Addressed the PR comments.

Author: vverman

oauth2_http/java/com/google/auth/mtls/MtlsUtils.java

@@ -1,3 +1,33 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google LLC nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
 package com.google.auth.mtls;
 
 import com.google.auth.oauth2.EnvironmentProvider;
@@ -14,7 +44,7 @@
  *
  * <p>For internal use only.
  */
-public class MtlsUtils {
+class MtlsUtils {
   static final String CERTIFICATE_CONFIGURATION_ENV_VARIABLE = "GOOGLE_API_CERTIFICATE_CONFIG";
   static final String WELL_KNOWN_CERTIFICATE_CONFIG_FILE = "certificate_config.json";
   static final String CLOUDSDK_CONFIG_DIRECTORY = "gcloud";
@@ -30,7 +60,7 @@ private MtlsUtils() {
    * @return The path to the certificate file.
    * @throws IOException if the certificate configuration cannot be found or loaded.
    */
-  public static String getCertificatePath(
+  static String getCertificatePath(
       EnvironmentProvider envProvider, PropertyProvider propProvider, String certConfigPathOverride)
       throws IOException {
     String certPath =
@@ -43,7 +73,21 @@ public static String getCertificatePath(
     return certPath;
   }
 
-  public static WorkloadCertificateConfiguration getWorkloadCertificateConfiguration(
+  /**
+   * Resolves and loads the workload certificate configuration.
+   *
+   * <p>The configuration file is resolved in the following order of precedence: 1. The provided
+   * certConfigPathOverride (if not null). 2. The path specified by the
+   * GOOGLE_API_CERTIFICATE_CONFIG environment variable. 3. The well-known certificate configuration
+   * file in the gcloud config directory.
+   *
+   * @param envProvider the environment provider to use for resolving environment variables
+   * @param propProvider the property provider to use for resolving system properties
+   * @param certConfigPathOverride optional override path for the configuration file
+   * @return the loaded WorkloadCertificateConfiguration
+   * @throws IOException if the configuration file cannot be found, read, or parsed
+   */
+  static WorkloadCertificateConfiguration getWorkloadCertificateConfiguration(
       EnvironmentProvider envProvider, PropertyProvider propProvider, String certConfigPathOverride)
       throws IOException {
     File certConfig;

oauth2_http/java/com/google/auth/mtls/X509Provider.java

@@ -31,6 +31,7 @@
 package com.google.auth.mtls;
 
 import com.google.api.client.util.SecurityUtils;
+import com.google.api.core.InternalApi;
 import com.google.auth.oauth2.EnvironmentProvider;
 import com.google.auth.oauth2.PropertyProvider;
 import com.google.auth.oauth2.SystemEnvironmentProvider;
@@ -48,6 +49,7 @@
  * libraries, and the public facing methods may be changed without notice, and have no guarantee of
  * backwards compatibility.
  */
+@InternalApi
 public class X509Provider implements MtlsProvider {
   private final EnvironmentProvider envProvider;
   private final PropertyProvider propProvider;

oauth2_http/java/com/google/auth/oauth2/EnvironmentProvider.java

@@ -1,10 +1,13 @@
 package com.google.auth.oauth2;
 
+import com.google.api.core.InternalApi;
+
 /**
  * Interface for an environment provider.
  *
  * <p>For internal use only.
  */
+@InternalApi
 public interface EnvironmentProvider {
   String getEnv(String name);
 }

oauth2_http/java/com/google/auth/oauth2/PropertyProvider.java

@@ -1,10 +1,13 @@
 package com.google.auth.oauth2;
 
+import com.google.api.core.InternalApi;
+
 /**
  * Interface for a system property provider.
  *
  * <p>For internal use only.
  */
+@InternalApi
 public interface PropertyProvider {
   String getProperty(String property, String def);
 }