module Google::Auth::ExternalAccount::BaseCredentials

def exchange_token
  additional_options = nil
  if @client_id.nil? && @workforce_pool_user_project
    additional_options = { userProject: @workforce_pool_user_project }
  end
  token_request = {
    audience: @audience,
    grant_type: STS_GRANT_TYPE,
    subject_token: retrieve_subject_token!,
    subject_token_type: @subject_token_type,
    scopes: @service_account_impersonation_url ? IAM_SCOPE : @scope,
    requested_token_type: STS_REQUESTED_TOKEN_TYPE,
    additional_options: additional_options
  }
  log_token_request token_request
  @sts_client.exchange_token token_request
end