The Java SDK supports several methods for credential management to authenticate your requests. You can use specific providers or a default provider chain.
1. Environment Variables
Reads TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY from your environment.
2. Configuration Files
Uses a .ini file at the following locations:
- Windows:
c:\Users\NAME\.tencentcloud\credentials - Linux:
~/.tencentcloud/credentials or /etc/tencentcloud/credentials
Format:
[default]
secret_id = xxxxx
secret_key = xxxxx
3. Role Assumption (STS)
Use temporary credentials by providing a roleArn and session name. The SDK automatically refreshes these credentials.
4. Instance Roles (CVM)
When running on a CVM instance with an attached role, the SDK can automatically fetch and refresh temporary credentials via the instance metadata service.
5. TKE OIDC Credentials
Used for Pod-based authentication in Tencent Kubernetes Engine (TKE).
6. Default Credentials Provider Chain
To simplify management, use DefaultCredentialsProvider. It attempts to retrieve credentials in the following order:
Environment Variables $\rightarrow$ Configuration Files $\rightarrow$ Instance Roles $\rightarrow$ TKE OIDC Credentials. It returns the first successful match.
// 1. Environment Variables
Credential cred = new EnvironmentVariableCredentialsProvider().getCredentials();
// 2. Configuration Files
Credential cred = new ProfileCredentialsProvider().getCredentials();
// 3. Role Assumption
Credential cred = new STSCredential("secretId", "secretKey", "roleArn", "roleSessionName");
// 4. Instance Roles
Credential cred = new CvmRoleCredential();
// 5. TKE OIDC
OIDCRoleArnProvider provider = new OIDCRoleArnProvider();
Credential credential = provider.getCredentials();
// 6. Default Provider Chain
Credential cred = new DefaultCredentialsProvider().getCredentials();
