Is it possible to protect an App Engine application with IAP while having a few public URLs?
As Ahmad suggested, the solution is to have a separate App Engine service that is publicly accessible.
I have an Google App Engine Standard (Python 3) application that I've secured behind Google IAP. This works great! But now I need a handful of web hook urls to be public, so other services can hit them, like SendGrid. Is there a solution to this that I am not seeing?