Google Cloud Platform

App Identity Java API Overview

Python |Java |PHP |Go
The App Identity API lets an application discover its application ID (also called the project ID). Using the ID, an App Engine application can assert its identity to other App Engine Apps, Google APIs, and third-party applications and services. The application ID can also be used to generate a URL or email address, or to make a run-time decision.


Getting the application ID

The application ID can be found using the ApiProxy.Environment.getAppId() method.

Getting the application hostname

By default, App Engine apps are served from URLs in the form http://<your_app_id>, where the app ID is part of the hostname. If an app is served from a custom domain, it may be necessary to retrieve the entire hostname component. You can do this using the attribute of the CurrentEnvironment.

public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  Environment env = ApiProxy.getCurrentEnvironment();
  resp.getWriter().println("default_version_hostname: "
      + env.getAttributes().get(""));

Asserting identity to other App Engine apps

If you want to determine the identity of the App Engine app that is making a request to your App Engine app, you can use the request header X-Appengine-Inbound-Appid. This header is added to the request by the URLFetch service and is not user modifiable, so it safely indicates the requesting application's ID, if present.

In order for this header to be added to the request, the app making the request must tell the UrlFetch service to not follow redirects when it invokes URLFetch. That is, your app must specify doNotFollowRedirect if it uses the URLFetchService class. If your app uses, it must set the connection as follows: connection.setInstanceFollowRedirects(false); App Engine will then automatically add the header to the HTTP response.

In your application handler, you can check the incoming ID by reading the X-Appengine-Inbound-Appid header and comparing it to a list of IDs allowed to make requests.

Asserting identity to Google APIs

Google APIs use the OAuth 2.0 protocol for authentication and authorization. The App Identity API can create OAuth tokens that can be used to assert that the source of a request is the application itself. The getAccessToken() method returns an access token for a scope, or list of scopes. This token can then be set in the HTTP headers of a call to identify the calling application.

The following example shows a REST call to the Google URL Shortener API. Note that the Google API Client Libraries can also manage much of this for you automatically.

import java.util.ArrayList;
// Note that any JSON parser can be used; this one is used for illustrative purposes.
import org.json.JSONObject;
import org.json.JSONTokener;

public String createShortUrl(String longUrl) throws Exception {
    try {
        ArrayList<String> scopes = new ArrayList<String>();
        AppIdentityService appIdentity = AppIdentityServiceFactory.getAppIdentityService();
        AppIdentityService.GetAccessTokenResult accessToken = appIdentity.getAccessToken(scopes);
        // The token asserts the identity reported by appIdentity.getServiceAccountName()
        JSONObject request = new JSONObject();
        request.put("longUrl", longUrl);

        URL url = new URL("");
        HttpURLConnection connection = (HttpURLConnection) url.openConnection();
        connection.addRequestProperty("Content-Type", "application/json");
        connection.addRequestProperty("Authorization", "Bearer  " + accessToken.getAccessToken());

        OutputStreamWriter writer = new OutputStreamWriter(connection.getOutputStream());

        if (connection.getResponseCode() == HttpURLConnection.HTTP_OK) {
            // Note: Should check the content-encoding.
            JSONTokener response_tokens = new JSONTokener(connection.getInputStream());
            JSONObject response = new JSONObject(response_tokens);
            return (String) response.get("id");
        } else {
            throw new Exception();
    } catch (Exception e) {
        // Error handling elided.
        throw e;

Note that the application's identity is represented by the service account name, which is typically You can get the exact value by using the getServiceAccountName() method. For services which offer ACLs, you can grant the application access by granting this account access.

Asserting identity to third-party services

The token generated by getAccessToken() only works against Google services. However you can use the underlying signing technology to assert the identity of your application to other services. The signForApp() method will sign bytes using a private key unique to your application, and the getPublicCertificatesForApp() method will return certificates which can be used to validate the signature.

Here is an example showing how to sign a blob and validate its signature:
//  Note that the algorithm used by AppIdentity.signForApp() and
//  getPublicCertificatesForApp() is "SHA256withRSA"

// Sign blob.
byte[] blob = "abcdefg".getBytes();
AppIdentityService.SigningResult result = appIdentity.signForApp(blob);
byte[] signedBlob = result.getSignature();

// Get public certificate and share it with the receiving app.
Collection<PublicCertificate> certs = appIdentity.getPublicCertificatesForApp();
PublicCertificate publicCert = certs.iterator().next();

// Receiving app gets the certificate, blob, and signature.
InputStream stream = new ByteArrayInputStream(publicCert.getX509CertificateInPemFormat().getBytes("UTF-8"));
CertificateFactory cf = CertificateFactory.getInstance("X.509");
cert = cf.generateCertificate(stream);
PublicKey pk = cert.getPublicKey();

// Then verify the signature against the blob.
Signature signature = Signature.getInstance("SHA256withRSA");
boolean isValid = signature.verify(result.getSignature());