Set A Bearer Token when using @google-cloud nodejs library

Question

So I have an electron app that performs:

const { v2 } = require('@google-cloud/speech');
...

client= new v2.SpeechClient({
  apiEndpoint: `us-central1-speech.googleapis.com`,
  keyFilename: keyFilename,
  projectId: PROJECT_ID,
});

...

client._streamingRecognize()
...

now this works perfectly fine, however due to multiple reasons (mainly security) and our app is bundled, I am not allowed to provide the json key on the electron app. So what I did is setup an API on our server where I can safely have the json auth key that returns a token from it:

// server api

const auth = new GoogleAuth({
  keyFilename: speech.keyFilename,
  scopes: ['https://www.googleapis.com/auth/cloud-platform'],
});

const client = await auth.getClient();
const accessToken = await client.getAccessToken();

return {
  token: accessToken.token,
};

I am hoping on doing something like:

const authToken = await fetch('my-api/token');

speechClient = new v2.SpeechClient({
  apiEndpoint: `us-central1-speech.googleapis.com`,
  // keyFilename: keyFilename,
  projectId: PROJECT_ID,

  authToken: `Bearer ${token}
});

Of course it does not work, but something where I can add the token with. I cannot use google's REST API directly because the functionality that I want to access (_streamingRecognize) is not available (I cannot find it in ther documentation).

This seems like a weird auth flow, why would users of your app all be using the same service account? And if this is what you want what do you gain by providing them the token instead of the private key, is that token even time-limited?, because if not it's pretty much equivalent since they get all permissions your SA has, with no options for authentication/authorization. You most likely want to use an oauth2 flow for end-users, see here for an explanation: cloud.google.com/nodejs/docs/reference/google-auth-library/… — somethingsomething
– somethingsomething, Commented Oct 25, 2024 at 12:10
@somethingsomething because our app lets the user to use the app first before creating an account. :( so the token that is generated here is only for the specific "function" and not per user — I am L
– I am L, Commented Nov 4, 2024 at 8:35
@PUTHINEEDIRAMOJIRAO unfortunately not because I need to use a service token for this one. — I am L
– I am L, Commented Nov 4, 2024 at 9:00

I am L · Accepted Answer · 2024-11-04 09:12:01Z

1

I was able to fix my issue using OAuth2Client and manually set the token on my electron app like:

const { OAuth2Client } = require('google-auth-library');

...


const oauth2Client = new OAuth2Client();
oauth2Client.setCredentials({ access_token: accessToken });

speechClient = new v2.SpeechClient({
  authClient: oauth2Client, // this is the fix
  apiEndpoint: `us-central1-speech.googleapis.com`,
  projectId: PROJECT_ID,
});

So I had to create an oauth2Client first, manually set the access_token to the accessToken I received from the server and pass that client as authClient

answered Nov 4, 2024 at 9:12

I am L

4,6806 gold badges38 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Gang Chen Over a year ago

This solution works, though it takes an extra hop (latency) to get the token and manage the logic of refreshing the token. potential alternatives: move the STT API handling logic to a GCP managed services (i.e Cloud Run, GKE etc.), then use their application default credentials with attaching Service Account. This will eliminate exchanging the token back-n-forth given your solution already uses a server side API.

Collectives™ on Stack Overflow

Set A Bearer Token when using @google-cloud nodejs library

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related