title: 401 Unauthorized When trying to call a google cloud functions
body: <p>I have a simple node.js function inside Google Cloud Function (that is called from inside my website's code) and I used previously the id_token that I got when I'm connected inside Google Cloud SDK and use this: <code>gcloud auth print-identity-token</code>, but it only last 60 minutes, so after that my application can't use anymore the google cloud function.</p>
  <p>So I tried to generate my own token with the help of the service account key: <a href="https://cloud.google.com/docs/authentication/production#create_service_account" rel="nofollow noreferrer">https://cloud.google.com/docs/authentication/production#create_service_account</a></p>
  <p>But I always got a &quot;401 Unauthorized&quot; when I call my link with the &quot;Authorization: Bearer token&quot; header</p>
  <p>Maybe it's because I don't know what to put inside the &quot;<strong>aud</strong>&quot; value (inside the payload array)</p>
  <pre><code>&lt;?php
  
  namespace MyProject\Parser;
  
  use Firebase\JWT\JWT;
  use GuzzleHttp\Client;
  
  abstract class GoogleCloudParser extends AbstractParser
  {
      /**
       * Returns the HTML for the given URL
       * @param string $url
       * @return string
       * @throws \GuzzleHttp\Exception\GuzzleException
       */
      protected function getHTML(string $url): string
      {
          $cloudFunctionURL = &quot;https://region-project-name.cloudfunctions.net/function-name&quot;;
          $token = $this-&gt;getToken();
  
  
          $guzzle = new Client();
          $response = $guzzle-&gt;get($cloudFunctionURL, [
              'query' =&gt; ['url' =&gt; $url],
              'headers' =&gt; [
                  'Authorization' =&gt; &quot;Bearer &quot; . $token
              ]
          ]);
  
          return $response-&gt;getBody()-&gt;getContents();
      }
  
      /**
       * Returns the authentification token for google cloud
       * @return string
       */
      protected function getToken()
      {
          $privateKey = &quot;-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n&quot;;
          $publicKey = &quot;-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n&quot;;    
  
          $payload = [
              'iss' =&gt; 'App-Engine-default-service-account@appspot.gserviceaccount.com',
              'sub' =&gt; 'App-Engine-default-service-account@appspot.gserviceaccount.com',
              'aud' =&gt; 'bucket-name',
              'iat' =&gt; time(),
              'exp' =&gt; (time() + 3600)
          ];
  
          $header = [
              &quot;alg&quot; =&gt; &quot;RS256&quot;,
              &quot;typ&quot; =&gt; &quot;JWT&quot;,
              &quot;kid&quot; =&gt; &quot;private_key_id_of_app_engine_default_service-account&quot;
          ];
  
  
          $token = JWT::encode($payload, $privateKey, $header[&quot;alg&quot;], $header[&quot;kid&quot;]);
  
          return $token;
      }
  }
  </code></pre>
  <p>I tried multiple thing to put on the &quot;<strong>aud</strong>&quot; but I don't know what to use... I tried to use the bucket name that I got with this: <a href="https://github.com/GoogleCloudPlatform/php-docs-samples/blob/78356e87cc54c1d46df52c0d2f47320329957ce5/auth/src/auth_api_explicit.php" rel="nofollow noreferrer">https://github.com/GoogleCloudPlatform/php-docs-samples/blob/78356e87cc54c1d46df52c0d2f47320329957ce5/auth/src/auth_api_explicit.php</a></p>
  <p>With the cmd line: <code>php src/auth_api_explicit.php myGoogleProjectID gcloud-service-account-file.json</code></p>
  <p>I tried to use &quot;https://cloudfunctions.googleapis.com/&quot;...</p>
  <p>I tried to put the full link of my function name inside the google cloud functions.</p>
  <p>And I think I have set up everything inside the IAM &amp; Google Cloud platform for my service account.</p>
  <p>Any help on this please?</p>