The App Identity API lets an application discover its application ID (also called the project ID). Using the ID, an App Engine application can assert its identity to other App Engine Apps, Google APIs, and third-party applications and services. The application ID can also be used to generate a URL or email address, or to make a run-time decision.
Getting the application ID
The application ID can be found using the
Getting the application hostname
By default, App Engine apps are served from URLs in the form
http://<your_app_id>.appspot.com, where the app ID is part of the hostname.
If an app is served from a custom domain, it may be necessary to retrieve the
entire hostname component. You can do this using the
com.google.appengine.runtime.default_version_hostname attribute of the
Asserting identity to other App Engine apps
If you want to determine the identity of the App Engine app that is making a
request to your App Engine app, you can use the request header
X-Appengine-Inbound-Appid. This header is added to the request by the URLFetch
service and is not user modifiable, so it safely indicates the requesting
application's ID, if present.
java.net, it must set the connection as follows:
connection.setInstanceFollowRedirects(false);App Engine will then automatically add the header to the HTTP response.
In your application handler, you can check the incoming ID by reading the
X-Appengine-Inbound-Appid header and comparing it to a list of IDs allowed
to make requests.
Asserting identity to Google APIs
Google APIs use the OAuth 2.0 protocol for authentication and
App Identity API can create OAuth tokens that can be used to assert that the
source of a request is the application itself. The
returns an access token for a scope, or list of scopes. This token can then be
set in the HTTP headers of a call to identify the calling application.
Note that the application's identity is represented by the service account name, which is typically firstname.lastname@example.org. You can get the exact value by using the
For services which offer ACLs, you can grant the application access by granting this account access.
Asserting identity to third-party services
The token generated by
only works against Google services. However you can use the underlying signing technology to assert the identity of your application to other services. The
will sign bytes using a private key unique to your application, and the
will return certificates which can be used to validate the signature.
Getting the default Cloud Storage Bucket name
Each application can have up to one default Cloud Storage bucket, which has free quota and doesn't require billing to be enabled. The maximum storage of this bucket is 5GB, which you can increase by enabling billing for your app and paying for the extra storage making this a paid bucket.
To get the name of the default bucket, you can use the App Identity API. Call AppIdentityService.getDefaultGcsBucketName.