Cloud Endpoints Frameworks 支援多種適合不同應用程式和用途的驗證方式。Endpoints Frameworks 採用您在註解中指定的驗證方式驗證傳入要求，然後再將要求傳送至 API 後端。本文件將針對每種支援的驗證方式提供概覽及用途範例。
API 金鑰
API 金鑰是一種簡易加密字串，用於識別Google Cloud 專案的配額、帳單及監控等功能。開發人員會在 Google Cloud 主控台的專案中產生 API 金鑰，然後將該金鑰以查詢參數的形式，嵌入在對 API 發出的每一個呼叫中。
如果您在註解指定 API 金鑰需求，Endpoints Frameworks 會使用 API 金鑰查詢與該 API 金鑰有關的Google Cloud 專案。除非 API 金鑰是在 Google Cloud 專案或已啟用您 API 的其他Google Cloud 專案中產生，否則 Endpoints Frameworks 會拒絕要求。詳情請參閱「透過 API 金鑰限制 API 存取權」
有別於使用短期憑證或簽署要求，且於要求標頭之中傳送的憑證，用戶端會將 API 金鑰以查詢參數傳送。即使查詢參數已透過 HTTPS 加密，API 金鑰並不安全。例如部分伺服器可能將每項要求的完整網址，以純文字儲存於伺服器記錄檔。基於安全考量，當 API 呼叫包含使用者資料時，請勿單獨使用 API 金鑰。除了以下任一驗證方法，您還可搭配使用 API 金鑰。
如需維護 API 金鑰安全及新增限制的最佳做法，請參閱「使用 API 金鑰」一文。雖然「使用 API 金鑰」的目標為使用 Google API 的用戶端，但文章中提供的最佳做法也適用於您以 Endpoints Frameworks 建立的 API。
用途
如果您想要使用如配額之類的 Endpoints 功能，則必須使用 API 金鑰傳送每個要求，Endpoints 才可以識別與用戶端應用程式相關聯的 Google Cloud專案。
使用 Google ID 憑證進行驗證可讓使用者利用以 Google 帳戶登入的方式驗證。驗證完畢後，使用者即可存取所有 Google 服務。您可使用 Google ID 憑證呼叫 Google API，以及您使用 Endpoints Frameworks 實作的 API。Endpoints Frameworks 使用公開金鑰驗證 Google ID 憑證，並確保 JWT 中的「iss」憑證附加資訊為 https://accounts.google.com 或 accounts.google.com。
用途
若所有使用者都有 Google 帳戶，建議使用 Google ID 憑證進行驗證。如果您的 API 範圍包含 Google Workspace 應用程式 (例如 Google 雲端硬碟隨附應用程式)，您可以選擇使用 Google ID 憑證驗證方式。Google ID 憑證驗證方式可讓使用者以登入 Google 帳戶方式進行驗證。驗證完畢後，使用者即可存取所有 Google 服務。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eEndpoints Frameworks utilizes specified authentication methods to validate incoming requests before they reach the API backend.\u003c/p\u003e\n"],["\u003cp\u003eAPI keys are simple encrypted strings that identify a Google Cloud project for tracking quota, billing, and monitoring, but should not be used alone when user data is involved due to security concerns.\u003c/p\u003e\n"],["\u003cp\u003eFirebase authentication is ideal for mobile and web apps that already use Firebase services, leveraging JSON Web Tokens (JWTs) for user authentication.\u003c/p\u003e\n"],["\u003cp\u003eAuth0 provides comprehensive authentication and authorization services for web and mobile applications, supporting numerous providers and generating JWTs upon user sign-in.\u003c/p\u003e\n"],["\u003cp\u003eGoogle ID token authentication is recommended when all users possess Google accounts, allowing access to both Google APIs and APIs built with Endpoints Frameworks.\u003c/p\u003e\n"]]],[],null,["# Choosing an authentication method\n\nCloud Endpoints Frameworks supports multiple authentication methods that are\nsuited to different applications and use cases. Endpoints Frameworks\nuses the authentication method that you have specified in your annotation\nto validate incoming requests before passing them to your API backend. This\ndocument provides an overview and sample use cases for each supported\nauthentication method.\n\nAPI keys\n--------\n\nAn API key is a simple encrypted string that identifies a\nGoogle Cloud project for quota, billing, and monitoring purposes.\nA developer generates an API key in a project in the Google Cloud console and embeds\nthat key in every call to your API as a query parameter.\n\nIf you specify an API key requirement in your annotation,\nEndpoints Frameworks uses the API key to look up the\nGoogle Cloud project that the API key is\nassociated with. Endpoints Frameworks rejects requests unless the API\nkey was generated in your Google Cloud project or within other\nGoogle Cloud projects in which your API has been enabled. For more\ninformation, see\n[Restricting API access with API keys](/endpoints/docs/frameworks/java/restricting-api-access-with-api-keys-frameworks)\n\nUnlike credentials that use short-lived tokens or signed requests and are sent\nin the request header, clients send an API key as a query parameter. Even though\nquery parameters get encrypted in HTTPS, API keys aren't secure. For example,\nsome servers might store the entire URL of each request in clear text in a\nserver log. For security reasons, don't use API keys by themselves when API\ncalls contain user data. You can use API keys in addition to one of the\nfollowing authentication methods.\n\nFor best practices on securing and adding restrictions to API keys, see\n[Using API keys](/docs/authentication/api-keys#securing_an_api_key). Although\n\"Using API keys\" is targeted for clients using Google APIs, the best practices\nare applicable to APIs that you create using Endpoints Frameworks.