title: How to initialize a Google BigQuery Client within a Cloud Function using the JWT of a service account passed by API Gateway to the Cloud Function
body: <p><strong>Goal:</strong><br>
  I have set up a Google API Gateway. The backend for the API is a cloud function (written in python). The cloud function should query data from Google BigQuery (BQ). To do that, I want to create a BQ Client (<code>google.cloud.bigquery.Client()</code>). The API should be accessed by different applications using different service accounts. The service accounts have permission to access only specific datasets within my project. Therefore, the service accounts/applications should <em>only</em> be able to query the datasets they have the permission for. Therefore, the BQ Client within the cloud function should be initialized with the service account that sends the request to the API.</p>
  <p><strong>What I tried:</strong><br>
  The API is secured with the following OpenAPI definition so that a JWT signed by the service account SA-EMAIL is required to send a request there:</p>
  <pre class="lang-yaml prettyprint-override"><code>securityDefinitions:
    sec-def1:
      authorizationUrl: &quot;&quot;
      flow: &quot;implicit&quot;
      type: &quot;oauth2&quot;
      x-google-issuer: &quot;SA-EMAIL&quot;
      x-google-jwks_uri: &quot;https://www.googleapis.com/robot/v1/metadata/x509/SA-EMAIL&quot;
      x-google-audiences: &quot;SERVICE&quot;
  </code></pre>
  <p>For the path that uses my cloud function, I use the following backend configuration:</p>
  <pre class="lang-yaml prettyprint-override"><code>x-google-backend:
    address: https://PROJECT-ID.cloudfunctions.net/CLOUD-FUNCTION
    path_translation: CONSTANT_ADDRESS 
  </code></pre>
  <p>So in the cloud function itself I get the forwarded JWT as <code>X-Forwarded-Authorization</code> and also the already verified base64url encoded JWT payload as <code>X-Apigateway-Api-Userinfo</code> from the API Gateway.<br>
  I tried to use the JWT from <code>X-Forwarded-Authorization</code> to obtain credentials:</p>
  <pre class="lang-py prettyprint-override"><code>bearer_token = request.headers.get('X-Forwarded-Authorization')
  token = bearer_token.split(&quot; &quot;)[1]
  cred = google.auth.credentials.Credentials(token)
  </code></pre>
  <p>At first, this seems to work since <code>cred.valid</code> returns <code>True</code>, but when trying to create the client with <code>google.cloud.bigquery.Client(credentials=cred)</code> it returns the following error in the logs:</p>
  <pre><code>google.auth.exceptions.RefreshError: The credentials do not contain 
  the necessary fields need to refresh the access token. You must 
  specify refresh_token, token_uri, client_id, and client_secret.
  </code></pre>
  <p>I do not have much experience with auth/oauth at all, but I think I do not have the necessary tokens/attributes the error is saying are missing available in my cloud function.
  Also, I am not exactly sure why there is a <code>RefreshError</code>, since I don't want to refresh the token (and don't do so explicitly) and just use it again (might be bad practice?).</p>
  <p><strong>Question:</strong><br>
  Is it possible to achieve my goal in the way I have tried or in any other way?</p>