From b73f6f4a912053baeb241da40659c4e46c960f6b Mon Sep 17 00:00:00 2001
From: yoshi-automation <yoshi-automation@google.com>
Date: Thu, 28 Feb 2019 00:48:09 -0800
Subject: [PATCH] Regenerate pubsub client

---
 .../com/google/pubsub/v1/PubsubProto.java     |  307 ++--
 .../java/com/google/pubsub/v1/PushConfig.java | 1273 +++++++++++++++++
 .../google/pubsub/v1/PushConfigOrBuilder.java |   36 +
 .../main/proto/google/pubsub/v1/pubsub.proto  |   38 +-
 .../google-cloud-pubsub/synth.metadata        |   10 +-
 5 files changed, 1512 insertions(+), 152 deletions(-)

diff --git a/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PubsubProto.java b/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PubsubProto.java
index cdc7b4ce4539..df3bcc0691d2 100644
--- a/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PubsubProto.java
+++ b/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PubsubProto.java
@@ -96,6 +96,10 @@ public static void registerAllExtensions(com.google.protobuf.ExtensionRegistry r
       internal_static_google_pubsub_v1_PushConfig_AttributesEntry_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internal_static_google_pubsub_v1_PushConfig_AttributesEntry_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_pubsub_v1_PushConfig_OidcToken_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_pubsub_v1_PushConfig_OidcToken_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
       internal_static_google_pubsub_v1_ReceivedMessage_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
@@ -249,152 +253,155 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + ".pubsub.v1.ExpirationPolicy\032-\n\013LabelsEnt"
           + "ry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\":\n\020Ex"
           + "pirationPolicy\022&\n\003ttl\030\001 \001(\0132\031.google.pro"
-          + "tobuf.Duration\"\230\001\n\nPushConfig\022\025\n\rpush_en"
+          + "tobuf.Duration\"\255\002\n\nPushConfig\022\025\n\rpush_en"
           + "dpoint\030\001 \001(\t\022@\n\nattributes\030\002 \003(\0132,.googl"
-          + "e.pubsub.v1.PushConfig.AttributesEntry\0321"
-          + "\n\017AttributesEntry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030"
-          + "\002 \001(\t:\0028\001\"S\n\017ReceivedMessage\022\016\n\006ack_id\030\001"
-          + " \001(\t\0220\n\007message\030\002 \001(\0132\037.google.pubsub.v1"
-          + ".PubsubMessage\".\n\026GetSubscriptionRequest"
-          + "\022\024\n\014subscription\030\001 \001(\t\"\202\001\n\031UpdateSubscri"
-          + "ptionRequest\0224\n\014subscription\030\001 \001(\0132\036.goo"
-          + "gle.pubsub.v1.Subscription\022/\n\013update_mas"
-          + "k\030\002 \001(\0132\032.google.protobuf.FieldMask\"R\n\030L"
-          + "istSubscriptionsRequest\022\017\n\007project\030\001 \001(\t"
-          + "\022\021\n\tpage_size\030\002 \001(\005\022\022\n\npage_token\030\003 \001(\t\""
-          + "k\n\031ListSubscriptionsResponse\0225\n\rsubscrip"
-          + "tions\030\001 \003(\0132\036.google.pubsub.v1.Subscript"
-          + "ion\022\027\n\017next_page_token\030\002 \001(\t\"1\n\031DeleteSu"
-          + "bscriptionRequest\022\024\n\014subscription\030\001 \001(\t\""
-          + "b\n\027ModifyPushConfigRequest\022\024\n\014subscripti"
-          + "on\030\001 \001(\t\0221\n\013push_config\030\002 \001(\0132\034.google.p"
-          + "ubsub.v1.PushConfig\"U\n\013PullRequest\022\024\n\014su"
-          + "bscription\030\001 \001(\t\022\032\n\022return_immediately\030\002"
-          + " \001(\010\022\024\n\014max_messages\030\003 \001(\005\"L\n\014PullRespon"
-          + "se\022<\n\021received_messages\030\001 \003(\0132!.google.p"
-          + "ubsub.v1.ReceivedMessage\"_\n\030ModifyAckDea"
-          + "dlineRequest\022\024\n\014subscription\030\001 \001(\t\022\017\n\007ac"
-          + "k_ids\030\004 \003(\t\022\034\n\024ack_deadline_seconds\030\003 \001("
-          + "\005\";\n\022AcknowledgeRequest\022\024\n\014subscription\030"
-          + "\001 \001(\t\022\017\n\007ack_ids\030\002 \003(\t\"\244\001\n\024StreamingPull"
-          + "Request\022\024\n\014subscription\030\001 \001(\t\022\017\n\007ack_ids"
-          + "\030\002 \003(\t\022\037\n\027modify_deadline_seconds\030\003 \003(\005\022"
-          + "\037\n\027modify_deadline_ack_ids\030\004 \003(\t\022#\n\033stre"
-          + "am_ack_deadline_seconds\030\005 \001(\005\"U\n\025Streami"
-          + "ngPullResponse\022<\n\021received_messages\030\001 \003("
-          + "\0132!.google.pubsub.v1.ReceivedMessage\"\257\001\n"
-          + "\025CreateSnapshotRequest\022\014\n\004name\030\001 \001(\t\022\024\n\014"
-          + "subscription\030\002 \001(\t\022C\n\006labels\030\003 \003(\01323.goo"
-          + "gle.pubsub.v1.CreateSnapshotRequest.Labe"
-          + "lsEntry\032-\n\013LabelsEntry\022\013\n\003key\030\001 \001(\t\022\r\n\005v"
-          + "alue\030\002 \001(\t:\0028\001\"v\n\025UpdateSnapshotRequest\022"
-          + ",\n\010snapshot\030\001 \001(\0132\032.google.pubsub.v1.Sna"
-          + "pshot\022/\n\013update_mask\030\002 \001(\0132\032.google.prot"
-          + "obuf.FieldMask\"\277\001\n\010Snapshot\022\014\n\004name\030\001 \001("
-          + "\t\022\r\n\005topic\030\002 \001(\t\022/\n\013expire_time\030\003 \001(\0132\032."
-          + "google.protobuf.Timestamp\0226\n\006labels\030\004 \003("
-          + "\0132&.google.pubsub.v1.Snapshot.LabelsEntr"
-          + "y\032-\n\013LabelsEntry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002"
-          + " \001(\t:\0028\001\"&\n\022GetSnapshotRequest\022\020\n\010snapsh"
-          + "ot\030\001 \001(\t\"N\n\024ListSnapshotsRequest\022\017\n\007proj"
-          + "ect\030\001 \001(\t\022\021\n\tpage_size\030\002 \001(\005\022\022\n\npage_tok"
-          + "en\030\003 \001(\t\"_\n\025ListSnapshotsResponse\022-\n\tsna"
-          + "pshots\030\001 \003(\0132\032.google.pubsub.v1.Snapshot"
-          + "\022\027\n\017next_page_token\030\002 \001(\t\")\n\025DeleteSnaps"
-          + "hotRequest\022\020\n\010snapshot\030\001 \001(\t\"m\n\013SeekRequ"
-          + "est\022\024\n\014subscription\030\001 \001(\t\022*\n\004time\030\002 \001(\0132"
-          + "\032.google.protobuf.TimestampH\000\022\022\n\010snapsho"
-          + "t\030\003 \001(\tH\000B\010\n\006target\"\016\n\014SeekResponse2\277\010\n\t"
-          + "Publisher\022j\n\013CreateTopic\022\027.google.pubsub"
-          + ".v1.Topic\032\027.google.pubsub.v1.Topic\")\202\323\344\223"
-          + "\002#\032\036/v1/{name=projects/*/topics/*}:\001*\022}\n"
-          + "\013UpdateTopic\022$.google.pubsub.v1.UpdateTo"
-          + "picRequest\032\027.google.pubsub.v1.Topic\"/\202\323\344"
-          + "\223\002)2$/v1/{topic.name=projects/*/topics/*"
-          + "}:\001*\022\202\001\n\007Publish\022 .google.pubsub.v1.Publ"
-          + "ishRequest\032!.google.pubsub.v1.PublishRes"
-          + "ponse\"2\202\323\344\223\002,\"\'/v1/{topic=projects/*/top"
-          + "ics/*}:publish:\001*\022o\n\010GetTopic\022!.google.p"
-          + "ubsub.v1.GetTopicRequest\032\027.google.pubsub"
-          + ".v1.Topic\"\'\202\323\344\223\002!\022\037/v1/{topic=projects/*"
-          + "/topics/*}\022\200\001\n\nListTopics\022#.google.pubsu"
-          + "b.v1.ListTopicsRequest\032$.google.pubsub.v"
-          + "1.ListTopicsResponse\"\'\202\323\344\223\002!\022\037/v1/{proje"
-          + "ct=projects/*}/topics\022\262\001\n\026ListTopicSubsc"
-          + "riptions\022/.google.pubsub.v1.ListTopicSub"
-          + "scriptionsRequest\0320.google.pubsub.v1.Lis"
-          + "tTopicSubscriptionsResponse\"5\202\323\344\223\002/\022-/v1"
-          + "/{topic=projects/*/topics/*}/subscriptio"
-          + "ns\022\242\001\n\022ListTopicSnapshots\022+.google.pubsu"
-          + "b.v1.ListTopicSnapshotsRequest\032,.google."
