Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Artikel ini menunjukkan cara mengakses resource yang dilindungi oleh Identity-Aware Proxy (IAP) secara terprogram menggunakan identitas eksternal.
Ada beberapa situasi yang mungkin mengharuskan Anda melakukannya:
Aplikasi frontend Anda memanfaatkan Identity Platform secara langsung. Server API backend Anda di-build menggunakan App Engine, dan dilindungi oleh IAP menggunakan identitas eksternal.
Aplikasi Anda dirancang untuk digunakan di lingkungan browser non-tradisional,
seperti di Android, iOS, atau command line, tempat penggunaan pengalihan browser
untuk mengautentikasi pengguna tidak memungkinkan.
Untuk mengakses resource secara terprogram menggunakan token ID, ikuti langkah-langkah berikut:
Ambil token ID pengguna.
Node.js
Pastikan pengguna login. Kode di bawah menunjukkan contoh sederhana
proses login pengguna dengan email dan sandi:
// If signing in using project-level email/password IdP.// auth.tenantId = null; // This is null by default.// For signing in to a specific tenant using email/password.auth.tenantId='myTenantId';auth.signInWithEmailAndPassword(email,password).then((user)=>{// User signed in. ID token can now be retrieved.}).catch((error)=>{// Handler error.});
Anda kemudian dapat mengambil token ID di objek user:
user.getIdToken().then((idToken)=>{// idToken is now available and can be sent to API server.}).catch((error)=>{// Handler error.});
REST
Memanggil signInWithPassword akan menampilkan token ID dalam respons:
curl 'https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=API-KEY' \
-H 'Content-Type: application/json' \
--data-binary '{
"email":"EMAIL",
"password":"PASSWORD",
"returnSecureToken":true,
"tenantId":"TENANT-ID" # Only used in multi-tenancy
}'
Sertakan token ID dalam header otorisasi saat memanggil
endpoint yang dilindungi oleh IAP.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eThis guide demonstrates how to programmatically access resources secured by Identity-Aware Proxy (IAP) using external identities.\u003c/p\u003e\n"],["\u003cp\u003eIt covers scenarios where direct Identity Platform integration or non-browser environments necessitate programmatic access, like Android, iOS, or command-line interfaces.\u003c/p\u003e\n"],["\u003cp\u003eYou can authenticate with a service account JWT, which has its own dedicated instructions, or by using an ID token as described in this document.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves retrieving a user's ID token, using methods like email/password sign-in, and then including this token in the authorization header when calling IAP-protected endpoints.\u003c/p\u003e\n"],["\u003cp\u003eThe ID Token can be retrieved from the user object after they have signed in, and the document shows how to retrieve it through Node.js and REST examples.\u003c/p\u003e\n"]]],[],null,["# Accessing non-Google resources programmatically\n\nThis article shows you how to programmatically access a resource protected by\nIdentity-Aware Proxy (IAP) using external identities.\n\nThere are several situations where you might want to do this:\n\n- Your frontend application leverages Identity Platform directly. Your\n backend API server is built using App Engine, and protected\n by IAP using external identities.\n\n- Your application is designed for use in a non-traditional browser environment,\n such as on Android, iOS, or the command-line, where using a browser\n redirect to authenticate users is infeasible.\n\nAccessing resources\n-------------------\n\nTo access a resource programmatically using a service account JWT, see\n[Authenticating with a service account JWT](/iap/docs/authentication-howto#authenticating_with_a_service_account_jwt).\n\nTo access a resource programmatically using an ID token, follow these steps:\n\n1. Retrieve the user's ID token.\n\n ### Node.js\n\n Ensure the user is signed in. The code below shows a simple example\n of signing in a user with an email and password: \n\n // If signing in using project-level email/password IdP.\n // auth.tenantId = null; // This is null by default.\n // For signing in to a specific tenant using email/password.\n auth.tenantId = 'myTenantId';\n auth.signInWithEmailAndPassword(email, password)\n .then((user) =\u003e {\n // User signed in. ID token can now be retrieved.\n })\n .catch((error) =\u003e {\n // Handler error.\n });\n\n You can then retrieve an ID token on the `user` object: \n\n user.getIdToken()\n .then((idToken) =\u003e {\n // idToken is now available and can be sent to API server.\n })\n .catch((error) =\u003e {\n // Handler error.\n });\n\n ### REST\n\n Calling `signInWithPassword` returns an ID token in the response: \n\n ```restructuredtext\n curl 'https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=API-KEY' \\\n -H 'Content-Type: application/json' \\\n --data-binary '{\n \"email\":\"EMAIL\",\n \"password\":\"PASSWORD\",\n \"returnSecureToken\":true,\n \"tenantId\":\"TENANT-ID\" # Only used in multi-tenancy\n }'\n ```\n2. Include the ID token in the authorization header when calling\n an endpoint protected by IAP.\n\n ```text\n curl -H \"Authorization: Bearer GCIP-ID-TOKEN\" \"https://example.appspot.com/api\"\n ```"]]
