ユーザーを認証するには、クライアント アプリケーションが HTTP リクエストの承認ヘッダー内の JSON Web Token（JWT）をバックエンド API に送信する必要があります。API Gateway は API に代わってトークンを検証するので、ユーザーが自分で API にコードを追加して認証を処理する必要はありません。ただし、選択した認証方法をサポートするようにゲートウェイの API 構成を行う必要があります。
追加のクライアント ID によるバックエンド サービスへのアクセスを許可するには、カンマ区切り値を使用して x-google-audiences フィールドに許可されたクライアント ID を指定します。これにより、API Gateway は、aud クレーム内で、指定されたクライアント ID のいずれかを持つ JWT を受け入れます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-03 UTC。"],[[["\u003cp\u003eAPI Gateway validates JSON Web Tokens (JWTs) in the authorization header of HTTP requests, eliminating the need for authentication code in your API.\u003c/p\u003e\n"],["\u003cp\u003eTo support client authentication, you must configure your API config with security definitions that include the JWT issuer and JSON Web Key Set (JWKS) location.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ex-google-audiences\u003c/code\u003e field in the API config can be used to specify allowed client IDs, otherwise, the gateway will accept any token that contains the service name in the \u003ccode\u003eaud\u003c/code\u003e claim.\u003c/p\u003e\n"],["\u003cp\u003eClient applications can send JWTs in the \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header or as an \u003ccode\u003eaccess_token\u003c/code\u003e query parameter.\u003c/p\u003e\n"],["\u003cp\u003eAPI Gateway forwards the authentication results to the backend API in the \u003ccode\u003eX-Apigateway-Api-Userinfo\u003c/code\u003e header, which contains the \u003ccode\u003ebase64url\u003c/code\u003e encoded JWT payload.\u003c/p\u003e\n"]]],[],null,["# Using Okta to authenticate users\n================================\n\nThis page describes how to support user authentication in API Gateway.\n\nTo authenticate a user, a client application must send a\n[JSON Web Token (JWT)](https://jwt.io/) in the authorization header of the\nHTTP request to your backend API. API Gateway\nvalidates the token on behalf of your API, so you don't have to add any code in\nyour API to process the authentication. However, you do need to configure the\nAPI config for your gateway to support your chosen authentication methods.\n\nAPI Gateway validates a JWT in a performant way by using the JWT\nissuer's [JSON Web Key Set (JWKS)](https://tools.ietf.org/html/rfc7517). The location of the JWKS is specified in the `x-google-jwks_uri` field of the gateway's API config. API Gateway caches the JWKS for five\nminutes and refreshes it every five minutes.\n\nBefore you begin\n----------------\n\n- Add authentication code to your client application, following the [Okta integration guide for Google Cloud Endpoints](https://www.okta.com/sites/default/files/OktaIntegrationGuide_GoogleCloudEndpoints_Feb2019.pdf).\n\n\n- When your client application sends an HTTP request, the authorization header in the request must contain the following JWT claims:\n - `iss` (issuer)\n - `sub` (subject)\n - `aud` (audience)\n - `iat` (issued at)\n - `exp` (expiration time)\n\n\u003cbr /\u003e\n\nConfiguring API Gateway to support client authentication\n--------------------------------------------------------\n\n\nYou must have a [security\nrequirement object](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#securityRequirementObject) and a [security\ndefinitions object](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#securityDefinitionsObject) in your API config for API Gateway to\nvalidate the claims in the signed JWT.\n\n\u003cbr /\u003e\n\nAs explained in the *Okta integration guide for Google Cloud Endpoints*,\nyou make the following changes to your OpenAPI document:\n\n1. Add the following to the security definition in your API config, which follows the [OpenAPI 2.0 security scheme](https://swagger.io/specification/v2/#securityDefinitionsObject). Replace \u003cvar translate=\"no\"\u003eYOUR_OKTA_TENANT_NAME\u003c/var\u003e with the\n name of your Okta tenant and \u003cvar translate=\"no\"\u003eYOUR_OKTA_CLIENT_ID\u003c/var\u003e with\n the client ID that you created in your Okta tenant.\n\n ```\n securityDefinitions:\n okta_jwt:\n authorizationUrl: \"\"\n flow: \"implicit\"\n type: \"oauth2\"\n x-google-issuer: \"https://YOUR_OKTA_TENANT_NAME.com\"\n x-google-jwks_uri: \"https://YOUR_OKTA_TENANT_NAME.com/oauth2/v1/keys\"\n x-google-audiences: \"YOUR_OKTA_CLIENT_ID\"\n ```\n2. Add a security section at either the API level to apply to the entire\n API, or at the method level to apply to a specific method.\n\n security:\n - okta_jwt: []\n\n\nYou can define multiple security definitions in the API config, but each\ndefinition must have a different issuer. If you use security sections at both\nthe API level and at the method level, the method-level settings override the\nAPI-level settings.\n\n\u003cbr /\u003e\n\n\nThe `x-google-audiences` field is *not* required. API Gateway\naccepts all JWTs with the backend service name in the form of\n`https://`\u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e in the `aud` claim.\n| **Note** : API Gateway does not accept the following URI types in the `aud` claim:\n|\n| - Internal addresses\n| - IPv4 or IPv6 addresses\n\nTo allow additional client IDs to access the backend service, you can specify the\nallowed client IDs in the `x-google-audiences` field by using\ncomma-separated values. API Gateway then accepts the JWTs with any of the\nspecified client IDs in the `aud` claim.\n\n\u003cbr /\u003e\n\nMaking an authenticated call to an API Gateway API\n--------------------------------------------------\n\nWhen you send a request using an authentication token, we\nrecommend that you put the token in the `Authorization:Bearer` header. For\nexample: \n\n```\ncurl --request POST \\\n --header \"Authorization: Bearer ${TOKEN}\" \\\n \"${GATEWAY_URL}/echo\"\n```\n\nHere, `GATEWAY_URL` and `TOKEN` are environment variables containing your\ndeployed gateway URL and authentication token, respectively. See\n[Making an authenticated request to an API Gateway API](/api-gateway/docs/authenticate-service-account#making_an_authenticated_request) for sample code that sends a request using the `Authorization:Bearer` header.\n\nIf you cannot use the header when sending the request, you can put the\nauthentication token in a query parameter called `access_token`. For example: \n\n curl \"${GATEWAY_URL}/echo?access_token=${TOKEN}\"\n\nReceiving authenticated results in your API\n-------------------------------------------\n\n\nAPI Gateway usually forwards all headers it receives. However, it overrides the\noriginal `Authorization` header when the backend address is specified by\n`x-google-backend` in the API config.\n\n\nAPI Gateway will send the authentication result in the `X-Apigateway-Api-Userinfo`\nto the backend API. It is recommended to use this header instead of the original\n`Authorization` header. This header is `base64url` encoded and contains\nthe JWT payload.\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n- [Authentication between services](/api-gateway/docs/authenticate-service-account)"]]