-          + "pubsub.v1.ListTopicSnapshotsResponse\"1\202\323"
-          + "\344\223\002+\022)/v1/{topic=projects/*/topics/*}/sn"
-          + "apshots\022t\n\013DeleteTopic\022$.google.pubsub.v"
-          + "1.DeleteTopicRequest\032\026.google.protobuf.E"
-          + "mpty\"\'\202\323\344\223\002!*\037/v1/{topic=projects/*/topi"
-          + "cs/*}2\371\021\n\nSubscriber\022\206\001\n\022CreateSubscript"
-          + "ion\022\036.google.pubsub.v1.Subscription\032\036.go"
-          + "ogle.pubsub.v1.Subscription\"0\202\323\344\223\002*\032%/v1"
-          + "/{name=projects/*/subscriptions/*}:\001*\022\222\001"
-          + "\n\017GetSubscription\022(.google.pubsub.v1.Get"
-          + "SubscriptionRequest\032\036.google.pubsub.v1.S"
-          + "ubscription\"5\202\323\344\223\002/\022-/v1/{subscription=p"
-          + "rojects/*/subscriptions/*}\022\240\001\n\022UpdateSub"
-          + "scription\022+.google.pubsub.v1.UpdateSubsc"
-          + "riptionRequest\032\036.google.pubsub.v1.Subscr"
-          + "iption\"=\202\323\344\223\002722/v1/{subscription.name=p"
-          + "rojects/*/subscriptions/*}:\001*\022\234\001\n\021ListSu"
-          + "bscriptions\022*.google.pubsub.v1.ListSubsc"
-          + "riptionsRequest\032+.google.pubsub.v1.ListS"
-          + "ubscriptionsResponse\".\202\323\344\223\002(\022&/v1/{proje"
-          + "ct=projects/*}/subscriptions\022\220\001\n\022DeleteS"
-          + "ubscription\022+.google.pubsub.v1.DeleteSub"
-          + "scriptionRequest\032\026.google.protobuf.Empty"
-          + "\"5\202\323\344\223\002/*-/v1/{subscription=projects/*/s"
-          + "ubscriptions/*}\022\243\001\n\021ModifyAckDeadline\022*."
-          + "google.pubsub.v1.ModifyAckDeadlineReques"
-          + "t\032\026.google.protobuf.Empty\"J\202\323\344\223\002D\"?/v1/{"
-          + "subscription=projects/*/subscriptions/*}"
-          + ":modifyAckDeadline:\001*\022\221\001\n\013Acknowledge\022$."
-          + "google.pubsub.v1.AcknowledgeRequest\032\026.go"
-          + "ogle.protobuf.Empty\"D\202\323\344\223\002>\"9/v1/{subscr"
-          + "iption=projects/*/subscriptions/*}:ackno"
-          + "wledge:\001*\022\204\001\n\004Pull\022\035.google.pubsub.v1.Pu"
-          + "llRequest\032\036.google.pubsub.v1.PullRespons"
-          + "e\"=\202\323\344\223\0027\"2/v1/{subscription=projects/*/"
-          + "subscriptions/*}:pull:\001*\022f\n\rStreamingPul"
-          + "l\022&.google.pubsub.v1.StreamingPullReques"
-          + "t\032\'.google.pubsub.v1.StreamingPullRespon"
-          + "se\"\000(\0010\001\022\240\001\n\020ModifyPushConfig\022).google.p"
-          + "ubsub.v1.ModifyPushConfigRequest\032\026.googl"
-          + "e.protobuf.Empty\"I\202\323\344\223\002C\">/v1/{subscript"
-          + "ion=projects/*/subscriptions/*}:modifyPu"
-          + "shConfig:\001*\022~\n\013GetSnapshot\022$.google.pubs"
-          + "ub.v1.GetSnapshotRequest\032\032.google.pubsub"
-          + ".v1.Snapshot\"-\202\323\344\223\002\'\022%/v1/{snapshot=proj"
-          + "ects/*/snapshots/*}\022\214\001\n\rListSnapshots\022&."
-          + "google.pubsub.v1.ListSnapshotsRequest\032\'."
-          + "google.pubsub.v1.ListSnapshotsResponse\"*"
-          + "\202\323\344\223\002$\022\"/v1/{project=projects/*}/snapsho"
-          + "ts\022\203\001\n\016CreateSnapshot\022\'.google.pubsub.v1"
-          + ".CreateSnapshotRequest\032\032.google.pubsub.v"
-          + "1.Snapshot\",\202\323\344\223\002&\032!/v1/{name=projects/*"
-          + "/snapshots/*}:\001*\022\214\001\n\016UpdateSnapshot\022\'.go"
-          + "ogle.pubsub.v1.UpdateSnapshotRequest\032\032.g"
-          + "oogle.pubsub.v1.Snapshot\"5\202\323\344\223\002/2*/v1/{s"
-          + "napshot.name=projects/*/snapshots/*}:\001*\022"
-          + "\200\001\n\016DeleteSnapshot\022\'.google.pubsub.v1.De"
-          + "leteSnapshotRequest\032\026.google.protobuf.Em"
-          + "pty\"-\202\323\344\223\002\'*%/v1/{snapshot=projects/*/sn"
-          + "apshots/*}\022\204\001\n\004Seek\022\035.google.pubsub.v1.S"
-          + "eekRequest\032\036.google.pubsub.v1.SeekRespon"
-          + "se\"=\202\323\344\223\0027\"2/v1/{subscription=projects/*"
-          + "/subscriptions/*}:seek:\001*B\256\001\n\024com.google"
-          + ".pubsub.v1B\013PubsubProtoP\001Z6google.golang"
-          + ".org/genproto/googleapis/pubsub/v1;pubsu"
-          + "b\370\001\001\252\002\026Google.Cloud.PubSub.V1\312\002\026Google\\C"
-          + "loud\\PubSub\\V1\352\002\031Google::Cloud::PubSub::"
-          + "V1b\006proto3"
+          + "e.pubsub.v1.PushConfig.AttributesEntry\022<"
+          + "\n\noidc_token\030\003 \001(\0132&.google.pubsub.v1.Pu"
+          + "shConfig.OidcTokenH\000\0321\n\017AttributesEntry\022"
+          + "\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\032<\n\tOidcT"
+          + "oken\022\035\n\025service_account_email\030\001 \001(\t\022\020\n\010a"
+          + "udience\030\002 \001(\tB\027\n\025authentication_method\"S"
+          + "\n\017ReceivedMessage\022\016\n\006ack_id\030\001 \001(\t\0220\n\007mes"
+          + "sage\030\002 \001(\0132\037.google.pubsub.v1.PubsubMess"
+          + "age\".\n\026GetSubscriptionRequest\022\024\n\014subscri"
+          + "ption\030\001 \001(\t\"\202\001\n\031UpdateSubscriptionReques"
+          + "t\0224\n\014subscription\030\001 \001(\0132\036.google.pubsub."
+          + "v1.Subscription\022/\n\013update_mask\030\002 \001(\0132\032.g"
+          + "oogle.protobuf.FieldMask\"R\n\030ListSubscrip"
+          + "tionsRequest\022\017\n\007project\030\001 \001(\t\022\021\n\tpage_si"
+          + "ze\030\002 \001(\005\022\022\n\npage_token\030\003 \001(\t\"k\n\031ListSubs"
+          + "criptionsResponse\0225\n\rsubscriptions\030\001 \003(\013"
+          + "2\036.google.pubsub.v1.Subscription\022\027\n\017next"
+          + "_page_token\030\002 \001(\t\"1\n\031DeleteSubscriptionR"
+          + "equest\022\024\n\014subscription\030\001 \001(\t\"b\n\027ModifyPu"
+          + "shConfigRequest\022\024\n\014subscription\030\001 \001(\t\0221\n"
+          + "\013push_config\030\002 \001(\0132\034.google.pubsub.v1.Pu"
+          + "shConfig\"U\n\013PullRequest\022\024\n\014subscription\030"
+          + "\001 \001(\t\022\032\n\022return_immediately\030\002 \001(\010\022\024\n\014max"
+          + "_messages\030\003 \001(\005\"L\n\014PullResponse\022<\n\021recei"
+          + "ved_messages\030\001 \003(\0132!.google.pubsub.v1.Re"
+          + "ceivedMessage\"_\n\030ModifyAckDeadlineReques"
+          + "t\022\024\n\014subscription\030\001 \001(\t\022\017\n\007ack_ids\030\004 \003(\t"
+          + "\022\034\n\024ack_deadline_seconds\030\003 \001(\005\";\n\022Acknow"
+          + "ledgeRequest\022\024\n\014subscription\030\001 \001(\t\022\017\n\007ac"
+          + "k_ids\030\002 \003(\t\"\244\001\n\024StreamingPullRequest\022\024\n\014"
+          + "subscription\030\001 \001(\t\022\017\n\007ack_ids\030\002 \003(\t\022\037\n\027m"
+          + "odify_deadline_seconds\030\003 \003(\005\022\037\n\027modify_d"
+          + "eadline_ack_ids\030\004 \003(\t\022#\n\033stream_ack_dead"
+          + "line_seconds\030\005 \001(\005\"U\n\025StreamingPullRespo"
+          + "nse\022<\n\021received_messages\030\001 \003(\0132!.google."
