OAuth2.0 & Google Cloud Platform (GCP) Identity Aware Proxy (IAP)

[justin-hausmann-sector-e]

Hi guys,

we need some help regarding the OAuth2.0 Resource in conjunction with an API that needs to be triggered. This API is running in Google Kubernetes Engine in Google Cloud Platform and is secured by Identity Aware Proxy.
We followed the following guides:

Create a Google OAuth client | Retool Docs

Configure API authentication | Retool Docs

We can connect to the Ressource and the "Access token" and "Refresh token" are valid.
When me make the Request we are getting the following error message:

error:"{"message":"Invalid IAP credentials: Unable to parse JWT"}"

In GCP IAP we added a group to the IAP Ressource and granted them the role "IAP-secured Web App User". In that group there is the user with the valid "Access token" and "Refresh token".

Maybe someone can provide a hint what to look for, or how to resolve the issue.

Thank you.
Cheers
Justin

[justin-hausmann-sector-e]

We were able to resolve this by ourself.
This post here helped so so much!

How do I give Retool access to a Cloud Functions endpoint that requires authentication?

I have a solution to the problems outlined above. The magic lies within the scopes granted. Authentication: OAuth2.0 authorization url: Sign in - Google Accounts access token url: https://www.googleapis.com/oauth2/v4/token client id and client secret following this guide: Creating a Google OAuth 2.0 client audience: set this to the client id from above access token lifespan: 3600 Scopes required: https://www.googleapis.com/auth/userinfo.email openid For the authorization header be sure to …

@retool Please add those information to your documentation!

Thank you
Cheers
Justin