# Invoke Google Cloud Function with service account **URL:** \ **Category:** Plugins\ **Created:** [June 8, 2022, 2:08pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313 "2022-06-08T14:08:35Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![dylan3](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@dylan3](https://forum.bubble.io/u/dylan3)\ **Post date:** [June 8, 2022, 2:08pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/1 "2022-06-08T14:08:35Z")
Hello, I am trying to find a way to invoke a Google Cloud Function that doesn’t allow unauthenticated calls from Bubble. I don’t want to use Allow unauthenticated for security reasons. **Has anyone managed to do it and could explain how he achieved it?** I tried using the following plugin : > **[Google Service Account Plugin for Bubble, by Nicholas Barrow](https://bubble.io/plugin/google-service-account-1605833704975x195806677045870600)** > > Google Service Account Plugin page on Bubble, by Nicholas Barrow. Add Google Service Account in one click to your app. Bubble lets you build web apps without any code. When I make an HTTP request to my cloud function using the generated access token, I get the following response : Your client does not have permission to the requested URL. I guess I am not using this plugin correctly. @nicholasrbarrow is this plugin supposed to work with Google Cloud Function? Thanks a lot 🙂 ---
**Author:** ![aniv](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/aniv/32/133757_2.png) [@aniv](https://forum.bubble.io/u/aniv)\ **Post date:** [June 8, 2022, 2:26pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/2 "2022-06-08T14:26:17Z")
Hey dylan3, I remember struggling with this. I ended up using an API key instead of the service account. The problem is that you cannot use API keys out of the box with cloud functions. I ended up having the key checked by the function. However, you can have a more sophisticated approach with API Gateway / Cloud Endpoints if you have a more complex API (e.g. [api key - Accessing Google Cloud Function via API Key - Stack Overflow](https://stackoverflow.com/questions/65541144/accessing-google-cloud-function-via-api-key)). Haven’t tried the plugin and also would like to hear if someone got it to work with service accounts. * * * **Andrej** @ [anivdev.com](https://www.anivdev.com/) Have a project in mind? Feel free to reach out, no strings attached. ---
**Author:** ![dylan3](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@dylan3](https://forum.bubble.io/u/dylan3)\ **Post date:** [June 8, 2022, 2:34pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/3 "2022-06-08T14:34:33Z")
Check the key in the function is what I am currently doing but it doesn’t prevent someone from triggering my cloud function if he finds the url. I will definitely try API Gateway / Cloud Endpoints. Thank you for your answer ! ---
**Author:** ![aniv](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/aniv/32/133757_2.png) [@aniv](https://forum.bubble.io/u/aniv)\ **Post date:** [June 8, 2022, 2:54pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/4 "2022-06-08T14:54:53Z")
Hey, you’re welcome. Yes, of course, it will trigger, but nothing will happen. Unless you’re concerned about the cost, but that is minimal… Even gateways in simple terms, work by placing another function that is called before your function that checks the API key. However, if you need really a secure robust/enterprise implementation, I’d definitely go for gateway/endpoints. * * * **Andrej** @ [anivdev.com](https://www.anivdev.com/) Have a project in mind? Feel free to reach out, no strings attached. ---
**Author:** ![nicholasrbarrow](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/nicholasrbarrow/32/157879_2.png) [@nicholasrbarrow](https://forum.bubble.io/u/nicholasrbarrow)\ **Post date:** [June 8, 2022, 3:10pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/5 "2022-06-08T15:10:19Z")
Hi @dylan3 : As far as I know, this method (the service account plugin) should work with any google cloud APIs (a quick google search of their documentation seems to confirm this: [Authenticating as a service account  |  Authentication  |  Google Cloud](https://cloud.google.com/docs/authentication/production)). However, I myself have never used it to authenticate to Google Cloud APIs. A quick way to confirm that your Bubble setup is correct is to access an easier API, such as Google Directory or Google Drive. You can try to read data from there. If you can successfully get the Service Account running with an easy API, you can at least confirm your setup is good, and then work towards Google Cloud functions. The documentation is here: [Google Service Account Plugin - Bubble Plugins](https://thenicholasrbarrowcompany.gitbook.io/bubble-plugins/google-service-account/google-service-account-plugin) Feel free to send me a screenshot of your workflow to generate the bearer token as well. **One caveat: Google Service Accounts, as far as I know, only work on a paid Google Workspace; this has been an area of confusion in the past.** ---
