title: Application type users authenticating to GCP
body: <p>I'm looking for a standard Oauth2.0 approach for the service type users authenticating to APIs hosted in GCP environment with secrets. The closest I got is a <a href="https://cloud.google.com/endpoints/docs/openapi/service-account-authentication" rel="nofollow noreferrer"><code>service accounts</code></a> with key pairs.</p>
  <p>However I would like to avoid updating <code>ESP</code> config each time a new <code>service account</code> is added (like in the example below).</p>
  <pre><code> securityDefinitions:
    service-1:
      authorizationUrl: &quot;&quot;
      flow: &quot;implicit&quot;
      type: &quot;oauth2&quot;
      x-google-issuer: &quot;service-1@example-project-12345.iam.gserviceaccount.com&quot;
      x-google-jwks_uri: &quot;https://www.googleapis.com/robot/v1/metadata/x509/service-1@example-project-12345.iam.gserviceaccount.com&quot;
    service-2:
      authorizationUrl: &quot;&quot;
      flow: &quot;implicit&quot;
      type: &quot;oauth2&quot;
      x-google-issuer: &quot;service-2@example-project-12345.iam.gserviceaccount.com&quot;
      x-google-jwks_uri: &quot;https://www.googleapis.com/robot/v1/metadata/x509/service-2@example-project-12345.iam.gserviceaccount.com&quot;
  
      #should be possible to leave the addition of service-X to the end client without needing to update this.
  </code></pre>
  <p><strong>EDIT:</strong> I've tried using <code>Identity Platform</code> and <code>ESP</code> config won't need updating when new users are added:</p>
  <pre><code>securityDefinitions:
      auth0:
          authorizationUrl: &quot;&quot;
          flow: &quot;implicit&quot;
          type: &quot;oauth2&quot;
          x-google-issuer: &quot;https://securetoken.google.com/{google-project-ID}&quot;
          x-google-jwks_uri: &quot;https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com&quot;
          x-google-audiences: &quot;{google-project-ID}&quot;
  </code></pre>
  <p>however email/password is not an option for my case and <code>GCP Identity Platform</code> doesn't seem to support users with secrets, unless I'm missing something?</p>
  <p>It would also be good to have a possibility to add custom claims against users, which would remove a need to maintain the permissions table within the API code.</p>
  <p><code>Apigee</code> has all the required functionality however seems to be an expensive over-complication for my project needs.</p>