title: How do I allow public/unauthenticated publish to my GCP pub/sub topic from front-end webapp?
body: <p>After reading a guide on GCP PubSub, I've created a new topic which pushes data into BigQuery. That part is working fine.</p>
  <p>What's not working is: I still need to be authenticated to publish to the topic. Even though I have added the <code>allUsers</code> principal with <code>Pub/Sub Publisher</code> role. Infact, it even shows a big scary warning saying:</p>
  <blockquote>
  <p>This resource is public and can be accessed by anyone on the internet. To remove public access, remove &quot;allUsers&quot; and &quot;allAuthenticatedUsers&quot; from the resource's principals.</p>
  </blockquote>
  <p>Despite this, when I try to send a POST request to the HTTP endpoint, it still demands auth.</p>
  <pre><code>POST https://pubsub.googleapis.com/v1/projects/{my-project}/topics/{my-topic}:publish
  
  HTTP Status=403
  &quot;message&quot;: &quot;The request is missing a valid API key.&quot;
  </code></pre>
  <p>Well of course it's missing an API key: it's supposed to be public!</p>
  <p>I realize there are some workarounds: create a service user, implement bearer auth on front-end. Or proxy this through a CloudFunction. But those have major drawbacks in terms of added complexity and/or cost. It seems there must be some trivial way to handle this.</p>
  <p>For context: This is probably an X/Y problem. My usecase is to push arbitrary blobs of data from a web front-end, and have them end up in BigQuery in near-realtime. Not unlike how Google Analytics allows a web front-end to send &quot;events&quot; which then appear in the Analytics web UI after ~24h. Unfortunately, a large portion of my users are running adblockers, which break Google Analytics, impeding our ability to understand how users engage with our webapp. Googling around led me to <a href="https://cloud.google.com/blog/products/data-analytics/pub-sub-launches-direct-path-to-bigquery-for-streaming-analytics" rel="nofollow noreferrer">this marketing pitch about how PubSub is great for streaming analytics into BigQuery with low cost</a>. But if I have to run my own microservice to proxy these inbound requests anyway, then PubSub adds no value as I can then stream the data directly to BigQuery. So there must be something I'm missing. Maybe there's another GCP service better suited for this usecase?</p>