GCS buckets are REAPI compatible… I know how to make this work with bazel via the newish credential helper feature – where you shove an authorization header into outgoing requests. Can I do the same with pants?

maybe https://www.pantsbuild.org/2.19/reference/global-options#remote_oauth_bearer_token_path