title: CustomToken not working when issued through "createCustomToken" method
body: <p>I am using Firebase authentication for my application and using it to authenicate users to a back-end API using JWT tokens. On the API back-end I've configured the JWT-secret, which is the asymmetric keys pulled from this url: </p>
  
  <p><a href="https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com" rel="nofollow noreferrer">https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com</a></p>
  
  <p>This is all working fine. I recently needed to create a cloud function, which needs to call the API back-end as well. To do this, I'm using the functionality to create a Custom Token found here:</p>
  
  <p><a href="https://firebase.google.com/docs/auth/admin/create-custom-tokens" rel="nofollow noreferrer">https://firebase.google.com/docs/auth/admin/create-custom-tokens</a></p>
  
  <p>This creates my token with correct custom claims</p>
  
  <pre><code>          let additionalClaims = {
               'x-hasura-default-role': 'admin',
               'x-hasura-allowed-roles': ['user', 'admin']
             }     
  
          admin.auth().createCustomToken(userId,additionalClaims).then(function (customToken) {
          console.log(customToken);
  
          response.end(JSON.stringify({
            token: customToken
          }))
        })
        .catch(function (error) {
         console.log('Error creating custom token:', error);
      });
  </code></pre>
  
  <p>however, when I try to use it against the back-end API, I get the "JWTInvalidSignature" error. In my cloud function, I specify the service account that is in my firebase project, but it doesn't seem to help. When I view the two tokens decoded, they definitely appear coming from different services.</p>
  
  <p>CustomToken </p>
  
  <pre><code>     {
        "aud": 
         "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",
         "iat": 1573164629,
         "exp": 1573168229,
         "iss": "firebase-adminsdk-r2942@postgrest-b4c8c.iam.gserviceaccount.com",
         "sub": "firebase-adminsdk-r2942@postgrest-b4c8c.iam.gserviceaccount.com",
         "uid": "mikeuserid",
          "claims": {
             "x-hasura-default-role": "admin",
             "x-hasura-allowed-roles": [
             "user",
             "admin"
          ]
         }
      }
  </code></pre>
  
  <p>TOKEN from FireBase Auth</p>
  
  <pre><code> {
        "role": "webuser",   
        "schema": "customer1",
        "userid": "15",
        "claims": {
        "x-hasura-default-role": "user",
        "x-hasura-allowed-roles": [
        "user",
        "admin"
    ],
      "x-hasura-user-id": "OS2T2rdkM5UlhfWLHEjNExZ71lq1",
      "x-hasura-dbuserid": "15"
     },
     "iss": "https://securetoken.google.com/postgrest-b4c8c",
     "aud": "postgrest-b4c8c",
     "auth_time": 1573155319,
     "user_id": "OS2T2rdkM5UlhfWLHEjNExZ71lq1",
     "sub": "OS2T2rdkM5UlhfWLHEjNExZ71lq1",
     "iat": 1573164629,
     "exp": 1573168229,
     "email": "johnny1@gmail.com",
     "email_verified": false,
     "firebase": {
      "identities": {
       "email": [
      "johnny1@gmail.com"
    ]
    },
      "sign_in_provider": "password"
    }
   }
  </code></pre>
  
  <p>How can I get this customToken to work with the existing JWT secret keys I have configured??</p>