From 1b16bd9cd26a49d3b5a6921ba027830010c5773f Mon Sep 17 00:00:00 2001
From: Luwei Ge <lwge@google.com>
Date: Wed, 29 Oct 2025 17:06:01 +0000
Subject: [PATCH] fix: add env var to allow disabling directpath bound token

---
 .../cloud/spanner/spi/v1/GapicSpannerRpc.java      | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java b/google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java
index 60a99a8bfa3..cc375a98d35 100644
--- a/google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java
+++ b/google-cloud-spanner/src/main/java/com/google/cloud/spanner/spi/v1/GapicSpannerRpc.java
@@ -368,10 +368,12 @@ public GapicSpannerRpc(final SpannerOptions options) {
       boolean isEnableDirectAccess = options.isEnableDirectAccess();
       if (isEnableDirectAccess) {
         defaultChannelProviderBuilder.setAttemptDirectPath(true);
-        // This will let the credentials try to fetch a hard-bound access token if the runtime
-        // environment supports it.
-        defaultChannelProviderBuilder.setAllowHardBoundTokenTypes(
-            Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
+        if (isEnableDirectPathBoundToken()) {
+          // This will let the credentials try to fetch a hard-bound access token if the runtime
+          // environment supports it.
+          defaultChannelProviderBuilder.setAllowHardBoundTokenTypes(
+              Collections.singletonList(InstantiatingGrpcChannelProvider.HardBoundTokenTypes.ALTS));
+        }
         defaultChannelProviderBuilder.setAttemptDirectPathXds();
       }
 
@@ -687,6 +689,10 @@ public static boolean isEnableDirectPathXdsEnv() {
     return Boolean.parseBoolean(System.getenv("GOOGLE_SPANNER_ENABLE_DIRECT_ACCESS"));
   }
 
+  public static boolean isEnableDirectPathBoundToken() {
+    return !Boolean.parseBoolean(System.getenv("GOOGLE_SPANNER_DISABLE_DIRECT_ACCESS_BOUND_TOKEN"));
+  }
+
   private static final RetrySettings ADMIN_REQUESTS_LIMIT_EXCEEDED_RETRY_SETTINGS =
       RetrySettings.newBuilder()
           .setInitialRetryDelayDuration(Duration.ofSeconds(5L))