title: How to authenticate programmatically to a Cloud Identity-Aware Proxy (Cloud IAP)-secured resource using user default credentials?
body: <p>I would like to be able to programmatically generate an id token for iap using the user default credential on a dev environment (i.e. my own laptop with google cloud sdk installed and logged in).</p>
  
  <p>When following the <a href="https://cloud.google.com/iap/docs/authentication-howto#authenticating_from_a_service_account" rel="nofollow noreferrer">documentation</a>, I managed to generate an authorization token using a service account file. </p>
  
  <p>When using <code>google.auth.default</code> on my personal computer, I can see the credentials of type <code>google.oauth2.credentials.Credentials</code> have a <code>refresh_token</code>. I wanted to use it to generate the token as it is done with curl in the <a href="https://cloud.google.com/iap/docs/authentication-howto#authenticating_from_a_desktop_app" rel="nofollow noreferrer">documentation</a> under 
  <code>Authenticating from a desktop app -&gt; Accessing the application</code> but I could not make it work. Does someone know if there is a way to authenticate this way ?</p>