+          + "pubsub.v1.ReceivedMessage\"\257\001\n\025CreateSnap"
+          + "shotRequest\022\014\n\004name\030\001 \001(\t\022\024\n\014subscriptio"
+          + "n\030\002 \001(\t\022C\n\006labels\030\003 \003(\01323.google.pubsub."
+          + "v1.CreateSnapshotRequest.LabelsEntry\032-\n\013"
+          + "LabelsEntry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:"
+          + "\0028\001\"v\n\025UpdateSnapshotRequest\022,\n\010snapshot"
+          + "\030\001 \001(\0132\032.google.pubsub.v1.Snapshot\022/\n\013up"
+          + "date_mask\030\002 \001(\0132\032.google.protobuf.FieldM"
+          + "ask\"\277\001\n\010Snapshot\022\014\n\004name\030\001 \001(\t\022\r\n\005topic\030"
+          + "\002 \001(\t\022/\n\013expire_time\030\003 \001(\0132\032.google.prot"
+          + "obuf.Timestamp\0226\n\006labels\030\004 \003(\0132&.google."
+          + "pubsub.v1.Snapshot.LabelsEntry\032-\n\013Labels"
+          + "Entry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\"&\n"
+          + "\022GetSnapshotRequest\022\020\n\010snapshot\030\001 \001(\t\"N\n"
+          + "\024ListSnapshotsRequest\022\017\n\007project\030\001 \001(\t\022\021"
+          + "\n\tpage_size\030\002 \001(\005\022\022\n\npage_token\030\003 \001(\t\"_\n"
+          + "\025ListSnapshotsResponse\022-\n\tsnapshots\030\001 \003("
+          + "\0132\032.google.pubsub.v1.Snapshot\022\027\n\017next_pa"
+          + "ge_token\030\002 \001(\t\")\n\025DeleteSnapshotRequest\022"
+          + "\020\n\010snapshot\030\001 \001(\t\"m\n\013SeekRequest\022\024\n\014subs"
+          + "cription\030\001 \001(\t\022*\n\004time\030\002 \001(\0132\032.google.pr"
+          + "otobuf.TimestampH\000\022\022\n\010snapshot\030\003 \001(\tH\000B\010"
+          + "\n\006target\"\016\n\014SeekResponse2\277\010\n\tPublisher\022j"
+          + "\n\013CreateTopic\022\027.google.pubsub.v1.Topic\032\027"
+          + ".google.pubsub.v1.Topic\")\202\323\344\223\002#\032\036/v1/{na"
+          + "me=projects/*/topics/*}:\001*\022}\n\013UpdateTopi"
+          + "c\022$.google.pubsub.v1.UpdateTopicRequest\032"
+          + "\027.google.pubsub.v1.Topic\"/\202\323\344\223\002)2$/v1/{t"
+          + "opic.name=projects/*/topics/*}:\001*\022\202\001\n\007Pu"
+          + "blish\022 .google.pubsub.v1.PublishRequest\032"
+          + "!.google.pubsub.v1.PublishResponse\"2\202\323\344\223"
+          + "\002,\"\'/v1/{topic=projects/*/topics/*}:publ"
+          + "ish:\001*\022o\n\010GetTopic\022!.google.pubsub.v1.Ge"
+          + "tTopicRequest\032\027.google.pubsub.v1.Topic\"\'"
+          + "\202\323\344\223\002!\022\037/v1/{topic=projects/*/topics/*}\022"
+          + "\200\001\n\nListTopics\022#.google.pubsub.v1.ListTo"
+          + "picsRequest\032$.google.pubsub.v1.ListTopic"
+          + "sResponse\"\'\202\323\344\223\002!\022\037/v1/{project=projects"
+          + "/*}/topics\022\262\001\n\026ListTopicSubscriptions\022/."
+          + "google.pubsub.v1.ListTopicSubscriptionsR"
+          + "equest\0320.google.pubsub.v1.ListTopicSubsc"
+          + "riptionsResponse\"5\202\323\344\223\002/\022-/v1/{topic=pro"
+          + "jects/*/topics/*}/subscriptions\022\242\001\n\022List"
+          + "TopicSnapshots\022+.google.pubsub.v1.ListTo"
+          + "picSnapshotsRequest\032,.google.pubsub.v1.L"
+          + "istTopicSnapshotsResponse\"1\202\323\344\223\002+\022)/v1/{"
+          + "topic=projects/*/topics/*}/snapshots\022t\n\013"
+          + "DeleteTopic\022$.google.pubsub.v1.DeleteTop"
+          + "icRequest\032\026.google.protobuf.Empty\"\'\202\323\344\223\002"
+          + "!*\037/v1/{topic=projects/*/topics/*}2\371\021\n\nS"
+          + "ubscriber\022\206\001\n\022CreateSubscription\022\036.googl"
+          + "e.pubsub.v1.Subscription\032\036.google.pubsub"
+          + ".v1.Subscription\"0\202\323\344\223\002*\032%/v1/{name=proj"
+          + "ects/*/subscriptions/*}:\001*\022\222\001\n\017GetSubscr"
+          + "iption\022(.google.pubsub.v1.GetSubscriptio"
+          + "nRequest\032\036.google.pubsub.v1.Subscription"
+          + "\"5\202\323\344\223\002/\022-/v1/{subscription=projects/*/s"
+          + "ubscriptions/*}\022\240\001\n\022UpdateSubscription\022+"
+          + ".google.pubsub.v1.UpdateSubscriptionRequ"
+          + "est\032\036.google.pubsub.v1.Subscription\"=\202\323\344"
+          + "\223\002722/v1/{subscription.name=projects/*/s"
+          + "ubscriptions/*}:\001*\022\234\001\n\021ListSubscriptions"
+          + "\022*.google.pubsub.v1.ListSubscriptionsReq"
+          + "uest\032+.google.pubsub.v1.ListSubscription"
+          + "sResponse\".\202\323\344\223\002(\022&/v1/{project=projects"
+          + "/*}/subscriptions\022\220\001\n\022DeleteSubscription"
+          + "\022+.google.pubsub.v1.DeleteSubscriptionRe"
+          + "quest\032\026.google.protobuf.Empty\"5\202\323\344\223\002/*-/"
+          + "v1/{subscription=projects/*/subscription"
+          + "s/*}\022\243\001\n\021ModifyAckDeadline\022*.google.pubs"
+          + "ub.v1.ModifyAckDeadlineRequest\032\026.google."
+          + "protobuf.Empty\"J\202\323\344\223\002D\"?/v1/{subscriptio"
+          + "n=projects/*/subscriptions/*}:modifyAckD"
+          + "eadline:\001*\022\221\001\n\013Acknowledge\022$.google.pubs"
+          + "ub.v1.AcknowledgeRequest\032\026.google.protob"
+          + "uf.Empty\"D\202\323\344\223\002>\"9/v1/{subscription=proj"
+          + "ects/*/subscriptions/*}:acknowledge:\001*\022\204"
+          + "\001\n\004Pull\022\035.google.pubsub.v1.PullRequest\032\036"
+          + ".google.pubsub.v1.PullResponse\"=\202\323\344\223\0027\"2"
+          + "/v1/{subscription=projects/*/subscriptio"
+          + "ns/*}:pull:\001*\022f\n\rStreamingPull\022&.google."
+          + "pubsub.v1.StreamingPullRequest\032\'.google."
+          + "pubsub.v1.StreamingPullResponse\"\000(\0010\001\022\240\001"
+          + "\n\020ModifyPushConfig\022).google.pubsub.v1.Mo"
+          + "difyPushConfigRequest\032\026.google.protobuf."
+          + "Empty\"I\202\323\344\223\002C\">/v1/{subscription=project"
+          + "s/*/subscriptions/*}:modifyPushConfig:\001*"
+          + "\022~\n\013GetSnapshot\022$.google.pubsub.v1.GetSn"
+          + "apshotRequest\032\032.google.pubsub.v1.Snapsho"
+          + "t\"-\202\323\344\223\002\'\022%/v1/{snapshot=projects/*/snap"
+          + "shots/*}\022\214\001\n\rListSnapshots\022&.google.pubs"
+          + "ub.v1.ListSnapshotsRequest\032\'.google.pubs"
+          + "ub.v1.ListSnapshotsResponse\"*\202\323\344\223\002$\022\"/v1"
+          + "/{project=projects/*}/snapshots\022\203\001\n\016Crea"
+          + "teSnapshot\022\'.google.pubsub.v1.CreateSnap"
+          + "shotRequest\032\032.google.pubsub.v1.Snapshot\""
+          + ",\202\323\344\223\002&\032!/v1/{name=projects/*/snapshots/"
+          + "*}:\001*\022\214\001\n\016UpdateSnapshot\022\'.google.pubsub"
+          + ".v1.UpdateSnapshotRequest\032\032.google.pubsu"
+          + "b.v1.Snapshot\"5\202\323\344\223\002/2*/v1/{snapshot.nam"
+          + "e=projects/*/snapshots/*}:\001*\022\200\001\n\016DeleteS"
+          + "napshot\022\'.google.pubsub.v1.DeleteSnapsho"
+          + "tRequest\032\026.google.protobuf.Empty\"-\202\323\344\223\002\'"
+          + "*%/v1/{snapshot=projects/*/snapshots/*}\022"
+          + "\204\001\n\004Seek\022\035.google.pubsub.v1.SeekRequest\032"
+          + "\036.google.pubsub.v1.SeekResponse\"=\202\323\344\223\0027\""
+          + "2/v1/{subscription=projects/*/subscripti"
+          + "ons/*}:seek:\001*B\256\001\n\024com.google.pubsub.v1B"
+          + "\013PubsubProtoP\001Z6google.golang.org/genpro"
+          + "to/googleapis/pubsub/v1;pubsub\370\001\001\252\002\026Goog"
+          + "le.Cloud.PubSub.V1\312\002\026Google\\Cloud\\PubSub"
+          + "\\V1\352\002\031Google::Cloud::PubSub::V1b\006proto3"
     };
     com.google.protobuf.Descriptors.FileDescriptor.InternalDescriptorAssigner assigner =
         new com.google.protobuf.Descriptors.FileDescriptor.InternalDescriptorAssigner() {
@@ -578,7 +585,7 @@ public com.google.protobuf.ExtensionRegistry assignDescriptors(
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_pubsub_v1_PushConfig_descriptor,
             new java.lang.String[] {
-              "PushEndpoint", "Attributes",
+              "PushEndpoint", "Attributes", "OidcToken", "AuthenticationMethod",
             });
     internal_static_google_pubsub_v1_PushConfig_AttributesEntry_descriptor =
         internal_static_google_pubsub_v1_PushConfig_descriptor.getNestedTypes().get(0);
@@ -588,6 +595,14 @@ public com.google.protobuf.ExtensionRegistry assignDescriptors(
             new java.lang.String[] {
               "Key", "Value",
             });
+    internal_static_google_pubsub_v1_PushConfig_OidcToken_descriptor =
+        internal_static_google_pubsub_v1_PushConfig_descriptor.getNestedTypes().get(1);
+    internal_static_google_pubsub_v1_PushConfig_OidcToken_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_pubsub_v1_PushConfig_OidcToken_descriptor,
+            new java.lang.String[] {
+              "ServiceAccountEmail", "Audience",
+            });
     internal_static_google_pubsub_v1_ReceivedMessage_descriptor =
         getDescriptor().getMessageTypes().get(17);
     internal_static_google_pubsub_v1_ReceivedMessage_fieldAccessorTable =
diff --git a/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PushConfig.java b/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PushConfig.java
index 5f483cb689e1..2f4ea218ae06 100644
--- a/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PushConfig.java
+++ b/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PushConfig.java
@@ -72,6 +72,24 @@ private PushConfig(
               attributes_.getMutableMap().put(attributes__.getKey(), attributes__.getValue());
               break;
             }
+          case 26:
+            {
+              com.google.pubsub.v1.PushConfig.OidcToken.Builder subBuilder = null;
+              if (authenticationMethodCase_ == 3) {
+                subBuilder =
+                    ((com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_).toBuilder();
+              }
+              authenticationMethod_ =
+                  input.readMessage(
+                      com.google.pubsub.v1.PushConfig.OidcToken.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(
+                    (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_);
+                authenticationMethod_ = subBuilder.buildPartial();
+              }
+              authenticationMethodCase_ = 3;
+              break;
+            }
           default:
             {
               if (!parseUnknownFieldProto3(input, unknownFields, extensionRegistry, tag)) {
@@ -115,7 +133,944 @@ protected com.google.protobuf.MapField internalGetMapField(int number) {
             com.google.pubsub.v1.PushConfig.class, com.google.pubsub.v1.PushConfig.Builder.class);
   }
 
+  public interface OidcTokenOrBuilder
+      extends
+      // @@protoc_insertion_point(interface_extends:google.pubsub.v1.PushConfig.OidcToken)
+      com.google.protobuf.MessageOrBuilder {
+
+    /**
+     *
+     *
+     * <pre>
+     * [Service account
+     * email](https://cloud.google.com/iam/docs/service-accounts)
+     * to be used for generating the OIDC token. The caller (for
+     * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+     * have the iam.serviceAccounts.actAs permission for the service account.
+     * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+     * </pre>
+     *
+     * <code>string service_account_email = 1;</code>
+     */
+    java.lang.String getServiceAccountEmail();
+    /**
+     *
+     *
+     * <pre>
+     * [Service account
+     * email](https://cloud.google.com/iam/docs/service-accounts)
+     * to be used for generating the OIDC token. The caller (for
+     * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+     * have the iam.serviceAccounts.actAs permission for the service account.
+     * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+     * </pre>
+     *
+     * <code>string service_account_email = 1;</code>
+     */
+    com.google.protobuf.ByteString getServiceAccountEmailBytes();
+
+    /**
+     *
+     *
+     * <pre>
+     * Audience to be used when generating OIDC token. The audience claim
+     * identifies the recipients that the JWT is intended for. The audience
+     * value is a single case-sensitive string. Having multiple values (array)
+     * for the audience field is not supported. More info about the OIDC JWT
+     * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+     * Note: if not specified, the Push endpoint URL will be used.
+     * </pre>
+     *
+     * <code>string audience = 2;</code>
+     */
+    java.lang.String getAudience();
+    /**
+     *
+     *
+     * <pre>
+     * Audience to be used when generating OIDC token. The audience claim
+     * identifies the recipients that the JWT is intended for. The audience
+     * value is a single case-sensitive string. Having multiple values (array)
+     * for the audience field is not supported. More info about the OIDC JWT
+     * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+     * Note: if not specified, the Push endpoint URL will be used.
+     * </pre>
+     *
+     * <code>string audience = 2;</code>
+     */
+    com.google.protobuf.ByteString getAudienceBytes();
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Contains information needed for generating an
+   * [OpenID Connect
+   * token](https://developers.google.com/identity/protocols/OpenIDConnect).
+   * </pre>
+   *
+   * Protobuf type {@code google.pubsub.v1.PushConfig.OidcToken}
+   */
+  public static final class OidcToken extends com.google.protobuf.GeneratedMessageV3
+      implements
+      // @@protoc_insertion_point(message_implements:google.pubsub.v1.PushConfig.OidcToken)
+      OidcTokenOrBuilder {
+    private static final long serialVersionUID = 0L;
+    // Use OidcToken.newBuilder() to construct.
+    private OidcToken(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+      super(builder);
+    }
+
+    private OidcToken() {
+      serviceAccountEmail_ = "";
+      audience_ = "";
+    }
+
+    @java.lang.Override
+    public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+      return this.unknownFields;
+    }
+
+    private OidcToken(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      this();
+      if (extensionRegistry == null) {
+        throw new java.lang.NullPointerException();
+      }
+      int mutable_bitField0_ = 0;
+      com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+          com.google.protobuf.UnknownFieldSet.newBuilder();
+      try {
+        boolean done = false;
+        while (!done) {
+          int tag = input.readTag();
+          switch (tag) {
+            case 0:
+              done = true;
+              break;
+            case 10:
+              {
+                java.lang.String s = input.readStringRequireUtf8();
+
+                serviceAccountEmail_ = s;
+                break;
+              }
+            case 18:
+              {
+                java.lang.String s = input.readStringRequireUtf8();
+
+                audience_ = s;
+                break;
+              }
+            default:
+              {
+                if (!parseUnknownFieldProto3(input, unknownFields, extensionRegistry, tag)) {
+                  done = true;
+                }
+                break;
+              }
+          }
+        }
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        throw e.setUnfinishedMessage(this);
+      } catch (java.io.IOException e) {
+        throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+      } finally {
+        this.unknownFields = unknownFields.build();
+        makeExtensionsImmutable();
+      }
+    }
+
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.pubsub.v1.PubsubProto
+          .internal_static_google_pubsub_v1_PushConfig_OidcToken_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.pubsub.v1.PubsubProto
+          .internal_static_google_pubsub_v1_PushConfig_OidcToken_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.pubsub.v1.PushConfig.OidcToken.class,
+              com.google.pubsub.v1.PushConfig.OidcToken.Builder.class);
+    }
+
+    public static final int SERVICE_ACCOUNT_EMAIL_FIELD_NUMBER = 1;
+    private volatile java.lang.Object serviceAccountEmail_;
+    /**
+     *
+     *
+     * <pre>
+     * [Service account
+     * email](https://cloud.google.com/iam/docs/service-accounts)
+     * to be used for generating the OIDC token. The caller (for
+     * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+     * have the iam.serviceAccounts.actAs permission for the service account.
