I want to use my Google Functions through API Gateway with the same behaviour, just with a clean API.

Since the beggining I’m calling functions with this method :

curl "https://URL-OF-FUNCTION/items" -H "Authorization: Bearer $(gcloud auth print-identity-token)"

And it’s working. Without the token I can’t use public URL. This is the behaviour I want to keep !

But whith Gateway API I can’t manage to use the same Bearer Token.

With this type of configuration (Terraform) :

swagger: "2.0"
info:
  title: ${google_api_gateway_api.api.api_id}
  description: xxxxxxxxxxxxx
  Version: 0.0.1
securityDefinitions:
  jwt:
    type: "oauth2"
    authorizationUrl: ""
    flow: "implicit"
    x-google-issuer: "https://accounts.google.com"
    x-google-jwks_uri: "https://www.googleapis.com/oauth2/v3/certs"
schemes:
  - https
paths:
  "/items":
    get:
      x-google-backend:
        address: https://URL-OF-FUNCTION/items
      security:
        - jwt: []
      description: xxx
      operationId: "items"
      parameters: xxx
      responses: xxx

It’s not working, I’ve try some things find all over the web:

x-google-issuer: "https://accounts.google.com"
x-google-jwks_uri: "https://www.googleapis.com/oauth2/v3/certs"

--> {"message":"Audiences in Jwt are not allowed","code":403}

Or :

x-google-issuer: "${var.service_account_email}"
x-google-jwks_uri: "https://www.googleapis.com/robot/v1/metadata/x509/${var.service_account_email}"

--> {"message":"Jwt issuer is not configured","code":401}

To be perfectly fair, I’m not so sure about what is the next direction to looking for.

Please help.