curl -X POST https://admin.knoxcall.com/admin/oauth/workload-bindings \
  -H "Authorization: Bearer $SESSION_JWT" \
  -H "X-Tenant-ID: $TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "oauth_client_id": "<your_oauth_client_id>",
    "name": "gcp-prod-api",
    "issuer": "https://accounts.google.com",
    "audience": "knoxcall:api",
    "attribute_conditions": {
      "email": "knoxcall-prod@my-project.iam.gserviceaccount.com"
    },
    "allowed_scopes": ["routes:write", "secrets:read"],
    "access_token_ttl_seconds": 3600
  }'

gcloud run deploy my-service \
  --image gcr.io/my-project/my-service \
  --service-account knoxcall-prod@my-project.iam.gserviceaccount.com \
  --set-env-vars KNOXCALL_TENANT=acme

apiVersion: v1
kind: ServiceAccount
metadata:
  name: knoxcall-caller
  annotations:
    iam.gke.io/gcp-service-account: knoxcall-prod@my-project.iam.gserviceaccount.com

spec:
  template:
    spec:
      serviceAccountName: knoxcall-caller
      containers:
        - env:
            - { name: KNOXCALL_TENANT, value: acme }

import { KnoxCall } from "@knoxcall/sdk";
const client = new KnoxCall({ tenant: process.env.KNOXCALL_TENANT });
const routes = await client.routes.list();