+     * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+     * </pre>
+     *
+     * <code>string service_account_email = 1;</code>
+     */
+    public java.lang.String getServiceAccountEmail() {
+      java.lang.Object ref = serviceAccountEmail_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        serviceAccountEmail_ = s;
+        return s;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * [Service account
+     * email](https://cloud.google.com/iam/docs/service-accounts)
+     * to be used for generating the OIDC token. The caller (for
+     * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+     * have the iam.serviceAccounts.actAs permission for the service account.
+     * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+     * </pre>
+     *
+     * <code>string service_account_email = 1;</code>
+     */
+    public com.google.protobuf.ByteString getServiceAccountEmailBytes() {
+      java.lang.Object ref = serviceAccountEmail_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        serviceAccountEmail_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
+    public static final int AUDIENCE_FIELD_NUMBER = 2;
+    private volatile java.lang.Object audience_;
+    /**
+     *
+     *
+     * <pre>
+     * Audience to be used when generating OIDC token. The audience claim
+     * identifies the recipients that the JWT is intended for. The audience
+     * value is a single case-sensitive string. Having multiple values (array)
+     * for the audience field is not supported. More info about the OIDC JWT
+     * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+     * Note: if not specified, the Push endpoint URL will be used.
+     * </pre>
+     *
+     * <code>string audience = 2;</code>
+     */
+    public java.lang.String getAudience() {
+      java.lang.Object ref = audience_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        audience_ = s;
+        return s;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Audience to be used when generating OIDC token. The audience claim
+     * identifies the recipients that the JWT is intended for. The audience
+     * value is a single case-sensitive string. Having multiple values (array)
+     * for the audience field is not supported. More info about the OIDC JWT
+     * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+     * Note: if not specified, the Push endpoint URL will be used.
+     * </pre>
+     *
+     * <code>string audience = 2;</code>
+     */
+    public com.google.protobuf.ByteString getAudienceBytes() {
+      java.lang.Object ref = audience_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        audience_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
+    private byte memoizedIsInitialized = -1;
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      byte isInitialized = memoizedIsInitialized;
+      if (isInitialized == 1) return true;
+      if (isInitialized == 0) return false;
+
+      memoizedIsInitialized = 1;
+      return true;
+    }
+
+    @java.lang.Override
+    public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+      if (!getServiceAccountEmailBytes().isEmpty()) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 1, serviceAccountEmail_);
+      }
+      if (!getAudienceBytes().isEmpty()) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 2, audience_);
+      }
+      unknownFields.writeTo(output);
+    }
+
+    @java.lang.Override
+    public int getSerializedSize() {
+      int size = memoizedSize;
+      if (size != -1) return size;
+
+      size = 0;
+      if (!getServiceAccountEmailBytes().isEmpty()) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, serviceAccountEmail_);
+      }
+      if (!getAudienceBytes().isEmpty()) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(2, audience_);
+      }
+      size += unknownFields.getSerializedSize();
+      memoizedSize = size;
+      return size;
+    }
+
+    @java.lang.Override
+    public boolean equals(final java.lang.Object obj) {
+      if (obj == this) {
+        return true;
+      }
+      if (!(obj instanceof com.google.pubsub.v1.PushConfig.OidcToken)) {
+        return super.equals(obj);
+      }
+      com.google.pubsub.v1.PushConfig.OidcToken other =
+          (com.google.pubsub.v1.PushConfig.OidcToken) obj;
+
+      boolean result = true;
+      result = result && getServiceAccountEmail().equals(other.getServiceAccountEmail());
+      result = result && getAudience().equals(other.getAudience());
+      result = result && unknownFields.equals(other.unknownFields);
+      return result;
+    }
+
+    @java.lang.Override
+    public int hashCode() {
+      if (memoizedHashCode != 0) {
+        return memoizedHashCode;
+      }
+      int hash = 41;
+      hash = (19 * hash) + getDescriptor().hashCode();
+      hash = (37 * hash) + SERVICE_ACCOUNT_EMAIL_FIELD_NUMBER;
+      hash = (53 * hash) + getServiceAccountEmail().hashCode();
+      hash = (37 * hash) + AUDIENCE_FIELD_NUMBER;
+      hash = (53 * hash) + getAudience().hashCode();
+      hash = (29 * hash) + unknownFields.hashCode();
+      memoizedHashCode = hash;
+      return hash;
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(java.nio.ByteBuffer data)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(
+        java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data, extensionRegistry);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(
+        com.google.protobuf.ByteString data)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(
+        com.google.protobuf.ByteString data,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data, extensionRegistry);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(byte[] data)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(
+        byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data, extensionRegistry);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(java.io.InputStream input)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(
+        java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+          PARSER, input, extensionRegistry);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseDelimitedFrom(
+        java.io.InputStream input) throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseDelimitedFrom(
+        java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+          PARSER, input, extensionRegistry);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(
+        com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken parseFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+          PARSER, input, extensionRegistry);
+    }
+
+    @java.lang.Override
+    public Builder newBuilderForType() {
+      return newBuilder();
+    }
+
+    public static Builder newBuilder() {
+      return DEFAULT_INSTANCE.toBuilder();
+    }
+
+    public static Builder newBuilder(com.google.pubsub.v1.PushConfig.OidcToken prototype) {
+      return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+    }
+
+    @java.lang.Override
+    public Builder toBuilder() {
+      return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+    }
+
+    @java.lang.Override
+    protected Builder newBuilderForType(
+        com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      Builder builder = new Builder(parent);
+      return builder;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Contains information needed for generating an
+     * [OpenID Connect
+     * token](https://developers.google.com/identity/protocols/OpenIDConnect).
