>";
            var keyId = "<public_key_ID>";
            var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();

            var headers = new Dictionary<string, object>()
            {
                { "kid", keyId }
            };

            var payload = new Dictionary<string, object>()
            {
                { "aud", "https://iam.api.cloud.yandex.net/iam/v1/tokens" },
                { "iss", serviceAccountId },
                { "iat", now },
                { "exp", now + 3600 }
            };

            using (var rsa = RSA.Create())
            {
                rsa.ImportFromPem(File.ReadAllText("<private_key_file>").ToCharArray());
                string encodedToken = Jose.JWT.Encode(payload, rsa, JwsAlgorithm.PS256, headers);
            }
        }
    }
}

install jwt v5
go get -u github.com/golang-jwt/jwt/v5

package main  

import (
	"crypto/rsa"
	"encoding/json"
	"log"
	"os"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

func main() {
  // Getting a token
	token := signedToken()
  // Saving the token to a file
	err := os.WriteFile("jwt_token.txt", []byte(token), 0644)
	if err != nil {
	  log.Fatal(err)
	}
	// Printing the token to console
	fmt.Println("Here is token:")
	fmt.Println(token)
}

const (
  keyID            = "<public_key_ID>"
  serviceAccountID = "<service_account_ID>"
  keyFile          = "<JSON_file_with_keys>"
)

// JWT generation.
func signedToken() string {
	claims := jwt.RegisteredClaims{
	 	Issuer:    serviceAccountID,
	 	ExpiresAt: jwt.NewNumericDate(time.Now().UTC().Add(1 * time.Hour)),
	 	IssuedAt:  jwt.NewNumericDate(time.Now().UTC()),
	 	NotBefore: jwt.NewNumericDate(time.Now().UTC()),
	 	Audience:  []string{"https://iam.api.cloud.yandex.net/iam/v1/tokens"},
	}
	token := jwt.NewWithClaims(jwt.SigningMethodPS256, claims)
	token.Header["kid"] = keyID

	privateKey := loadPrivateKey()
	signed, err := token.SignedString(privateKey)
	if err != nil {
		panic(err)
	}

	return signed
}

func loadPrivateKey() *rsa.PrivateKey {
  keyData := readPrivateKey()

  rsaPrivateKey, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(keyData.PrivateKey))
  if err != nil {
    panic(err)
  }
  return rsaPrivateKey
  }

func readPrivateKey() *iamkey.Key {
  data, err := os.ReadFile(keyFile)
  if err != nil {
    panic(err)
  }

  var keyData *iamkey.Key
  if err := json.Unmarshal(data, &keyData); err != nil {
    panic(err)
  }

  return keyData
}

const serviceAccountJson = require('<JSON_file_with_keys>')
const jose = require('node-jose');

const {
    id: accessKeyId,
    service_account_id: serviceAccountId,
    private_key: privateKey
} = serviceAccountJson

const createJWT = () =>
{
    const now = Math.floor(new Date().getTime() / 1000)
    const payload = {
        iss: serviceAccountId,
        iat: now,
        exp: now + 3600,
        aud: "https://iam.api.cloud.yandex.net/iam/v1/tokens"
    
    return jose.JWK.asKey(privateKey, 'pem', { kid: accessKeyId, alg: 'PS256' })
        .then(function (result)
        {
            return jose.JWS.createSign({ format: 'compact' }, result)
                .update(JSON.stringify(payload))
                .final();
        });
}

require 'vendor/autoload.php';

use Jose\Component\Core\AlgorithmManager;
use Jose\Component\KeyManagement\JWKFactory;
use Jose\Component\Signature\Algorithm\PS256;
use Jose\Component\Signature\JWSBuilder;
use Jose\Component\Signature\Serializer\CompactSerializer;

// Reading data from a file
$keyData = json_decode(file_get_contents("<JSON_file_with_keys>"), true);
$privateKeyPem = $keyData['private_key'];
$keyId = $keyData['id'];
$serviceAccountId = $keyData['service_account_id'];

// You need to delete header/metadata from the private key
if (strpos($privateKeyPem, "PLEASE DO NOT REMOVE THIS LINE!") === 0) {
    $privateKeyPem = substr($privateKeyPem, strpos($privateKeyPem, "\n") + 1);
}

$jwk = JWKFactory::createFromKey(
    $privateKeyPem, 
    null, 
    [
        'alg' => 'PS256',
        'use' => 'sig',
        'kid' => $keyId,
    ]
);

$algorithmManager = new AlgorithmManager([new PS256()]);
$jwsBuilder = new JWSBuilder($algorithmManager);

$payload = json_encode([
    'iss' => $serviceAccountId,
    'aud' => "https://iam.api.cloud.yandex.net/iam/v1/tokens",
    'iat' => time(),
    'nbf' => time(),
    'exp' => time() + 3600,
]);

$jws = $jwsBuilder
    ->create()
    ->withPayload($payload)
    ->addSignature($jwk, ['alg' => 'PS256', 'typ'=>'JWT', 'kid' => $keyId])
    ->build();


$serializer = new CompactSerializer();
$token = $serializer->serialize($jws, 0); 

// Saving the token to a file
file_put_contents('jwt_token.txt', $token);
// Printing the token to console
echo "JWT Token: " . $token . PHP_EOL;

#include <chrono>
#include <fstream>
#include <iterator>

#include "jwt-cpp/jwt.h"

int main()
{
    std::ifstream key_file("<JSON_file_with_keys>");
    std::string content((std::istreambuf_iterator<char>(key_file)),
        (std::istreambuf_iterator<char>()));

    picojson::value v;
    std::string err = picojson::parse(v, content);
    auto privateKey = v.get("private_key").to_str();
    auto serviceAccountId = v.get("service_account_id").to_str();
    auto keyId = v.get("id").to_str();

    auto now = std::chrono::system_clock::now();
    auto expires_at = now + std::chrono::hours(1);
    picojson::array audience_array;
    audience_array.push_back(picojson::value("https://iam.api.cloud.yandex.net/iam/v1/tokens"));
    auto algorithm = jwt::algorithm::ps256(
        "",
        privateKey);

    // JWT generation.
    auto encoded_token = jwt::create()
        .set_key_id(keyId)
        .set_issuer(serviceAccountId)
        .set_audience(audience_array)
        .set_issued_at(now)
        .set_expires_at(expires_at)
        .sign(algorithm);

    std::cout << encoded_token;
}

gem install jwt

require 'jwt'
require 'json'
require 'time'

KEY_FILE = '<JSON_file_with_keys>'
KEY_DATA = JSON.parse(File.read(KEY_FILE))
KEY_ID = KEY_DATA['id']
SERVICE_ACCOUNT_ID = KEY_DATA['service_account_id']

def load_private_key
  OpenSSL::PKey::RSA.new(KEY_DATA['private_key'])
rescue IOError, JSON::ParserError, OpenSSL::PKey::RSAError => e
  raise "Failed to load or parse private key: #{e.message}"
end

def signed_token
  payload = {
    iss: SERVICE_ACCOUNT_ID,
    exp: Time.now.to_i + 3600,
    iat: Time.now.to_i,
    nbf: Time.now.to_i,
    aud: "https://iam.api.cloud.yandex.net/iam/v1/tokens"
  }

  header = {
    kid: KEY_ID
  }

  private_key = load_private_key

  JWT.encode(payload, private_key, 'PS256', header)
end

# Main execution
begin
  token = signed_token
  File.write('jwt_token.txt', token)
  # Or, alternatively, print the token to the console
  # puts "Here is the token:"
  # puts token
rescue => e
  puts "An error occurred: #{e.message}"
end