App Identity Go Functions


Getting the project ID

The project ID can be found using the `appengine.AppID` function.

Getting the application hostname


Asserting identity to other App Engine apps





Asserting identity to Google APIs

Google APIs use the OAuth 2.0 protocol for authentication and authorization. The App Identity API can create OAuth tokens that can be used to assert that the source of a request is the application itself. The appengine.AccessToken function returns an access token for a scope, or list of scopes. This token can then be set in the HTTP headers of a call to identify the calling application.

The following example shows how to use the App Identity API to make a REST call to the Google URL Shortener API.
import (


	urlshortener ""

// shortenURL returns a short URL which redirects to the provided url,
// using Google's urlshortener API.
func shortenURL(ctx context.Context, url string) (string, error) {
	transport := &oauth2.Transport{
		Source: google.AppEngineTokenSource(ctx, urlshortener.UrlshortenerScope),
		Base:   &urlfetch.Transport{Context: ctx},
	client := &http.Client{Transport: transport}

	svc, err := urlshortener.New(client)
	if err != nil {
		return "", err

	resp, err := svc.Url.Insert(&urlshortener.Url{LongUrl: url}).Do()
	if err != nil {
		return "", err
	return resp.Id, nil

Note that the application's identity is represented by the service account name, which is typically You can get the exact value by using the appengine.ServiceAccount function. For services which offer ACLs, you can grant the application access by granting this account access.

Asserting identity to third-party services

The token generated by AccessToken only works against Google services. However you can use the underlying signing technology to assert the identity of your application to other services. The appengine.SignBytes function will sign bytes using a private key unique to your application, and the appengine.PublicCertificates function will return certificates which can be used to validate the signature.

Getting the default Cloud Storage Bucket name

Each application can have one default Cloud Storage bucket, which includes 5GB of free storage and a free quota for I/O operations. The maximum storage of this bucket is 5GB, which you can increase by enabling billing for your app and paying for the extra storage making this a paid bucket.

To get the name of the default bucket, call DefaultBucketName.

Was this page helpful? Let us know how we did:

Send feedback about...

App Engine standard environment for Go