code: public Credential getCredentialFromMetadataServiceAccount()
        throws IOException, GeneralSecurityException {
      logger.atFine().log("getCredentialFromMetadataServiceAccount()");
      Credential cred =
          new ComputeCredentialWithRetry(
              new ComputeCredential.Builder(getStaticHttpTransport(), JSON_FACTORY)
                  .setRequestInitializer(new CredentialHttpRetryInitializer()));
      try {
        cred.refreshToken();
      } catch (IOException e) {
        throw new IOException(
            "Error getting access token from metadata server at: " + cred.getTokenServerEncodedUrl(),
            e);
      }
      return cred;
    }
docs: Initializes OAuth2 credential using preconfigured ServiceAccount settings on the local GCE VM.
  See: <a href="https://developers.google.com/compute/docs/authentication">Authenticating from
  Google Compute Engine</a>.