GCP REST API authentication missing

Few days back I was trying to integrate GCP into a SaaS application but struggling to figure out how to invoke a microservice ( which is acting as a proxy to GCP) with credentials for different projects which will be passed to this microservice on the fly. I was surprised that in spite of spending good amount of time I could not figure out how to achieve it because GCP documentation is focused on working with one project credentials at a time using application default credentials. Another frustrating thing is that API explorer shows both OAuth 2.0 and API Key by default for all the APIs when the fact is that API Key is hardly supported for any API. Finally I found the solution for this problem here.

Here are the steps to invoke a GCP rest api -

• Create a service account for your project and download the json file associated with it.
• Note down values of client_email, private_key_id and private_key attribues from service account json file.
• Define following environment variables using above values -

GCP_SERVICE_ACCOUNT_CLIENT_EMAIL=<client_email>
GCP_SERVICE_ACCOUNT_PRIVATE_KEY_ID=<private_key_id>
GCP_SERVICE_ACCOUNT_PRIVATE_KEY=<private_key>

• Execute following python code to generate jwt_token -

    import time, jwt, os
    
    iat = time.time()
    exp = iat + 3600
    
    client_email = os.getenv('GCP_SERVICE_ACCOUNT_CLIENT_EMAIL')
    private_key_id = os.getenv('GCP_SERVICE_ACCOUNT_PRIVATE_KEY_ID')
    private_key = os.getenv('GCP_SERVICE_ACCOUNT_PRIVATE_KEY')
    
    payload = {
        'iss': client_email,
        'sub': client_email,
        'aud': 'https://compute.googleapis.com/',
        'iat': iat,
        'exp': exp
    }
    
    private_key1 = private_key.replace('\\n', '\n')
    # print(private_key1)
    
    additional_headers = {'kid': private_key_id}
    
    signed_jwt = jwt.encode(
                    payload, 
                    private_key1,
                    headers=additional_headers,
                    algorithm='RS256'
                )
    
    print(signed_jwt)

• Use generated jwt token from previous step and use it as a bearer token to invoke any GCP rest api. E.g.

curl -X GET --header 'Authorization: Bearer <jwt_token>' 'https://compute.googleapis.com/compute/v1/projects/{project}/global/networks'

The best practice to authenticate a request is to use your application credentials. Just make sure you installed the google cloud SDK.

curl -X POST \
-H "Authorization: Bearer "$(gcloud auth application-default print-access-token) \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
https://dataflow.googleapis.com/v1b3/projects/PROJECT_ID/templates:launch?gcsPath=gs://dataflow-templates/latest/Jdbc_to_BigQuery