title: RSA private/public keys for Google's OAuth2
body: <p>I'm making a server-to-server authentication using a service account from Google Cloud Platform. According to <a href="https://developers.google.com/identity/protocols/oauth2/service-account#creatingjwt" rel="nofollow noreferrer">Google's documentation</a>, the request token (JWT) must be based on RSA SHA-256 algoritm, therefore signed with a RSA certificated private key and decoded with its respective public key.</p>
  
  <p>How do i let google api know the public key?</p>
  
  <p>I'm aware that Google has its own <a href="https://www.googleapis.com/oauth2/v1/certs" rel="nofollow noreferrer">RSA certificates</a> but i don't know how to use them exactly.</p>
  
  <p>So, what RSA private/public key should i use for google's oauth2 token codification?</p>
  
  <p>Here's an extract of the code:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="true">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>import jwt from 'jsonwebtoken'
  const axios = require('axios')
  const fs = require('fs')
  const {
    google
  } = require('googleapis')
  
  // oauth2 token uri
  const GSUITE_AUD = 'https://oauth2.googleapis.com/token'
  
  const payload = {
    iss: 'example@example.iam.gserviceaccount.com',
    scope: 'https://www.googleapis.com/auth/admin.directory.user',
    aud: GSUITE_AUD,
  }
  
  const options = {
    algorithm: 'RS256',
    expiresIn: '10m'
  }
  
  const fetchGSuiteUsersUtil = () =&gt; {
    let path = require('path'),
      privateKeyFilePath = path.join(__dirname, 'private.key')
  
    const privateKey = fs.readFileSync(privateKeyFilePath, 'utf-8')
  
    const request_token = jwt.sign(payload, privateKey, options)
  
    authorize(request_token, listUsers)
  
    function authorize(request_token, callback) {
      const TOKEN_URI = GSUITE_AUD
      const data = {
        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
        assertion: request_token
      }
      axios.post(TOKEN_URI, data)
        .then((res) =&gt; {
          console.log(`statusCode: ${res.statusCode}`)
          console.log(res)
          // callback(res)
        })
        .catch((error) =&gt; {
          /**
           * Here i get the error 'Invalid JWT signature' and sounds logic
           * since it doesn't know the public key for the RSA certificated
           * private key that i used
           * 
           */
          console.error(error)
        })
    }
  
    function listUsers(auth) {
      const service = google.admin({
        version: 'directory_v1',
        auth,
      })
      service.users.list({
          customer: 'my_customer',
          orderBy: 'email',
          maxResults: 500,
          query: 'orgUnitPath=/'
        },
        async(err, res) =&gt; {
          // Do things once i get the token..
        })
    }
  
  }
  
  export default fetchGSuiteUsersUtil</code></pre>
  </div>
  </div>
  </p>