From 3cfdf5babee9c2928f070c2026dfc8e49e3f9847 Mon Sep 17 00:00:00 2001
From: Luwei Ge <lwge@google.com>
Date: Wed, 4 Jun 2025 21:36:47 +0000
Subject: [PATCH] feat: enable ALTS hard bound token in DirectPath

---
 .../java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java b/google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java
index 937367e3d34..09aec6f3ebe 100644
--- a/google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java
+++ b/google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java
@@ -368,6 +368,10 @@ public GapicSpannerRpc(final SpannerOptions options) {
       boolean isAttemptDirectPathXds = isEnableDirectPathXdsEnv();
       if (isAttemptDirectPathXds) {
         defaultChannelProviderBuilder.setAttemptDirectPath(true);
+        // This will let the credentials try to fetch a hard-bound access token if the runtime
+        // environment supports it.
+        defaultChannelProviderBuilder.setAllowHardBoundTokenTypes(
+            Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
         defaultChannelProviderBuilder.setAttemptDirectPathXds();
       }