+     * </pre>
+     *
+     * Protobuf type {@code google.pubsub.v1.PushConfig.OidcToken}
+     */
+    public static final class Builder
+        extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+        implements
+        // @@protoc_insertion_point(builder_implements:google.pubsub.v1.PushConfig.OidcToken)
+        com.google.pubsub.v1.PushConfig.OidcTokenOrBuilder {
+      public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+        return com.google.pubsub.v1.PubsubProto
+            .internal_static_google_pubsub_v1_PushConfig_OidcToken_descriptor;
+      }
+
+      @java.lang.Override
+      protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+          internalGetFieldAccessorTable() {
+        return com.google.pubsub.v1.PubsubProto
+            .internal_static_google_pubsub_v1_PushConfig_OidcToken_fieldAccessorTable
+            .ensureFieldAccessorsInitialized(
+                com.google.pubsub.v1.PushConfig.OidcToken.class,
+                com.google.pubsub.v1.PushConfig.OidcToken.Builder.class);
+      }
+
+      // Construct using com.google.pubsub.v1.PushConfig.OidcToken.newBuilder()
+      private Builder() {
+        maybeForceBuilderInitialization();
+      }
+
+      private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+        super(parent);
+        maybeForceBuilderInitialization();
+      }
+
+      private void maybeForceBuilderInitialization() {
+        if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+      }
+
+      @java.lang.Override
+      public Builder clear() {
+        super.clear();
+        serviceAccountEmail_ = "";
+
+        audience_ = "";
+
+        return this;
+      }
+
+      @java.lang.Override
+      public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+        return com.google.pubsub.v1.PubsubProto
+            .internal_static_google_pubsub_v1_PushConfig_OidcToken_descriptor;
+      }
+
+      @java.lang.Override
+      public com.google.pubsub.v1.PushConfig.OidcToken getDefaultInstanceForType() {
+        return com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance();
+      }
+
+      @java.lang.Override
+      public com.google.pubsub.v1.PushConfig.OidcToken build() {
+        com.google.pubsub.v1.PushConfig.OidcToken result = buildPartial();
+        if (!result.isInitialized()) {
+          throw newUninitializedMessageException(result);
+        }
+        return result;
+      }
+
+      @java.lang.Override
+      public com.google.pubsub.v1.PushConfig.OidcToken buildPartial() {
+        com.google.pubsub.v1.PushConfig.OidcToken result =
+            new com.google.pubsub.v1.PushConfig.OidcToken(this);
+        result.serviceAccountEmail_ = serviceAccountEmail_;
+        result.audience_ = audience_;
+        onBuilt();
+        return result;
+      }
+
+      @java.lang.Override
+      public Builder clone() {
+        return (Builder) super.clone();
+      }
+
+      @java.lang.Override
+      public Builder setField(
+          com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+        return (Builder) super.setField(field, value);
+      }
+
+      @java.lang.Override
+      public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+        return (Builder) super.clearField(field);
+      }
+
+      @java.lang.Override
+      public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+        return (Builder) super.clearOneof(oneof);
+      }
+
+      @java.lang.Override
+      public Builder setRepeatedField(
+          com.google.protobuf.Descriptors.FieldDescriptor field,
+          int index,
+          java.lang.Object value) {
+        return (Builder) super.setRepeatedField(field, index, value);
+      }
+
+      @java.lang.Override
+      public Builder addRepeatedField(
+          com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+        return (Builder) super.addRepeatedField(field, value);
+      }
+
+      @java.lang.Override
+      public Builder mergeFrom(com.google.protobuf.Message other) {
+        if (other instanceof com.google.pubsub.v1.PushConfig.OidcToken) {
+          return mergeFrom((com.google.pubsub.v1.PushConfig.OidcToken) other);
+        } else {
+          super.mergeFrom(other);
+          return this;
+        }
+      }
+
+      public Builder mergeFrom(com.google.pubsub.v1.PushConfig.OidcToken other) {
+        if (other == com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance()) return this;
+        if (!other.getServiceAccountEmail().isEmpty()) {
+          serviceAccountEmail_ = other.serviceAccountEmail_;
+          onChanged();
+        }
+        if (!other.getAudience().isEmpty()) {
+          audience_ = other.audience_;
+          onChanged();
+        }
+        this.mergeUnknownFields(other.unknownFields);
+        onChanged();
+        return this;
+      }
+
+      @java.lang.Override
+      public final boolean isInitialized() {
+        return true;
+      }
+
+      @java.lang.Override
+      public Builder mergeFrom(
+          com.google.protobuf.CodedInputStream input,
+          com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+          throws java.io.IOException {
+        com.google.pubsub.v1.PushConfig.OidcToken parsedMessage = null;
+        try {
+          parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+        } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+          parsedMessage = (com.google.pubsub.v1.PushConfig.OidcToken) e.getUnfinishedMessage();
+          throw e.unwrapIOException();
+        } finally {
+          if (parsedMessage != null) {
+            mergeFrom(parsedMessage);
+          }
+        }
+        return this;
+      }
+
+      private java.lang.Object serviceAccountEmail_ = "";
+      /**
+       *
+       *
+       * <pre>
+       * [Service account
+       * email](https://cloud.google.com/iam/docs/service-accounts)
+       * to be used for generating the OIDC token. The caller (for
+       * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+       * have the iam.serviceAccounts.actAs permission for the service account.
+       * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+       * </pre>
+       *
+       * <code>string service_account_email = 1;</code>
+       */
+      public java.lang.String getServiceAccountEmail() {
+        java.lang.Object ref = serviceAccountEmail_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          serviceAccountEmail_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       *
+       *
+       * <pre>
+       * [Service account
+       * email](https://cloud.google.com/iam/docs/service-accounts)
+       * to be used for generating the OIDC token. The caller (for
+       * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+       * have the iam.serviceAccounts.actAs permission for the service account.
+       * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+       * </pre>
+       *
+       * <code>string service_account_email = 1;</code>
+       */
+      public com.google.protobuf.ByteString getServiceAccountEmailBytes() {
+        java.lang.Object ref = serviceAccountEmail_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b =
+              com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+          serviceAccountEmail_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       *
+       *
+       * <pre>
+       * [Service account
+       * email](https://cloud.google.com/iam/docs/service-accounts)
+       * to be used for generating the OIDC token. The caller (for
+       * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+       * have the iam.serviceAccounts.actAs permission for the service account.
+       * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+       * </pre>
+       *
+       * <code>string service_account_email = 1;</code>
+       */
+      public Builder setServiceAccountEmail(java.lang.String value) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+
+        serviceAccountEmail_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       *
+       *
+       * <pre>
+       * [Service account
+       * email](https://cloud.google.com/iam/docs/service-accounts)
+       * to be used for generating the OIDC token. The caller (for
+       * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+       * have the iam.serviceAccounts.actAs permission for the service account.
+       * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+       * </pre>
+       *
+       * <code>string service_account_email = 1;</code>
+       */
+      public Builder clearServiceAccountEmail() {
+
+        serviceAccountEmail_ = getDefaultInstance().getServiceAccountEmail();
+        onChanged();
+        return this;
+      }
+      /**
+       *
+       *
+       * <pre>
+       * [Service account
+       * email](https://cloud.google.com/iam/docs/service-accounts)
+       * to be used for generating the OIDC token. The caller (for
+       * CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+       * have the iam.serviceAccounts.actAs permission for the service account.
+       * See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+       * </pre>
+       *
+       * <code>string service_account_email = 1;</code>
+       */
+      public Builder setServiceAccountEmailBytes(com.google.protobuf.ByteString value) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        checkByteStringIsUtf8(value);
+
+        serviceAccountEmail_ = value;
+        onChanged();
+        return this;
+      }
+
+      private java.lang.Object audience_ = "";
+      /**
+       *
+       *
+       * <pre>
+       * Audience to be used when generating OIDC token. The audience claim
+       * identifies the recipients that the JWT is intended for. The audience
+       * value is a single case-sensitive string. Having multiple values (array)
+       * for the audience field is not supported. More info about the OIDC JWT
+       * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+       * Note: if not specified, the Push endpoint URL will be used.
+       * </pre>
+       *
+       * <code>string audience = 2;</code>
+       */
+      public java.lang.String getAudience() {
+        java.lang.Object ref = audience_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          audience_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       *
+       *
+       * <pre>
+       * Audience to be used when generating OIDC token. The audience claim
+       * identifies the recipients that the JWT is intended for. The audience
+       * value is a single case-sensitive string. Having multiple values (array)
+       * for the audience field is not supported. More info about the OIDC JWT
+       * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+       * Note: if not specified, the Push endpoint URL will be used.
+       * </pre>
+       *
+       * <code>string audience = 2;</code>
+       */
+      public com.google.protobuf.ByteString getAudienceBytes() {
+        java.lang.Object ref = audience_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b =
+              com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+          audience_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       *
+       *
+       * <pre>
+       * Audience to be used when generating OIDC token. The audience claim
+       * identifies the recipients that the JWT is intended for. The audience
+       * value is a single case-sensitive string. Having multiple values (array)
+       * for the audience field is not supported. More info about the OIDC JWT
+       * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+       * Note: if not specified, the Push endpoint URL will be used.
+       * </pre>
+       *
+       * <code>string audience = 2;</code>
+       */
+      public Builder setAudience(java.lang.String value) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+
+        audience_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       *
+       *
+       * <pre>
+       * Audience to be used when generating OIDC token. The audience claim
+       * identifies the recipients that the JWT is intended for. The audience
+       * value is a single case-sensitive string. Having multiple values (array)
+       * for the audience field is not supported. More info about the OIDC JWT
+       * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+       * Note: if not specified, the Push endpoint URL will be used.
+       * </pre>
+       *
+       * <code>string audience = 2;</code>
+       */
+      public Builder clearAudience() {
+
+        audience_ = getDefaultInstance().getAudience();
+        onChanged();
+        return this;
+      }
+      /**
+       *
+       *
+       * <pre>
+       * Audience to be used when generating OIDC token. The audience claim
+       * identifies the recipients that the JWT is intended for. The audience
+       * value is a single case-sensitive string. Having multiple values (array)
+       * for the audience field is not supported. More info about the OIDC JWT
+       * token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+       * Note: if not specified, the Push endpoint URL will be used.
