title: Cloud Endpoints Authentication
body: <p>I am using App Engine Standard with the Python 2 runtime and Endpoints Frameworks.
  When making a request, the app just returns "Successful" if the request was completed.  I am trying to implement authentication so unauthenticated users are not able to complete the request. I've done the following:</p>
  
  <ol>
  <li>Modified my main.py decorator to include issuers and audience:</li>
  </ol>
  
  <pre><code>issuers={'serviceAccount': endpoints.Issuer('[MYSERVICEACCOUNT]', 'https://www.googleapis.com/robot/v1/metadata/x509/[MYSERVICEACCOUNT]')}, 
  audiences={'serviceAccount': ['[MYSERVICENAME]-dot-[MYPROJECT].appspot.com']}
  </code></pre>
  
  <ol start="2">
  <li>Modifed my main.py method to check for a valid user:</li>
  </ol>
  
  <pre><code>user = endpoints.get_current_user()
  if user is None:
     raise endpoints.UnauthorizedException('You must authenticate first.')
  </code></pre>
  
  <ol start="3">
  <li><p>Regenerated and redeployed my openAPI document. It now has security and securityDefinitions sections.</p></li>
  <li><p>Updated my app.yaml to reference that Endpoints version.</p></li>
  <li><p>Redeployed my app</p></li>
  </ol>
  
  <p>To make an authorized request to my app, I have done the following:</p>
  
  <ol>
  <li><p>I gave the service account the Service Consumer role on my Endpoints service.</p></li>
  <li><p>Generate a signed jwt using the generate_jwt function from Google's <a href="https://cloud.google.com/endpoints/docs/openapi/service-account-authentication" rel="nofollow noreferrer">documentation</a>. I am passing in credentials using the service account's json key file. </p></li>
  </ol>
  
  <pre><code>    payload = json.dumps({
          "iat": now,
          "exp": now + 3600,
          "iss": [MYSERVICEACCOUNT],
          "sub": [MYSERVICEACCOUNT],
          "aud": [MYSERVICENAME]-dot-[MYPROJECT].appspot.com
      })
  </code></pre>
  
  <ol start="3">
  <li>Make the request using make_jwt_request function from Google's documentation.</li>
  </ol>
  
  <pre><code>   headers = {
          'Authorization': 'Bearer {}'.format(signed_jwt),
          'content-type': 'application/json'}
  </code></pre>
  
  <p>I am getting 401 Client Error: Unauthorized for url error.  Am I missing something?</p>