Getting a service account IAM token using a container
Written by
Updated at July 1, 2026
If a container revision was created with a service account, you can get an IAM token from the metadata service in Google Compute Engine using the API.
To do this, from inside the container, send a GET request to http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token and specify the Metadata-Flavor: Google HTTP header.
Below is an example of a function for getting an IAM token.
JavaScript
const fetch = require("node-fetch");
let url = 'http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token';
let headers = {'Metadata-Flavor': 'Google'};
async function getToken(event) {
const resp = await fetch(url, {
headers: headers,
});
let respJson = await resp.json();
return {
token: respJson['access_token'],
expiresInSeconds: respJson['expires_in'],
};
};