title: How to validate GCP Pub/sub push subscription token?
body: <p>We are new to the GCP. We have set up a Pub/Sub queue that has a push subscription to an external webhook (ASP.NET Web API) with authentication enabled. This gives us a bearer token in the HTTP post call.</p>
  
  <p>It is unclear for me if:</p>
  
  <ul>
  <li>A. I need to request a token using the service account <code>.json</code> file first and compare it with the bearer token that Pub/Sub sends in the webhook. </li>
  <li>B. I only need to validate the token from pubsub with <code>GoogleJsonWebSignature.ValidateAsync(token, settings)</code>?</li>
  </ul>
  
  <p>Either possibility works, I am just unsure about the security implications. Option B is simple, but is it really secure? Isn't possible to tamper with this?</p>