**Author:** ![dylan3](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@dylan3](https://forum.bubble.io/u/dylan3)\ **Post date:** [June 8, 2022, 3:39pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/6 "2022-06-08T15:39:02Z")
Thank you for your answer. I did what you suggested and I can confirm that it works fine with other Google APIs. I guess Cloud Functions are just not meant to work with access tokens ---
**Author:** ![nicholasrbarrow](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/nicholasrbarrow/32/157879_2.png) [@nicholasrbarrow](https://forum.bubble.io/u/nicholasrbarrow)\ **Post date:** [June 8, 2022, 4:18pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/7 "2022-06-08T16:18:58Z")
It looks like Google Cloud functions use Identity Tokens, not Bearer/Authorization Tokens (which is what the service account provides): [OAuth2 authentication for a Cloud function - Stack Overflow](https://stackoverflow.com/questions/67210317/oauth2-authentication-for-a-cloud-function/67213000#67213000). However, the stack reply does list a method for turning a service account file into an identity token… maybe this could help? ---
**Author:** ![dylan3](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@dylan3](https://forum.bubble.io/u/dylan3)\ **Post date:** [June 9, 2022, 7:52am UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/8 "2022-06-09T07:52:56Z")
You are right. The method provided in Stack Overflow works in a Python environment but I don’t know how to replicate this inside Bubble. Thanks again for your help 🙂 ---
**Author:** ![dylan3](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@dylan3](https://forum.bubble.io/u/dylan3)\ **Post date:** [June 9, 2022, 10:20am UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/9 "2022-06-09T10:20:48Z")
I found a way to get an Identity token. You need to follow these steps : 1/ Generate an access token using the [Google Service Account Plugin](https://bubble.io/plugin/google-service-account-1605833704975x195806677045870600). - **Scope** : [https://www.googleapis.com/auth/cloud-platform](https://www.googleapis.com/auth/cloud-platform) - **Email to Impersonate** : Email of an account that has iam.serviceAccounts.getAccessToken permission (Service Account Token Creator) 2/ Use the access token to generate an id token - **POST** : [https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/](https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/)[SERVICE ACCOUNT NAME]%40[PROJECT ID].iam.gserviceaccount.com:generateIdToken - **Headers** : Authorization Bearer [ACCESS TOKEN] - **Body** : > { > “audience”: “\”, > “includeEmail”: “true” > } 3/ Use id token to call you function - **Headers** : Authorization Bearer [ID TOKEN] It works but you need to make 3 requests before you call your Cloud Function (Create assertion / Request Bearer Token / Request Id Token) → This is super slow ☹ It also forces you to specify your cloud function url in the Plugins \> API Connector and in the WF calling your Cloud Function. Here is an example : ![image](https://us1.discourse-cdn.com/bubble/original/3X/b/1/b1107932c018cf79a7fb1ac55b047a2baafac319.jpeg) ---
**Author:** ![jared.gibb](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/jared.gibb/32/123329_2.png) [@jared.gibb](https://forum.bubble.io/u/jared.gibb)\ **Post date:** [June 9, 2022, 10:28am UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/10 "2022-06-09T10:28:30Z")
Yes they are intended to be secure when you want. You need to set permissions as to who can/can’t invoke the function ---
**Author:** ![nicholasrbarrow](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/nicholasrbarrow/32/157879_2.png) [@nicholasrbarrow](https://forum.bubble.io/u/nicholasrbarrow)\ **Post date:** [June 25, 2022, 8:00pm UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/11 "2022-06-25T20:00:05Z")
I might be able to incorporate this into the plugin as an additional workflow step… is that something that would be of use to you? ---
**Author:** ![dylan3](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@dylan3](https://forum.bubble.io/u/dylan3)\ **Post date:** [June 27, 2022, 7:29am UTC](https://forum.bubble.io/t/invoke-google-cloud-function-with-service-account/210313/12 "2022-06-27T07:29:52Z")
Yes I would definitely try it !