title: How can I retrieve an id_token to access a Google Cloud Function?
body: <p>I'm trying to generate a <em>id_token</em> to make authenticated calls to Google Cloud Functions using this following code, that I got from <a href="https://medium.com/google-cloud/service-account-credentials-api-a-solution-to-different-issues-dc7434037115" rel="nofollow noreferrer">here</a>:</p>
  <pre><code># IAP audience is the ClientID of IAP-App-Engine-app in 
  # the API-&gt;credentials page
  # Cloud Function and Cloud Run need the base URL of the service
  audience = 'my_cloud_function_url'
  # #1 Get the default credential to generate the access token
  credentials, project_id = google.auth.default()
  
  # #2 To use the current service account email
  service_account_email = credentials.service_account_email
  
  # Don't work with user account, so define manually the email
  # service_account_email = 'MY SERVICE ACCOUNT EMAIL'
  # #3 prepare the call the the service account credentials API
  sa_credentials_url =  f'https://iamcredentials.googleapis.com/' \
                        f'v1/projects/-/serviceAccounts/'  \
                        f'{service_account_email}:generateIdToken'
  headers = {'Content-Type': 'application/json'}
  # Create an AuthorizedSession that includes 
  # automatically the access_token based on your credentials
  authed_session = AuthorizedSession(credentials)
  # Define the audience in the request body
  # add the parameter &quot;'includeEmail':true&quot; for IAP access
  body = json.dumps({'audience': audience})
  # Make the call 
  token_response = authed_session.request('POST',sa_credentials_url,
                                          data=body, headers=headers)
  
  jwt = token_response.json()
  id_token = jwt['token']
  </code></pre>
  <p>I'm not running it into a Google Cloud environment, so I set my GOOGLE_APPLICATION_CREDENTIALS to a json file from a service account I generated in the console. I asked my network manager to authorize the service account within the ['https://www.googleapis.com/auth/cloud-platform'] scope.</p>
  <p>When I run the script, I get the following error:</p>
  <pre><code>{'error': {'code': 403, 'message': 'The caller does not have permission', 'status': 'PERMISSION_DENIED'}}
  </code></pre>
  <p>I imagine that this error has something to do with not having some intern access with this service account, but I'm not sure, can anybody help me with this?</p>
  <p>Edit:</p>
  <p>As stated by @guillaume blaquiere on the comments, you can get the id_token without calling the Service Account Credential API, And I could obtain the id_token, but was unable to call my service account with that id_token</p>
  <pre><code>import google.oauth2.id_token
  import google.auth.transport.requests
  
  request = google.auth.transport.requests.Request()
  audience = 'my_cloud_function_url'
  
  id_token = google.oauth2.id_token.fetch_id_token(request, audience)
  headers = {'Authorization': f'bearer {id_token}'}
  service_response = requests.get(audience, headers=headers)
  </code></pre>
  <p>Does anyone knows why thes id_token is invalid?</p>