{"name":"CLOUDSDK_AUTH_ACCESS_TOKEN","slug":"cloudsdk-auth-access-token","family":"env","title":"Environment variables","noun":"environment variable","description":"gh, aws, gcloud, bq and gsutil get placeholder credentials so they authenticate through the proxy instead of failing.","description_source":"entry","described_by":{"version":"2.1.239","anchor":"sandboxed-clis-get-placeholder-credentials-so-they-route-thr"},"presence":{"first_seen":"2.1.178","removed_in":null,"in_current_build":true,"newest_mined":"2.1.309","builds":114,"mined_builds":150,"first_cited":{"version":"2.1.239","released_at":"2026-08-21 17:18:54","spans":1}},"aliases":[],"entries":[{"version":"2.1.284","anchor":"bedrockvertex-model-access-probe-results-are-cached-on-disk","heading":"Bedrock and Vertex model-access checks are remembered for 15 minutes","line":"A successful check that your cloud provider gives you access to a model is now saved on disk and reused for 15 minutes","released_at":"2026-09-28 17:11:59","reason":"found in this entry's text"},{"version":"2.1.239","anchor":"sandboxed-clis-get-placeholder-credentials-so-they-route-thr","heading":"Sandboxed CLIs get placeholder credentials so they route through the agent proxy","line":"gh, aws, gcloud, bq and gsutil get placeholder credentials so they authenticate through the proxy instead of failing.","released_at":"2026-08-21 17:18:54","reason":"found in this entry's text"},{"version":"2.1.239","anchor":"credential-placeholder-table-names-google-application-creden","heading":"Credential placeholder table names GOOGLE_APPLICATION_CREDENTIALS and the AWS profile set","line":"The credential placeholder table now also names Google and AWS credential variables, with no traced consumer.","released_at":"2026-08-21 17:18:54","reason":"found in this entry's text"},{"version":"2.1.128","anchor":"bug-fixes","heading":"","line":null,"released_at":"2026-05-04 19:29:23","reason":"found in this entry's text"}],"entries_total":4,"docs":[],"docs_total":0,"gates":[],"related":[{"name":"CLOUDSDK_ACTIVE_CONFIG_NAME","slug":"cloudsdk-active-config-name","description":"Names the active gcloud configuration. It is part of the hash that names the lock and outcome files Claude Code uses when running the `gcpAuthRefresh` command. When building its GCP credential fingerprint, Claude Code reads `configurations\/config_<name>` from the gcloud config directory using this name, else the contents of the `active_config` file, else `default`; no fingerprint is built when the `active_config` file does not exist, even if this variable is set."},{"name":"CLOUDSDK_CONFIG","slug":"cloudsdk-config","description":"AWS and Google custom endpoint variables are now forwarded and scrubbed deliberately."},{"name":"CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","slug":"cloudsdk-core-custom-ca-certs-file","description":null},{"name":"CLOUDSDK_PROXY_USERNAME","slug":"cloudsdk-proxy-username","description":"Concurrent sandboxes now get unique proxy usernames instead of sharing one identity."}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/cloudsdk-auth-access-token","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}