title: What is correct way to access an Identity Aware Proxy protected GCloud AppEngine URL with dotnet?
body: <p>I have a GCloud deployed appengine that is protected with Google's identity aware proxy (IAP) and would like to do server to server communication to retrieve a URL from the app using dotnet (F# in this case).  All the google examples hit google apis not appengine pages, and I haven't found any in .Net.   My basic F# below (API calls same as you'd make for C#) manages to set up the service credentials and retrieve token but pulling the home page of the app (which should require no further auth) returns the error below.  I think it's at least partially correct because earlier attempts to provide the Bearer token incorrectly land on the google sign in page rather than the app.   I have added the service account to the list of authorized users.  <a href="https://cloud.google.com/iap/docs/authentication-howto" rel="nofollow noreferrer">The closest google example is in Python</a> and uses a two step process but the api calls are different to the dotnet library.  Suggestions for debugging or fixes appreciated,</p>
  
  <blockquote>
    <p>Unhandled Exception: System.AggregateException: One or more errors
    occurred. (Response status code does not indicate success: 401
    (Unauthorized).) ---> System.Net.Http.HttpRequestException: Response
    status code does not indicate success: 401 (Unauthorized).    at
    System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()    at
    System.Net.Http.HttpClient.d__27.MoveNext()</p>
  </blockquote>
  
  <pre><code>open Google.Apis.Auth
  open Google.Apis.Requests
  open Google.Apis.Http
  open Google.Apis.Oauth2.v2
  open Google.Apis.Auth.OAuth2
  open System.IO
  open System
  open Google.Apis.Auth.OAuth2
  
  
  open System
  open System.Threading.Tasks
  open Giraffe.Tasks
  open System.Security.Cryptography.X509Certificates
  
  open Google.Apis.Auth.OAuth2
  open Google.Apis.Services
  open System.Security.Cryptography
  open System.Net.Http.Headers
  
  let test() =
  
      printfn "inial service account credentials from json"
      use jsonStream = new StreamReader("c:/&lt;path to json credentials&gt;.json")
      let credential = ServiceAccountCredential.FromServiceAccountData(jsonStream.BaseStream)
  
      let t =
          task {
              printfn "Get access token"
              // Is this the right auth_uri?
              let! token = credential.GetAccessTokenForRequestAsync("https://www.googleapis.com/oauth2/v4/token")
              let auth = AuthenticationHeaderValue("Bearer",token)
              credential.HttpClient.DefaultRequestHeaders.Authorization&lt;-auth
  
              // This access to an Identity aware proxy protected appengine page access to an Identity aware proxy throws a 401
              let! homePage = credential.HttpClient.GetStringAsync("https://&lt;myapp&gt;.appspot.com")
              printfn "%s" homePage
          }
      t.Wait()
      ()
  </code></pre>