title: What is the best way to call an authenticated HTTP Cloud Function from Node JS app deployed in GCP?
body: <p>We have an authenticated HTTP cloud function (CF). The endpoint for this CF is public but because it is authenticated, it requires a valid identity token (<code>id_token</code>) to be added to the <code>Authorization</code> header.</p>
  <p>We have another Node JS application that is deployed in the same Google Cloud. What we want is to call the CF from the Node application, for which we will be needing a valid id token.</p>
  <p>The <a href="https://github.com/googleapis/google-api-nodejs-client#application-default-credentials" rel="nofollow noreferrer">GCP documentation</a> for authentication is too generic and does not have anything for such kind of scenario.</p>
  <br/>
  <p><em>So what is the best way to achieve this?</em></p>
  <p><strong>Note</strong> <br/>
  Like every google Kubernetes deployment, the node application has a service account attached to it which already has cloud function invoker access.</p>
  <br/>
  <p><strong>Follow Up</strong><br/>
  Before posting the question here I had already followed the same approach as <a href="https://stackoverflow.com/users/11372593/guillaume-blaquiere">@guillaume</a> mentioned in his answer.
  In my current code, I am hitting the metadata server from the Node JS application to get an <code>id_token</code>, and then I am sending the <code>id_token</code> in a header <code>Authorization: 'Bearer [id_token]'</code> to the CF HTTP request.
  <br/><br/>
  However, I am getting a <code>403</code> <code>forbidden</code> when I do that. <em>I am not sure why??</em>
  <a href="https://i.stack.imgur.com/r3vwX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/r3vwX.png" alt="enter image description here" /></a></p>
  <br/>
  <p>I can verify the <code>id_token</code> fetched from the metadata server with the following endpoint. <br/>
  <a href="https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=%5Bid_token%5D" rel="nofollow noreferrer">https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=[id_token]</a></p>
  <p>It's a valid one.
  And it has the following fields. <br/>
  Decoding the <code>id_token</code> in <a href="https://jwt.io/" rel="nofollow noreferrer">https://jwt.io/</a> shows the same field in the payload.</p>
  <pre><code>{
      &quot;issued_to&quot;: &quot;XXX&quot;,
      &quot;audience&quot;: &quot;[CLOUD_FUNTION_URL]&quot;,
      &quot;user_id&quot;: &quot;XXX&quot;,
      &quot;expires_in&quot;: 3570,
      &quot;issuer&quot;: &quot;https://accounts.google.com&quot;,
      &quot;issued_at&quot;: 1610010647
  }
  </code></pre>
  <p>There is no service account <code>email</code> field!</p>