Google issues OIDC tokens for service accounts from https://accounts.google.com. The account email identifies the caller. The numeric unique ID stays the same if the account is deleted and recreated.
Docs and discovery
| Docs | Service account credentials |
| Issuer | https://accounts.google.com |
| Discovery | https://accounts.google.com/.well-known/openid-configuration |
The unique ID is on IAM, Service Accounts, Unique ID.
Token
| Issuer | https://accounts.google.com |
| Audience | The audience the caller requests |
email | |
| Unique ID | sub, optional |
Fields
| Field | Claim | Required | Validation |
|---|---|---|---|
| Service account email | email | Yes | A valid email address. |
| Unique ID | sub | No | Digits only. |
| Audience | aud | Yes | The audience the caller requests. |
| Additional claims | other | No | Cannot reuse aud, email, or sub. |
Example policy
{
issuer: "https://accounts.google.com",
claims: {
aud: ["https://app.example.com"],
email: ["bot@acme.iam.gserviceaccount.com"],
sub: ["117"],
},
}Add a field
Edit components/oidc/provider-google.tsx after install. For a one-off claim, use Additional claims. For its own input, add it to Fields (or schema), DEFAULTS, compile, parse, FIRST_CLASS_CLAIMS, and the form.
See Add a field.