title: JWT validation failed: BAD_FORMAT
body: <p>I am trying my hands on configuring Endpoints on Cloud Functions by following the <a href="https://cloud.google.com/endpoints/docs/openapi/get-started-cloud-functions" rel="nofollow noreferrer">article</a>.</p>
  
  <p>Have performed the following steps:</p>
  
  <p>1) Create a Google Cloud Platform (GCP) project, and deployed the following Cloud Function.</p>
  
  <pre><code>export const TestPost = (async (request: any, response: any) =&gt; {
      response.send('Record created.');
  });
  </code></pre>
  
  <p>using following command</p>
  
  <pre><code>gcloud functions deploy TestPost --runtime nodejs10 --trigger-http --region=asia-east2
  </code></pre>
  
  <p>Function is working fine till here.</p>
  
  <p>2) Deploy the ESP container to Cloud Run using following command</p>
  
  <pre><code>gcloud config set run/region us-central1
  
  gcloud beta run deploy CLOUD_RUN_SERVICE_NAME \
      --image="gcr.io/endpoints-release/endpoints-runtime-serverless:1.30.0" \
      --allow-unauthenticated \
      --project=ESP_PROJECT_ID
  </code></pre>
  
  <p>ESP container is successfully deployed as well.</p>
  
  <p>3) Create an OpenAPI document that describes the API, and configure the routes to the Cloud Functions.</p>
  
  <pre><code>swagger: '2.0'
  info:
      title: Cloud Endpoints + GCF
      description: Sample API on Cloud Endpoints with a Google Cloud Functions backend
      version: 1.0.0
  host: HOST
  schemes:
  - https
  produces:
      - application/json
  paths:
      /Test:
        get:
          summary: Do something
          operationId: Test
          x-google-backend:
              address: https://REGION-FUNCTIONS_PROJECT_ID.cloudfunctions.net/Test
          responses:
              '200':
                  description: A successful response
                  schema:
                      type: string
  </code></pre>
  
  <p>4) Deploy the OpenAPI document using following command </p>
  
  <pre><code>gcloud endpoints services deploy swagger.yaml
  </code></pre>
  
  <p>5) Configure ESP so it can find the configuration for the Endpoints service.</p>
  
  <pre><code>gcloud beta run configurations update \
     --service CLOUD_RUN_SERVICE_NAME  \
     --set-env-vars ENDPOINTS_SERVICE_NAME=YOUR_SERVICE_NAME \
     --project ESP_PROJECT_ID
  
  gcloud alpha functions add-iam-policy-binding FUNCTION_NAME \
      --member "serviceAccount:ESP_PROJECT_NUMBER-compute@developer.gserviceaccount.com" \
      --role "roles/iam.cloudfunctions.invoker" \
      --project FUNCTIONS_PROJECT_ID
  </code></pre>
  
  <p>This is done successfully</p>
  
  <p>6) Sending requests to the API</p>
  
  <p>Works absolutely fine.</p>
  
  <p>Now I wanted to Implement authentication so I made following changes to OpenAPI document </p>
  
  <pre><code>swagger: '2.0'
  info:
      title: Cloud Endpoints + GCF
      description: Sample API on Cloud Endpoints with a Google Cloud Functions backend
      version: 1.0.0
  host: HOST
  schemes:
  - https
  produces:
      - application/json
  security:
      - client-App-1: [read, write]
  paths:
      /Test:
        get:
          summary: Do something
          operationId: Test
          x-google-backend:
              address: https://REGION-FUNCTIONS_PROJECT_ID.cloudfunctions.net/Test
          responses:
              '200':
                  description: A successful response
                  schema:
                      type: string
  securityDefinitions:
      client-App-1:
          authorizationUrl: ""
          flow: "implicit"
          type: "oauth2"
          scopes:
              read: Grants read access
              write: Grants write access
          x-google-issuer: SERVICE_ACCOUNT@PROJECT.iam.gserviceaccount.com
          x-google-jwks_uri: https://www.googleapis.com/robot/v1/metadata/x509/SERVICE_ACCOUNT@PROJECT.iam.gserviceaccount.com
  </code></pre>
  
  <p>I created a service account using following command.</p>
  
  <pre><code>gcloud iam service-accounts create SERVICE_ACCOUNT_NAME --display-name DISPLAY_NAME
  </code></pre>
  
  <p>Granted Token Creator role to service account using following</p>
  
  <pre><code>gcloud projects add-iam-policy-binding PROJECT_ID --member serviceAccount:SERVICE_ACCOUNT_EMAIL --role roles/iam.serviceAccountTokenCreator
  </code></pre>
  
  <p>Redeploy the OpenAPI document</p>
  
  <pre><code>gcloud endpoints services deploy swagger.yaml
  </code></pre>
  
  <p>Now when I test the API I get following error</p>
  
  <pre><code>{
      "code": 16,
      "message": "JWT validation failed: BAD_FORMAT",
      "details": [
          {
              "@type": "type.googleapis.com/google.rpc.DebugInfo",
              "stackEntries": [],
              "detail": "auth"
          }
      ] }
  </code></pre>
  
  <p>I am passing the access token generated via gcloud into the request using BearerToken</p>
  
  <p>cmd for generating access token is <code>gcloud auth application-default print-access-token</code></p>
  
  <p>Can some one point out what the issue here. Thanks...</p>
  
  <p><strong>Edit#1:</strong> 
  I am using Postman to connect to my API's</p>
  
  <p>After using the following command I am getting a different error.</p>
  
  <p><strong>Command:</strong></p>
  
  <pre><code>gcloud auth print-identity-token SERVICE_ACCOUNT_EMAIL
  </code></pre>
  
  <p><strong>Error:</strong></p>
  
  <pre><code>{
      "code": 16,
      "message": "JWT validation failed: Issuer not allowed",
      "details": [
          {
              "@type": "type.googleapis.com/google.rpc.DebugInfo",
              "stackEntries": [],
              "detail": "auth"
          }
      ]
  }
  </code></pre>