\n\n### Use case\n\nIf you want to use Endpoints features such as\n[quotas](/endpoints/docs/frameworks/quotas-overview), each request must pass in an\nAPI key so that Endpoints can identify the Google Cloud\nproject that the client application is associated with.\n\nFor more information about API keys, see [Why and when to use API\nkeys](/endpoints/docs/frameworks/java/when-why-api-key).\n\nFirebase authentication\n-----------------------\n\n[Firebase authentication](https://firebase.google.com/docs/auth/) provides\nbackend services, SDKs, and libraries to authenticate users to a mobile or\nweb app. It authenticates users using a variety of credentials such as Google,\nFacebook, Twitter, or GitHub.\n\nThe Firebase client library signs a [JSON Web Token (JWT)](https://jwt.io/) with\na private key after the user has successfully signed in.\nEndpoints Frameworks validates that the JWT was signed by Firebase and\nthat the \"iss\" (issuer) claim\nin the JWT, which identifies your Firebase application, matches the `issuer`\nsetting in the annotation.\n\n### Use case\n\nBecause Firebase authentication integrates tightly with other Firebase services,\nit is well-suited for mobile or web apps that use Firebase. See [Authenticating\nwith Firebase\nAuth](/endpoints/docs/frameworks/java/authenticating-users#authenticating_with_firebase_auth).\n\nAuth0\n-----\n\n[Auth0](https://auth0.com/) authenticates and authorizes apps and APIs\nregardless of identity provider, platform, stack, and device.\n\nAuth0 supports a large number of providers and the [Security Assertion Markup\nLanguage](https://wiki.oasis-open.org/security/FrontPage) specification. It\nprovides backend services, SDKs, and user interface libraries for authenticating\nusers in web and mobile apps. Auth0 integrates with several third-party identity\nproviders and also provides custom user account management.\n\nThe client library provided by Auth0 generates and signs a JWT once the user has\nsigned in. Endpoints Frameworks validates the JWT was signed by Auth0\nand that the \"iss\" claim in the JWT, which identifies your Auth0 application,\nmatches the `issuer` setting in the annotation.\n\n### Use case\n\nAuth0 is well-suited for consumer and enterprise web and mobile apps. For more\ninformation, see\n[Authenticating with Auth0](/endpoints/docs/frameworks/java/authenticating-users#authenticating_with_auth0).\n\nGoogle ID token authentication\n------------------------------\n\nAuthentication using a [Google ID\ntoken](/endpoints/docs/frameworks/glossary#google_id_token) lets users\nauthenticate by signing in with a Google Account. Once authenticated, the user\nhas access to all Google services. You can use Google ID tokens to make calls to\nGoogle APIs and APIs that you have implemented using\nEndpoints Frameworks. Endpoints Frameworks validates the\nGoogle ID token using the public key and\nensures that the \"iss\" claim in the JWT is `https://accounts.google.com` or\n`accounts.google.com`.\n\n### Use case\n\nAuthentication using a Google ID token is recommended when all users have Google\naccounts. You might choose to use Google ID token authentication, for example,\nif your API accompanies Google Workspace Applications (for example, a Google\nDrive companion). Google ID token authentication lets users authenticate by\nsigning in with a Google Account. Once authenticated, the user has access to all\nGoogle services.\n\nFor more information, see [Authenticating with Google ID\ntokens](/endpoints/docs/frameworks/java/authenticating-users#google-id-tokens).\n\nJWTs and service accounts\n-------------------------\n\nA [JSON Web Token](https://jwt.io/) (JWT) is commonly used to share claims or\nassertions between connected applications. A JWT representing a service account\ncan be signed either by:\n\n- The service account.\n\n- Google's authorization service. (A JWT signed by Google's authorization service\n is referred to as a Google ID token.)\n\nAuthenticating a request using a JWT signed by a service account might be easier\nto implement, but if you have a large number of service accounts, or if you want\nto accept credentials from service accounts you don't own, using a Google ID\ntoken is recommended because you only need to allow\n`https://accounts.google.com` or `accounts.google.com` as an issuer for all\nservice accounts.\n\n### Use case\n\nJWTs and service accounts are well-suited for microservices. For more\ninformation, see [Authenticating with a service\naccount](/endpoints/docs/frameworks/java/service-account-authentication)."]]
