Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, você aprenderá a adicionar suporte à API para autenticação de usuários a partir de aplicativos cliente usando o Cloud Endpoints Frameworks. Atualmente, só há suporte para clientes Android e JavaScript.
O Endpoints Frameworks oferece suporte à autenticação de usuários de aplicativos clientes que usam qualquer uma das seguintes metodologias:
Não importa o método de autenticação usado, para verificar a autenticação adequada para cada método de API, é preciso checar se há User, conforme descrito nas seções a seguir:
Se você usa o JWT no cliente para enviar solicitações autenticadas à API, ele precisa estar no cabeçalho de autorização de uma solicitação HTTP e ter as seguintes reivindicações obrigatórias:
iss
sub
aud
iat
exp
Autenticar com o Firebase Auth
Para oferecer suporte a chamadas de clientes que usam Firebase Auth:
Importe a API do App Engine Cloud Endpoints na classe de API:
importendpoints
Adicione um objeto emissor do Firebase referente a cada cliente ao decorador de API.
Exemplo:
Substitua VERSION_NUMBER por sua versão da API, por exemplo, v1.
Substitua o código>YOUR_PROJECT_ID pelo ID do projeto Google Clouddo cliente.
Em cada método de API em que você quer verificar a autenticação adequada, verifique se há um User válido e aumente error 401 se não houver, como mostra esse exemplo de definição de método:
user=endpoints.get_current_user()# If there's no user defined, the request was unauthenticated, so we# raise 401 Unauthorized.
É possível adicionar o Firebase Authentication ao código, conforme descrito na documentação do Firebase. O cliente precisa ter um projeto do Google Cloud associado a ele, e o ID do projeto precisa estar listado na configuração do emissor do Firebase da API.
Como autenticar com Auth0
Para oferecer suporte a chamadas de clientes que usam Auth0:
Importe a API do App Engine Endpoints na classe de API:
importendpoints
Adicione um objeto emissor Auth0 ao decorador de API de cada cliente.
Exemplo:
Substitua VERSION_NUMBER por sua versão da API, por exemplo, v1.
Substitua YOUR_ACCOUNT_NAME pelo nome da conta Auth0 usado para o cliente.
Em cada método de API em que você quer verificar a autenticação adequada, verifique se há um User válido e aumente error 401 se não houver, como mostra esse exemplo de definição de método:
user=endpoints.get_current_user()# If there's no user defined, the request was unauthenticated, so we# raise 401 Unauthorized.
Implante a API e reimplante-a sempre que adicionar novos clientes.
Adicionar a autenticação Auth0 a um cliente
Adicione a autenticação do Auth0 ao código, conforme descrito na documentação do Auth0. O cliente precisa estar listado na configuração do emissor Auth0 da API.
Como autenticar com tokens de ID do Google
Para oferecer suporte a chamadas de clientes que fazem a autenticação usando tokens de ID do Google:
Receba um ID do cliente OAuth 2 para cada aplicativo cliente. O proprietário do aplicativo cliente precisa gerar o ID do cliente no console Google Cloud . Para
instruções, consulte
Como criar IDs do cliente.
Importe a API do App Engine Endpoints na classe de API:
importendpoints
Especifique todos os IDs de clientes para os quais você quer conceder acesso à API no allowed_client_ids. Especifique também os IDs dos clientes Android no campo audiences no decorador da API.
Exemplo:
@endpoints.api(
name='YOUR_API_NAME',
version='VERSION_NUMBER',
allowed_client_ids=ALLOWED_CLIENT_IDS,
audiences=[ANDROID_AUDIENCE])
class AuthedGreetingApi(remote.Service):
# ...
Substitua ALLOWED_CLIENT_IDS pela lista de IDs de clientes OAuth 2 gerados a partir do projeto de cada cliente e substitua ANDROID_AUDIENCE pela lista de IDs de clientes da Web do Android. O ID do cliente da Web é o ID do cliente com .apps.googleusercontent.com anexado, por exemplo: YOUR_CLIENT_ID.apps.googleusercontent.com.
Em cada método de API em que você quer verificar a autenticação adequada, verifique se há um User válido e aumente error 401 se não houver, como mostra esse exemplo de definição de método:
user=endpoints.get_current_user()# If there's no user defined, the request was unauthenticated, so we# raise 401 Unauthorized.
Para informações gerais sobre a autenticação de usuário e as diferenças entre esse método e a autorização de chave de API, consulte Quando e por que usar chaves de API.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[[["\u003cp\u003eThis guide outlines how to implement user authentication in your API using Cloud Endpoints Frameworks, currently supporting Android and JavaScript clients.\u003c/p\u003e\n"],["\u003cp\u003eEndpoints Frameworks enables user authentication from client applications via Firebase Auth, Auth0, or Google ID tokens.\u003c/p\u003e\n"],["\u003cp\u003eTo ensure proper authentication, you must check for a valid \u003ccode\u003eUser\u003c/code\u003e within each API method, regardless of the chosen authentication method.\u003c/p\u003e\n"],["\u003cp\u003eImplementing authentication involves importing the App Engine Endpoints API, configuring issuer objects in the API decorator, and deploying the updated API.\u003c/p\u003e\n"],["\u003cp\u003eIf you use JWT in your client to send authenticated requests to the API, the JWT must be in the authorization header of a HTTP request and contain the claims \u003ccode\u003eiss\u003c/code\u003e, \u003ccode\u003esub\u003c/code\u003e, \u003ccode\u003eaud\u003c/code\u003e, \u003ccode\u003eiat\u003c/code\u003e, and \u003ccode\u003eexp\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Authenticating users\n\nThis page describes how to add support in your API for user authentication from\nclient applications by using Cloud Endpoints Frameworks. Note that\nAndroid and JavaScript clients are currently supported.\n\nEndpoints Frameworks supports user authentication from client\napplications that use any of the following methodologies:\n\n- [Firebase Auth](https://firebase.google.com/docs/auth/)\n- [Auth0](http://auth0.com)\n- [Google ID tokens](/endpoints/docs/frameworks/glossary#google_id_token)\n\nNo matter which authentication method you use, in each API method where you want\nto check for proper authentication, you must check for a valid `User` as\ndescribed in the following sections:\n\n- [Authenticating with Firebase Auth](#authenticating_with_firebase_auth)\n- [Authenticating with Auth0](#authenticating_with_auth0)\n- [Authenticating with Google ID tokens](#google-id-tokens)\n\nPrerequisites\n-------------\n\nThis page assumes that you have already:\n\n- Created a\n [Google Cloud project](/resource-manager/docs/creating-managing-projects).\n\n- [Added API management](/endpoints/docs/frameworks/java/adding-api-management).\n\n \u003cbr /\u003e\n\n- If you use JWT in your client to send authenticated requests to the API, the JWT must be in the authorization header of a HTTP request. The JWT should have the following required claims:\u003cbr /\u003e\n\n - `iss`\n - `sub`\n - `aud`\n - `iat`\n - `exp`\n\n \u003cbr /\u003e\n\nAuthenticating with Firebase Auth\n---------------------------------\n\nTo support calls from clients that use Firebase Auth:\n\n1. Import the App Engine Cloud Endpoints API in your API class:\n\n import endpoints\n\n2. Add a Firebase issuer object for each client to the\n [API decorator](/endpoints/docs/frameworks/python/decorators-reference#defining_the_api_endpointsapi).\n For example:\n\n ```\n @endpoints.api(\n name='YOUR_API_NAME',\n version='VERSION_NUMBER',\n issuers={'firebase': endpoints.Issuer(\n 'https://securetoken.google.com/YOUR_PROJECT_ID,\n 'https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com')})\n ```\n - Replace \u003cvar translate=\"no\"\u003eYOUR_API_NAME\u003c/var\u003e with the name of your API.\n - Replace \u003cvar translate=\"no\"\u003eVERSION_NUMBER\u003c/var\u003e with your API version, for example, `v1`.\n - Replace code\\\u003e\u003cvar translate=\"no\"\u003eYOUR_PROJECT_ID\u003c/var\u003e with the Google Cloud project ID of the client.\n3. In each API method where you want to check for proper authentication,\n check for a valid `User` and raise `error 401` if there isn't one, as\n shown in this sample method definition:\n\n user = endpoints.get_current_user()\n # If there's no user defined, the request was unauthenticated, so we\n # raise 401 Unauthorized.\n\n4. [Deploy the Endpoints API](/endpoints/docs/frameworks/python/test-deploy).\n You need to redeploy the Endpoints API whenever you add new\n clients.\n\n### Adding Firebase authentication to a client\n\nYou can add Firebase authentication to your code as described in the\n[Firebase](https://firebase.google.com/docs/auth/)\ndocumentation. The client must have a Google Cloud project associated with\nit, and the project ID must be listed in the API's Firebase issuer\nconfiguration.\n\nAuthenticating with Auth0\n-------------------------\n\nTo support calls from clients that use Auth0:\n\n1. Import the App Engine Endpoints API in your API class:\n\n import endpoints\n\n2. Add an Auth0 issuer object for each client to\n the\n [API decorator](/endpoints/docs/frameworks/python/decorators-reference#defining_the_api_endpointsapi).\n For example:\n\n ```\n @endpoints.api(\n name='YOUR_API_NAME',\n version='VERSION_NUMBER',\n issuers={'auth0': endpoints.Issuer(\n 'https://YOUR_ACCOUNT_NAME.auth0.com',\n 'https://YOUR_ACCOUNT_NAME.auth0.com/.well-known/jwks.json')})\n ```\n - Replace \u003cvar translate=\"no\"\u003eYOUR_API_NAME\u003c/var\u003e with the name of your API.\n - Replace \u003cvar translate=\"no\"\u003eVERSION_NUMBER\u003c/var\u003e with your API version, for example, `v1`.\n - Replace \u003cvar translate=\"no\"\u003eYOUR_ACCOUNT_NAME\u003c/var\u003e with the Auth0 account name used for the client.\n3. In each API method where you want to check for proper authentication,\n check for a valid `User` and raise `error 401` if there isn't one, as\n shown in this sample method definition:\n\n user = endpoints.get_current_user()\n # If there's no user defined, the request was unauthenticated, so we\n # raise 401 Unauthorized.\n\n4. [Deploy the API](/endpoints/docs/frameworks/python/test-deploy). You\n need to redeploy the API whenever you add new clients.\n\n### Adding Auth0 authentication to a client\n\nYou can add Auth0 authentication to your code as described in the\n[Auth0](http://auth0.com)\ndocumentation. The client must be listed in the API's Auth0 issuer configuration.\n\nAuthenticating with Google ID tokens\n------------------------------------\n\nTo support calls from clients that authenticate using Google ID tokens:\n\n1. Obtain an OAuth 2 client ID for each client application. The client\n application owner must generate the client ID from the Google Cloud console. For\n instructions, see\n [Creating client IDs](/endpoints/docs/frameworks/python/creating-client-ids).\n\n2. Import the App Engine Endpoints API in your API class:\n\n import endpoints\n\n3. Specify all of the client IDs you want to grant access to your API\n in the `allowed_client_ids`, and also specify client IDs belonging to Android\n clients in the`audiences` field in the\n [API decorator](/endpoints/docs/frameworks/python/decorators-reference#defining_the_api_endpointsapi).\n For example:\n\n ```\n @endpoints.api(\n name='YOUR_API_NAME',\n version='VERSION_NUMBER',\n allowed_client_ids=ALLOWED_CLIENT_IDS,\n audiences=[ANDROID_AUDIENCE])\n class AuthedGreetingApi(remote.Service):\n # ...\n ```\n\n Replace \u003cvar translate=\"no\"\u003eALLOWED_CLIENT_IDS\u003c/var\u003e with the list of OAuth 2\n client IDs generated from each client's project, and replace\n \u003cvar translate=\"no\"\u003eANDROID_AUDIENCE\u003c/var\u003e with the list of Android web client\n IDs. The web client ID is the client ID with `.apps.googleusercontent.com`\n appended, for example:\n \u003cvar translate=\"no\"\u003eYOUR_CLIENT_ID\u003c/var\u003e`.apps.googleusercontent.com`.\n4. In each API method where you want to check for proper authentication,\n check for a valid `User` and raise `error 401` if there isn't one, as\n shown in this sample method definition:\n\n user = endpoints.get_current_user()\n # If there's no user defined, the request was unauthenticated, so we\n # raise 401 Unauthorized.\n\n5. [Deploy the Endpoints API](/endpoints/docs/frameworks/python/test-deploy).\n You need to redeploy the Endpoints API whenever you add new\n clients.\n\n### Adding Google ID token authentication to a client\n\nFor information on adding authentication code to clients, see the following:\n\n- [Android app](/endpoints/docs/frameworks/python/consume_android)\n- [Python client](/endpoints/docs/frameworks/python/access_from_python)\n\nWhat's next\n-----------\n\nFor background information about user authentication and how it differs from\nAPI key authorization, see\n[When and why to use API keys](/endpoints/docs/frameworks/python/when-why-api-key)."]]
