from google.oauth2 import service_account
import google.auth.transport.requests

cred = service_account.IDTokenCredentials.from_service_account_file(
    '/usr/local/google/home/sijunliu/wks/creds/nondca/srv.json',
    target_audience = "https://pubsub.googleapis.com",
)

# Trigger IAM endpoint flow.
# Note this feature is still experimental since setAzpToEmail is
# not supported yet
cred = cred._with_use_iam_endpoint(True)
req = google.auth.transport.requests.Request()

cred.refresh(req)
print(cred.token)