gcloud: Wed Mar 23 08:27:29 UTC 2022

gcloud/beta/auth/application-default/print-access-token

@@ -43,15 +43,15 @@ DESCRIPTION
 
 FLAGS
      --scopes=SCOPE,[SCOPE,...]
-        The scopes to authorize for. By default
-        [https://www.googleapis.com/auth/cloud-platform] scopes are used. The
-        list of possible scopes can be found at:
+        The scopes to authorize for. This flag is supported for user accounts
+        and service accounts only. The list of possible scopes can be found at:
         https://developers.google.com/identity/protocols/googlescopes.
 
-        This flag is not for end-user accounts. The scopes of end-user
-        credentials cannot change after authorization. To request a different
-        set of scopes for end-user accounts, rerun gcloud auth
-        application-default login --scopes.
+        For end-user accounts, the provided scopes must be from ['openid',
+        'https://www.googleapis.com/auth/userinfo.email',
+        'https://www.googleapis.com/auth/cloud-platform'], or the scopes
+        previously specified through gcloud auth application-default login
+        --scopes.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,

gcloud/beta/auth/help

@@ -6,15 +6,21 @@ SYNOPSIS
 
 DESCRIPTION
     (BETA) The gcloud auth command group lets you grant and revoke
-    authorization to Google Cloud CLI (gcloud) to access Google Cloud.
+    authorization to Google Cloud CLI (gcloud CLI) to access Google Cloud.
     Typically, when scripting Google Cloud CLI tools for use on multiple
     machines, using gcloud auth activate-service-account is recommended.
 
-    For more information on authorization and credential types, see:
-    https://cloud.google.com/sdk/docs/authorizing.
+    For information about authorization and credential types, see Authorizing
+    the gcloud CLI (https://cloud.google.com/sdk/docs/authorizing). For
+    information about authorizing a service account, see Authorizing with a
+    service account
+    (https://cloud.google.com/sdk/docs/authorizing#authorizing_with_a_service_account).
 
-    While running gcloud auth commands, the --account flag can be specified to
-    any command to use that account without activation.
+    After running gcloud auth commands, you can run other commands with
+    --account=ACCOUNT to authenticate the command with the credentials of the
+    specified account. For information about --account and other gcloud CLI
+    global flags, see the gcloud CLI overview
+    (https://cloud.google.com/sdk/gcloud/reference).
 
 EXAMPLES
     To authenticate a user account with gcloud and minimal user output, run: