Using a custom method to authenticate users

This page describes how to support user authentication in Cloud Endpoints.

To authenticate a user, a client application must send a JSON Web Token (JWT) in the authorization header of the HTTP request to your backend API. The Extensible Service Proxy (ESP) validates the token on behalf of your API, so you don't have to add any code in your API to process the authentication. However, you do need to configure your OpenAPI document to support your chosen authentication methods.

ESP validates a JWT in a performant way by using the JWT's issuer's public keys. ESP caches the public keys for five minutes. In addition, ESP caches validated JWTs for five minutes or until JWT expiry, whichever happens first.

Before you begin

  • Add authentication code to your client application, following the authentication provider's documentation.

  • When your client application sends an HTTP request, the authorization header in the request must contain the following JWT claims:
    • iss (issuer)
    • sub (subject)
    • aud (audience)
    • iat (issued at)
    • exp (expiration time)

Configuring ESP to support client authentication

You must have a security requirement object and a security definitions object in your OpenAPI document for ESP to validate the claims in the signed JWT.

To support custom authentication:

OpenAPI 2.0

  1. Add the following to the security definition in your OpenAPI document: