如要驗證使用者，用戶端應用程式必須在傳送至後端 API 的 HTTP 要求授權標頭中，傳送 JSON Web Token (JWT)。可擴充服務 Proxy (ESP) 會代表 API 驗證權杖，因此您不必在 API 中新增任何程式碼來處理驗證。不過，您必須設定 OpenAPI 文件，才能支援所選的驗證方法。
securityDefinitions:firebase:authorizationUrl:""flow:"implicit"type:"oauth2"# Replace YOUR-PROJECT-ID with your project IDx-google-issuer:"https://securetoken.google.com/YOUR-PROJECT-ID"x-google-jwks_uri:"https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com"x-google-audiences:"YOUR-PROJECT-ID"
在 API 層級新增安全性區段，並套用至整個 API，或是在方法層級套用至特定方法。
security:
- firebase: []
您可以在 OpenAPI 文件中定義多項安全定義，但每項定義必須要有不同的核發者。如果您在 API 層級和方法層級使用安全性區段，方法層級的設定就會覆寫 API 層級的設定。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eCloud Endpoints uses JSON Web Tokens (JWT) for user authentication, validated by the Extensible Service Proxy (ESP) without requiring additional code in your API.\u003c/p\u003e\n"],["\u003cp\u003eThe client application must include specific JWT claims (iss, sub, aud, iat, exp) in the authorization header of HTTP requests for successful authentication.\u003c/p\u003e\n"],["\u003cp\u003eOpenAPI documents need security requirement and definition objects for ESP to validate JWT claims, such as using Firebase authentication with the necessary security settings and project ID.\u003c/p\u003e\n"],["\u003cp\u003eAuthentication tokens can be sent in the \u003ccode\u003eAuthorization:Bearer\u003c/code\u003e header, or alternatively as an \u003ccode\u003eaccess_token\u003c/code\u003e query parameter, for making calls to an Endpoints API.\u003c/p\u003e\n"],["\u003cp\u003eESP forwards the authentication results to the backend API in the \u003ccode\u003eX-Endpoint-API-UserInfo\u003c/code\u003e header, which is a base64url-encoded JSON object containing the JWT payload and is the recommended way of accessing the authentication results.\u003c/p\u003e\n"]]],[],null,["# Using Firebase to authenticate users\n\nOpenAPI \\| gRPC\n\n\u003cbr /\u003e\n\nThis page describes how to support user authentication in Cloud Endpoints.\n\nTo authenticate a user, a client application must send a\n[JSON Web Token (JWT)](https://jwt.io/) in the authorization header of the\nHTTP request to your backend API. The\n[Extensible Service Proxy (ESP)](/endpoints/docs/glossary#extensible_service_proxy)\nvalidates the token on behalf of your API, so you don't have to add any code in\nyour API to process the authentication. However, you do need to configure your\nOpenAPI document to support your chosen authentication methods.\n\nESP validates a JWT in a performant way by using the JWT's\nissuer's public keys. ESP caches the public keys for five\nminutes. In addition, ESP caches validated JWTs for five minutes\nor until JWT expiry, whichever happens first.\n\nBefore you begin\n----------------\n\n- Add authentication code to your client application, following the [Firebase authentication](https://firebase.google.com/docs/auth/), documentation. Firebase supports authentication by using passwords, phone numbers, and popular federated identity providers like Google, Facebook and Twitter.\n\n\n- When your client application sends an HTTP request, the authorization header in the request must contain the following JWT claims:\n - `iss` (issuer)\n - `sub` (subject)\n - `aud` (audience)\n - `iat` (issued at)\n - `exp` (expiration time)\n\n\u003cbr /\u003e\n\nConfiguring your OpenAPI document\n---------------------------------\n\n\nYou must have a [security\nrequirement object](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#securityRequirementObject) and a [security\ndefinitions object](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#securityDefinitionsObject) in your OpenAPI document for ESP to\nvalidate the claims in the signed JWT.\n\n\u003cbr /\u003e\n\nTo support Firebase authentication:\n\n1. Add the following to the security definition in your OpenAPI\n document:\n\n securityDefinitions:\n firebase:\n authorizationUrl: \"\"\n flow: \"implicit\"\n type: \"oauth2\"\n # Replace YOUR-PROJECT-ID with your project ID\n x-google-issuer: \"https://securetoken.google.com/YOUR-PROJECT-ID\"\n x-google-jwks_uri: \"https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com\"\n x-google-audiences: \"YOUR-PROJECT-ID\"\n\n | **Note:** When defining security schemes in your OpenAPI document for JWT authentication, you must include the `authorizationUrl` field, even if its value is an empty string (\"\"). This is a requirement of the OpenAPI specification. Although the field is mandatory for the spec, its value is not used by Cloud Endpoints or API Gateway when validating a JWT.\n2. Add a security section at either the API level to apply to the entire\n API, or at the method level to apply to a specific method.\n\n security:\n - firebase: []\n\n\nYou can define multiple security definitions in the OpenAPI document, but each\ndefinition must have a different issuer. If you use security sections at both\nthe API level and at the method level, the method-level settings override the\nAPI-level settings.\n\n\u003cbr /\u003e\n\n\nYou may also customize JWT locations by adding `x-google-extensions`. For details, see [openAPI extensions](/endpoints/docs/openapi/openapi-extensions#x-google-jwt-locations).\n\n\u003cbr /\u003e\n\nMaking an authenticated call to an Endpoints API\n------------------------------------------------\n\nWhen you send a request using an authentication token, for security reasons, we\nrecommend that you put the token in the `Authorization:Bearer` header. For\nexample: \n\n curl -H \"Authorization: Bearer ${TOKEN}\" \"${ENDPOINTS_HOST}/echo\"\n\nHere, `ENDPOINTS_HOST` and `TOKEN` are environment variables containing your\nAPI host name and authentication token, respectively. See\n[Making an authenticated request to an Endpoints API](/endpoints/docs/openapi/service-account-authentication#making_an_authenticated_request).\nfor sample code that sends a request using the `Authorization:Bearer` header.\n\nIf you cannot use the header when sending the request, you can put the\nauthentication token in a query parameter called `access_token`. For example: \n\n curl \"${ENDPOINTS_HOST}/echo?access_token=${TOKEN}\"\n\nReceiving authenticated results in your API\n-------------------------------------------\n\n\nESP usually forwards all headers it receives. However, it overrides the\noriginal `Authorization` header when the backend address is specified by\n`x-google-backend` in OpenAPI specification or `BackendRule`\nin gRPC service configuration.\n\n\nESP will send the authentication result in the `X-Endpoint-API-UserInfo`\nto the backend API. We recommend using this header instead of the original\n`Authorization` header. This header is a string that `base64url` encodes\na JSON object. The JSON object format differs between ESPv2 and ESP.\nFor ESPv2, the JSON object is exactly the original JWT payload. For ESP,\nthe JSON object uses different field names and put original JWT payload under `claims` field.\nSee [Handle JWTs in the backend service](/endpoints/docs/openapi/migrate-to-esp-v2#handle-jwt)\nfor more information on the format.\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n\n- [Troubleshooting JWT validation](/endpoints/docs/openapi/troubleshoot-jwt)\n- [Authentication between services](/endpoints/docs/openapi/service-account-authentication)\n\n\u003cbr /\u003e"]]
