Using Google ID tokens to authenticate users

This page describes how to support user authentication in API Gateway.

To authenticate a user, a client application must send a JSON Web Token (JWT) in the authorization header of the HTTP request to your backend API. API Gateway validates the token on behalf of your API, so you don't have to add any code in your API to process the authentication. However, you do need to configure the API config for your gateway to support your chosen authentication methods.

API Gateway validates a JWT in a performant way by using the JWT issuer's JSON Web Key Set (JWKS). The location of the JWKS is specified in the gateway's API config. API Gateway caches the JWKS for five minutes and refreshes it every five minutes.

Before you begin

• Add authentication code to your client application that allows users to authenticate by signing in with a Google Account. See Authenticate users with Google Accounts for details.

• When your client application sends an HTTP request, the authorization header in the request must contain the following JWT claims:
  • iss (issuer)
  • sub (subject)