+       * </pre>
+       *
+       * <code>string audience = 2;</code>
+       */
+      public Builder setAudienceBytes(com.google.protobuf.ByteString value) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        checkByteStringIsUtf8(value);
+
+        audience_ = value;
+        onChanged();
+        return this;
+      }
+
+      @java.lang.Override
+      public final Builder setUnknownFields(
+          final com.google.protobuf.UnknownFieldSet unknownFields) {
+        return super.setUnknownFieldsProto3(unknownFields);
+      }
+
+      @java.lang.Override
+      public final Builder mergeUnknownFields(
+          final com.google.protobuf.UnknownFieldSet unknownFields) {
+        return super.mergeUnknownFields(unknownFields);
+      }
+
+      // @@protoc_insertion_point(builder_scope:google.pubsub.v1.PushConfig.OidcToken)
+    }
+
+    // @@protoc_insertion_point(class_scope:google.pubsub.v1.PushConfig.OidcToken)
+    private static final com.google.pubsub.v1.PushConfig.OidcToken DEFAULT_INSTANCE;
+
+    static {
+      DEFAULT_INSTANCE = new com.google.pubsub.v1.PushConfig.OidcToken();
+    }
+
+    public static com.google.pubsub.v1.PushConfig.OidcToken getDefaultInstance() {
+      return DEFAULT_INSTANCE;
+    }
+
+    private static final com.google.protobuf.Parser<OidcToken> PARSER =
+        new com.google.protobuf.AbstractParser<OidcToken>() {
+          @java.lang.Override
+          public OidcToken parsePartialFrom(
+              com.google.protobuf.CodedInputStream input,
+              com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+              throws com.google.protobuf.InvalidProtocolBufferException {
+            return new OidcToken(input, extensionRegistry);
+          }
+        };
+
+    public static com.google.protobuf.Parser<OidcToken> parser() {
+      return PARSER;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Parser<OidcToken> getParserForType() {
+      return PARSER;
+    }
+
+    @java.lang.Override
+    public com.google.pubsub.v1.PushConfig.OidcToken getDefaultInstanceForType() {
+      return DEFAULT_INSTANCE;
+    }
+  }
+
   private int bitField0_;
+  private int authenticationMethodCase_ = 0;
+  private java.lang.Object authenticationMethod_;
+
+  public enum AuthenticationMethodCase implements com.google.protobuf.Internal.EnumLite {
+    OIDC_TOKEN(3),
+    AUTHENTICATIONMETHOD_NOT_SET(0);
+    private final int value;
+
+    private AuthenticationMethodCase(int value) {
+      this.value = value;
+    }
+    /** @deprecated Use {@link #forNumber(int)} instead. */
+    @java.lang.Deprecated
+    public static AuthenticationMethodCase valueOf(int value) {
+      return forNumber(value);
+    }
+
+    public static AuthenticationMethodCase forNumber(int value) {
+      switch (value) {
+        case 3:
+          return OIDC_TOKEN;
+        case 0:
+          return AUTHENTICATIONMETHOD_NOT_SET;
+        default:
+          return null;
+      }
+    }
+
+    public int getNumber() {
+      return this.value;
+    }
+  };
+
+  public AuthenticationMethodCase getAuthenticationMethodCase() {
+    return AuthenticationMethodCase.forNumber(authenticationMethodCase_);
+  }
+
   public static final int PUSH_ENDPOINT_FIELD_NUMBER = 1;
   private volatile java.lang.Object pushEndpoint_;
   /**
@@ -315,6 +1270,53 @@ public java.lang.String getAttributesOrThrow(java.lang.String key) {
     return map.get(key);
   }
 
+  public static final int OIDC_TOKEN_FIELD_NUMBER = 3;
+  /**
+   *
+   *
+   * <pre>
+   * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+   * `Authorization` header in the HTTP request for every pushed message.
+   * </pre>
+   *
+   * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+   */
+  public boolean hasOidcToken() {
+    return authenticationMethodCase_ == 3;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+   * `Authorization` header in the HTTP request for every pushed message.
+   * </pre>
+   *
+   * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+   */
+  public com.google.pubsub.v1.PushConfig.OidcToken getOidcToken() {
+    if (authenticationMethodCase_ == 3) {
+      return (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_;
+    }
+    return com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance();
+  }
+  /**
+   *
+   *
+   * <pre>
+   * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+   * `Authorization` header in the HTTP request for every pushed message.
+   * </pre>
+   *
+   * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+   */
+  public com.google.pubsub.v1.PushConfig.OidcTokenOrBuilder getOidcTokenOrBuilder() {
+    if (authenticationMethodCase_ == 3) {
+      return (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_;
+    }
+    return com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance();
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -334,6 +1336,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     }
     com.google.protobuf.GeneratedMessageV3.serializeStringMapTo(
         output, internalGetAttributes(), AttributesDefaultEntryHolder.defaultEntry, 2);
+    if (authenticationMethodCase_ == 3) {
+      output.writeMessage(3, (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -356,6 +1361,11 @@ public int getSerializedSize() {
               .build();
       size += com.google.protobuf.CodedOutputStream.computeMessageSize(2, attributes__);
     }
+    if (authenticationMethodCase_ == 3) {
+      size +=
+          com.google.protobuf.CodedOutputStream.computeMessageSize(
+              3, (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -374,6 +1384,15 @@ public boolean equals(final java.lang.Object obj) {
     boolean result = true;
     result = result && getPushEndpoint().equals(other.getPushEndpoint());
     result = result && internalGetAttributes().equals(other.internalGetAttributes());
+    result = result && getAuthenticationMethodCase().equals(other.getAuthenticationMethodCase());
+    if (!result) return false;
+    switch (authenticationMethodCase_) {
+      case 3:
+        result = result && getOidcToken().equals(other.getOidcToken());
+        break;
+      case 0:
+      default:
+    }
     result = result && unknownFields.equals(other.unknownFields);
     return result;
   }
@@ -391,6 +1410,14 @@ public int hashCode() {
       hash = (37 * hash) + ATTRIBUTES_FIELD_NUMBER;
       hash = (53 * hash) + internalGetAttributes().hashCode();
     }
+    switch (authenticationMethodCase_) {
+      case 3:
+        hash = (37 * hash) + OIDC_TOKEN_FIELD_NUMBER;
+        hash = (53 * hash) + getOidcToken().hashCode();
+        break;
+      case 0:
+      default:
+    }
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -557,6 +1584,8 @@ public Builder clear() {
       pushEndpoint_ = "";
 
       internalGetMutableAttributes().clear();
+      authenticationMethodCase_ = 0;
+      authenticationMethod_ = null;
       return this;
     }
 
@@ -588,7 +1617,15 @@ public com.google.pubsub.v1.PushConfig buildPartial() {
       result.pushEndpoint_ = pushEndpoint_;
       result.attributes_ = internalGetAttributes();
       result.attributes_.makeImmutable();
+      if (authenticationMethodCase_ == 3) {
+        if (oidcTokenBuilder_ == null) {
+          result.authenticationMethod_ = authenticationMethod_;
+        } else {
+          result.authenticationMethod_ = oidcTokenBuilder_.build();
+        }
+      }
       result.bitField0_ = to_bitField0_;
+      result.authenticationMethodCase_ = authenticationMethodCase_;
       onBuilt();
       return result;
     }
@@ -643,6 +1680,17 @@ public Builder mergeFrom(com.google.pubsub.v1.PushConfig other) {
         onChanged();
       }
       internalGetMutableAttributes().mergeFrom(other.internalGetAttributes());
+      switch (other.getAuthenticationMethodCase()) {
+        case OIDC_TOKEN:
+          {
+            mergeOidcToken(other.getOidcToken());
+            break;
+          }
+        case AUTHENTICATIONMETHOD_NOT_SET:
+          {
+            break;
+          }
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -672,6 +1720,20 @@ public Builder mergeFrom(
       return this;
     }
 
+    private int authenticationMethodCase_ = 0;
+    private java.lang.Object authenticationMethod_;
+
+    public AuthenticationMethodCase getAuthenticationMethodCase() {
+      return AuthenticationMethodCase.forNumber(authenticationMethodCase_);
+    }
+
+    public Builder clearAuthenticationMethod() {
+      authenticationMethodCase_ = 0;
+      authenticationMethod_ = null;
+      onChanged();
+      return this;
+    }
+
     private int bitField0_;
 
     private java.lang.Object pushEndpoint_ = "";
@@ -1033,6 +2095,217 @@ public Builder putAllAttributes(java.util.Map<java.lang.String, java.lang.String
       return this;
     }
 
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.pubsub.v1.PushConfig.OidcToken,
+            com.google.pubsub.v1.PushConfig.OidcToken.Builder,
+            com.google.pubsub.v1.PushConfig.OidcTokenOrBuilder>
+        oidcTokenBuilder_;
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    public boolean hasOidcToken() {
+      return authenticationMethodCase_ == 3;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    public com.google.pubsub.v1.PushConfig.OidcToken getOidcToken() {
+      if (oidcTokenBuilder_ == null) {
+        if (authenticationMethodCase_ == 3) {
+          return (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_;
+        }
+        return com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance();
+      } else {
+        if (authenticationMethodCase_ == 3) {
+          return oidcTokenBuilder_.getMessage();
+        }
+        return com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    public Builder setOidcToken(com.google.pubsub.v1.PushConfig.OidcToken value) {
+      if (oidcTokenBuilder_ == null) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        authenticationMethod_ = value;
+        onChanged();
+      } else {
+        oidcTokenBuilder_.setMessage(value);
+      }
+      authenticationMethodCase_ = 3;
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    public Builder setOidcToken(com.google.pubsub.v1.PushConfig.OidcToken.Builder builderForValue) {
+      if (oidcTokenBuilder_ == null) {
+        authenticationMethod_ = builderForValue.build();
+        onChanged();
+      } else {
+        oidcTokenBuilder_.setMessage(builderForValue.build());
+      }
+      authenticationMethodCase_ = 3;
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    public Builder mergeOidcToken(com.google.pubsub.v1.PushConfig.OidcToken value) {
+      if (oidcTokenBuilder_ == null) {
+        if (authenticationMethodCase_ == 3
+            && authenticationMethod_
+                != com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance()) {
+          authenticationMethod_ =
+              com.google.pubsub.v1.PushConfig.OidcToken.newBuilder(
+                      (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_)
+                  .mergeFrom(value)
+                  .buildPartial();
+        } else {
+          authenticationMethod_ = value;
+        }
+        onChanged();
+      } else {
+        if (authenticationMethodCase_ == 3) {
+          oidcTokenBuilder_.mergeFrom(value);
+        }
+        oidcTokenBuilder_.setMessage(value);
+      }
+      authenticationMethodCase_ = 3;
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    public Builder clearOidcToken() {
+      if (oidcTokenBuilder_ == null) {
+        if (authenticationMethodCase_ == 3) {
+          authenticationMethodCase_ = 0;
+          authenticationMethod_ = null;
+          onChanged();
+        }
+      } else {
+        if (authenticationMethodCase_ == 3) {
+          authenticationMethodCase_ = 0;
+          authenticationMethod_ = null;
+        }
+        oidcTokenBuilder_.clear();
+      }
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    public com.google.pubsub.v1.PushConfig.OidcToken.Builder getOidcTokenBuilder() {
+      return getOidcTokenFieldBuilder().getBuilder();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    public com.google.pubsub.v1.PushConfig.OidcTokenOrBuilder getOidcTokenOrBuilder() {
+      if ((authenticationMethodCase_ == 3) && (oidcTokenBuilder_ != null)) {
+        return oidcTokenBuilder_.getMessageOrBuilder();
+      } else {
+        if (authenticationMethodCase_ == 3) {
+          return (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_;
+        }
+        return com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+     * `Authorization` header in the HTTP request for every pushed message.
