Authentication between services

In addition to authenticating end user requests, you may want to authenticate services (non-human users) that make requests to your API. This page explains how to use service accounts to provide authentication for humans or services.

Overview

To identify a service that sends requests to your API, you use a service account. The calling service uses the service account's private key to sign a secure JSON Web Token (JWT) and sends the signed JWT in the request to your API.

To implement service account authentication in your API and calling service:

  1. Create a service account and key for the calling service to use.
  2. Add support for authentication in the API config for your API Gateway service.

  3. Add code to the calling service that:

    • Creates a JWT and signs it with the service account's private key.
    • Sends the signed JWT in a request to the API.

API Gateway validates that the claims in the JWT match the configuration in your API config before forwarding the request to your API. API Gateway doesn't check for Cloud Identity permissions that you have granted on the service account.

Prerequisites

This page assumes that you have already:

Create a service account with a key

You need a service account with a private key file that the calling service uses to sign the JWT. If you have more than one service sending requests to your API, you can create one service account to represent all the calling services. If you need to differentiate between the services—for example, they might have different permissions—you can create a service account and key for each calling service.

This section shows how to use the Google Cloud console and the gcloud command-line tool to create the service account and private key file and to assign the service account the Service Account Token Creator role. For information on using an API to do this task, see Create and manage service accounts.

To create a service account with a key:

Google Cloud console

Create a service account:

  1. In the Google Cloud console, go to Create service account.

    Go to Create service account

  2. Select a project.

  3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

  4. Optional: In the Service account description field, enter a description.

  5. Click Create.

  6. Click the Select a role field.

    Under All roles, select Service Accounts > Service Account Token Creator.

  7. Click Continue.

  8. Click Done to finish creating the service account.

    Don't close your browser window. You will use it in the next procedure.

Create a service account key:

  1. In the Google Cloud console, click the email address for the service account that you created.
  2. Click Keys.
  3. Click Add key, then Create new key.
  4. Click Create. A JSON key file is downloaded to your computer.
  5. Click Close.

gcloud

You can run the following commands by using the Google Cloud CLI on your local machine, or within Cloud Shell.

  1. Set the default account for gcloud. If you have more than one account, make sure to choose the account that is in the Google Cloud project that you want to use.

    gcloud auth login

  2. Display the project IDs for your Google Cloud projects.

    gcloud