title: Firebase ID token has incorrect "aud" (audience) claim when calling from Endpoint connected to Google Functions
body: <p>I am using Google Endpoints as an API gateway which is running in a Google Run container service. The API path points to a Google Function (node js). The calls to the API gateway are from a web application (viz. browser).</p>
  
  <p>One of the paths is: <code>/login</code> which authenticates a user in firebase using the <code>firebase.auth().signInWithEmailAndPassword</code> method. I get the token Id of the user and send it back in the response header (authentication bearer) back to the browser. This works as expected.</p>
  
  <p>When other Requests are made (e.g <code>/check</code>) to the endpoint the token (in the header) is included. I wanted to check the validity of the token using the Firebase Admin method before processing any requests.  The code in the Google Function that does this for one of the routes is as follows:</p>
  
  <pre><code>...
  
  const decodeIdToken = async (req, res, next) =&gt; {
    // Read the ID Token from the Authorization header.
    const idToken = req.headers.authorization.split('Bearer ')[1];
    try {
      const decodedIdToken = await admin.auth().verifyIdToken(idToken);
      req.decodedToken = decodedIdToken;
      next();
      return;
    } catch (error) {
      return res.status(403).json({
        status: 'failure',
        data: null,
        error: error.message
      });
    }
  };
  
  // use decodeIdToken as middleware
  app.post('/check', decodeIdToken, (req, res, next) =&gt; {
    return res.json({
      status: 'success',
      data: req.decodedToken,
      error: null
    });
  });
  
  </code></pre>
  
  <p>When I call (via Postman ) the routes by directly calling the Google Function trigger <strong>both the routes</strong> work. However, when I call <strong>the Google Endpoints</strong> which point to the Google Function I receive the following error while using the Firebase Admin object:</p>
  
  <blockquote>
    <p>Firebase ID token has incorrect \"aud\" (audience) claim. Expected \"PROJECT-ID\" but got \"<a href="https://us-central1-PROJECT-ID.cloudfunctions.net/FUNCTION-NAME" rel="nofollow noreferrer">https://us-central1-PROJECT-ID.cloudfunctions.net/FUNCTION-NAME</a>\". Make sure the ID token comes from the same Firebase project as the service account used to authenticate this SDK. See <a href="https://firebase.google.com/docs/auth/admin/verify-id-tokens" rel="nofollow noreferrer">https://firebase.google.com/docs/auth/admin/verify-id-tokens</a> for details on how to retrieve an ID token</p>
  </blockquote>
  
  <p>When setting the Firebase Admin object in NodeJs I tried the following:</p>
  
  <pre><code>const admin = require('firebase-admin');
  admin.initializeApp();
  </code></pre>
  
  <p>as well as</p>
  
  <pre><code>admin.initializeApp({
    credential: admin.credential.cert(serviceAccount),
    databaseURL: "https://PROJECT-ID.firebaseio.com"
  });
  </code></pre>