+     * </pre>
+     *
+     * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+     */
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.pubsub.v1.PushConfig.OidcToken,
+            com.google.pubsub.v1.PushConfig.OidcToken.Builder,
+            com.google.pubsub.v1.PushConfig.OidcTokenOrBuilder>
+        getOidcTokenFieldBuilder() {
+      if (oidcTokenBuilder_ == null) {
+        if (!(authenticationMethodCase_ == 3)) {
+          authenticationMethod_ = com.google.pubsub.v1.PushConfig.OidcToken.getDefaultInstance();
+        }
+        oidcTokenBuilder_ =
+            new com.google.protobuf.SingleFieldBuilderV3<
+                com.google.pubsub.v1.PushConfig.OidcToken,
+                com.google.pubsub.v1.PushConfig.OidcToken.Builder,
+                com.google.pubsub.v1.PushConfig.OidcTokenOrBuilder>(
+                (com.google.pubsub.v1.PushConfig.OidcToken) authenticationMethod_,
+                getParentForChildren(),
+                isClean());
+        authenticationMethod_ = null;
+      }
+      authenticationMethodCase_ = 3;
+      onChanged();
+      ;
+      return oidcTokenBuilder_;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFieldsProto3(unknownFields);
diff --git a/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PushConfigOrBuilder.java b/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PushConfigOrBuilder.java
index d03adf60bebc..b43de54a3da1 100644
--- a/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PushConfigOrBuilder.java
+++ b/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/java/com/google/pubsub/v1/PushConfigOrBuilder.java
@@ -159,4 +159,40 @@ public interface PushConfigOrBuilder
    * <code>map&lt;string, string&gt; attributes = 2;</code>
    */
   java.lang.String getAttributesOrThrow(java.lang.String key);
+
+  /**
+   *
+   *
+   * <pre>
+   * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+   * `Authorization` header in the HTTP request for every pushed message.
+   * </pre>
+   *
+   * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+   */
+  boolean hasOidcToken();
+  /**
+   *
+   *
+   * <pre>
+   * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+   * `Authorization` header in the HTTP request for every pushed message.
+   * </pre>
+   *
+   * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+   */
+  com.google.pubsub.v1.PushConfig.OidcToken getOidcToken();
+  /**
+   *
+   *
+   * <pre>
+   * If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+   * `Authorization` header in the HTTP request for every pushed message.
+   * </pre>
+   *
+   * <code>.google.pubsub.v1.PushConfig.OidcToken oidc_token = 3;</code>
+   */
+  com.google.pubsub.v1.PushConfig.OidcTokenOrBuilder getOidcTokenOrBuilder();
+
+  public com.google.pubsub.v1.PushConfig.AuthenticationMethodCase getAuthenticationMethodCase();
 }
diff --git a/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/proto/google/pubsub/v1/pubsub.proto b/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/proto/google/pubsub/v1/pubsub.proto
index 02d0bf34b3ee..095a37b156fd 100644
--- a/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/proto/google/pubsub/v1/pubsub.proto
+++ b/google-api-grpc/proto-google-cloud-pubsub-v1/src/main/proto/google/pubsub/v1/pubsub.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC.
+// Copyright 2019 Google LLC.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -651,6 +651,42 @@ message PushConfig {
   // * `v1beta1`: uses the push format defined in the v1beta1 Pub/Sub API.
   // * `v1` or `v1beta2`: uses the push format defined in the v1 Pub/Sub API.
   map<string, string> attributes = 2;
+
+  // An authentication method used by push endpoints to verify the source of
+  // push requests. This can be used with push endpoints that are private by
+  // default to allow requests only from the Cloud Pub/Sub system, for example.
+  // This field is optional and should be set only by users interested in
+  // authenticated push.
+  // <b>EXPERIMENTAL:</b> This field a part of a closed alpha that may not be
+  // accessible to all users. It may be changed in backward-incompatible ways
+  // and is not subject to any SLA or deprecation policy.  It is not recommended
+  // for production use.
+  oneof authentication_method {
+    // If specified, Pub/Sub will generate and attach an OIDC JWT token as an
+    // `Authorization` header in the HTTP request for every pushed message.
+    OidcToken oidc_token = 3;
+  }
+
+  // Contains information needed for generating an
+  // [OpenID Connect
+  // token](https://developers.google.com/identity/protocols/OpenIDConnect).
+  message OidcToken {
+    // [Service account
+    // email](https://cloud.google.com/iam/docs/service-accounts)
+    // to be used for generating the OIDC token. The caller (for
+    // CreateSubscription, UpdateSubscription, and ModifyPushConfig calls) must
+    // have the iam.serviceAccounts.actAs permission for the service account.
+    // See https://cloud.google.com/iam/docs/understanding-roles#service-accounts-roles.
+    string service_account_email = 1;
+
+    // Audience to be used when generating OIDC token. The audience claim
+    // identifies the recipients that the JWT is intended for. The audience
+    // value is a single case-sensitive string. Having multiple values (array)
+    // for the audience field is not supported. More info about the OIDC JWT
+    // token audience here: https://tools.ietf.org/html/rfc7519#section-4.1.3
+    // Note: if not specified, the Push endpoint URL will be used.
+    string audience = 2;
+  }
 }
 
 // A message and its corresponding acknowledgment ID.
diff --git a/google-cloud-clients/google-cloud-pubsub/synth.metadata b/google-cloud-clients/google-cloud-pubsub/synth.metadata
index d8183652373c..c596772783e5 100644
--- a/google-cloud-clients/google-cloud-pubsub/synth.metadata
+++ b/google-cloud-clients/google-cloud-pubsub/synth.metadata
@@ -1,19 +1,19 @@
 {
-  "updateTime": "2019-02-13T08:46:41.544485Z",
+  "updateTime": "2019-02-28T08:48:09.044830Z",
   "sources": [
     {
       "generator": {
         "name": "artman",
-        "version": "0.16.13",
-        "dockerImage": "googleapis/artman@sha256:5fd9aee1d82a00cebf425c8fa431f5457539562f5867ad9c54370f0ec9a7ccaa"
+        "version": "0.16.14",
+        "dockerImage": "googleapis/artman@sha256:f3d61ae45abaeefb6be5f228cda22732c2f1b00fb687c79c4bd4f2c42bb1e1a7"
       }
     },
     {
       "git": {
         "name": "googleapis",
         "remote": "https://github.com/googleapis/googleapis.git",
-        "sha": "ca61898878f0926dd9dcc68ba90764f17133efe4",
-        "internalRef": "233680013"
+        "sha": "9c769d3a0e67e4df9b9e8eee480124c2700a7e6c",
+        "internalRef": "235997788"
       }
     }
   ],