This sample shows how to make an authenticated request by retrieving a JSON Web Tokens (JWT) from the [metadata server](https://cloud.google.com/run/docs/securing/service-identity#identity_tokens).

For more details on how to work with this sample read [Authenticating service-to-service](https://cloud.google.com/run/docs/authenticating/service-to-service).

**Note** You cannot query an instance's metadata from another instance or directly from your local computer. For testing purposes, this sample uses the environment variable, `"GOOGLE_CLOUD_PROJECT"`, to determine local or instance environment. To run tests locally, make sure environment variable, `"GOOGLE_CLOUD_PROJECT"`, is not set.

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>

<groupId>com.example.cloudrun</groupId>

<artifactId>authentication</artifactId>

<packaging>jar</packaging>

<version>1.0-SNAPSHOT</version>

<!--

<parent>

<groupId>com.google.cloud.samples</groupId>

<artifactId>shared-configuration</artifactId>

<version>1.0.13</version>

</parent>

<properties>

<maven.compiler.target>1.8</maven.compiler.target>

<maven.compiler.source>1.8</maven.compiler.source>

</properties>

<dependencies>

<dependency>

<groupId>com.squareup.okhttp3</groupId>

<artifactId>okhttp</artifactId>

<version>4.4.1</version>

</dependency>

<dependency>

<groupId>junit</groupId>

<artifactId>junit</artifactId>

<version>4.13</version>

<scope>test</scope>

</dependency>

</dependencies>

</project>

package com.example.cloudrun;

import java.io.IOException;

import java.util.concurrent.TimeUnit;

import okhttp3.OkHttpClient;

import okhttp3.Request;

import okhttp3.Response;

public class Authentication {

// Instantiate OkHttpClient

private static final OkHttpClient ok =

new OkHttpClient.Builder()

.readTimeout(10, TimeUnit.SECONDS)

.writeTimeout(10, TimeUnit.SECONDS)

.build();

// makeGetRequest makes a GET request to the specified Cloud Run endpoint,

// serviceUrl (must be a complete URL), by authenticating with the Id token

// obtained from the Metadata API.

public static Response makeGetRequest(String serviceUrl) throws IOException {

Request.Builder serviceRequest = new Request.Builder().url(serviceUrl);

// Set up metadata server request

// https://cloud.google.com/compute/docs/instances/verifying-instance-identity#request_signature

String tokenUrl =

String.format(

"http://metadata/computeMetadata/v1/instance/service-accounts/default/identity?audience=%s",

serviceUrl);

Request tokenRequest =

new Request.Builder().url(tokenUrl).addHeader("Metadata-Flavor", "Google").get().build();

// Fetch the token

try (Response tokenResponse = ok.newCall(tokenRequest).execute()) {

String token = tokenResponse.body().string();

// Provide the token in the request to the receiving service

serviceRequest.addHeader("Authorization", "Bearer " + token);

System.out.println("Id token query succeeded.");

} catch (IOException e) {

System.out.println("Id token query failed: " + e);

}

return ok.newCall(serviceRequest.get().build()).execute();

}

}

package com.example.cloudrun;

import static org.hamcrest.MatcherAssert.assertThat;

import static org.hamcrest.core.StringContains.containsString;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.PrintStream;

import org.junit.After;

import org.junit.Before;

import org.junit.Test;

public class AuthenticationTest {

private ByteArrayOutputStream bout;

private PrintStream out;

String expectedResp;

@Before

public void setUp() {

bout = new ByteArrayOutputStream();

out = new PrintStream(bout);

System.setOut(out);

// This test uses the existence of env var "GOOGLE_CLOUD_PROJECT"

// to determine local vs GCP environment only for testing purposes.

if (System.getenv("GOOGLE_CLOUD_PROJECT") != null) {

expectedResp = "Id token query succeeded";

System.out.println("Running on GCP...");

} else {

expectedResp = "Id token query failed";

System.out.println("Running locally...");

}

}

@After

public void tearDown() {

System.setOut(null);

}

@Test

public void canMakeGetRequest() throws IOException {

String url = "http://example.com/";

Authentication.makeGetRequest(url);

String got = bout.toString();

assertThat(got, containsString(expectedResp));

}

@Test

public void failsMakeGetRequestWithoutProtocol() throws IOException {

String url = "example.com/";

try {

Authentication.makeGetRequest(url);

} catch (IllegalArgumentException e) {

assertThat(e.getMessage(), containsString("Expected URL scheme 'http' or 'https'"));

}

}

}