Google Cloud Platform
Hide
PHP
Write Feedback

App Identity PHP API Overview

Python |Java |PHP |Go
Code sometimes needs to determine the identifier of the application in which it is executing. This may be to generate a URL or email address, or possibly to make some run-time decision. App Engine includes an Application Identity service for this purpose.

  1. Identifying itself
  2. Asserting identity to other App Engine apps
  3. Asserting identity to Google APIs
  4. Asserting identity to other systems

Identifying itself

Application ID

The application ID can be found using the getApplicationId() method.

Versioned hostnames

A related operation is the need to get the hostname part of a URL to the application. You can use the getDefaultVersionHostname() method for this purpose. This is useful in certain scenarios when the application is not available at http://your_app_id.appspot.com.

Asserting identity to other App Engine apps

If you want to determine the identity of the App Engine app that is making a request to your App Engine app, you can use the request header X-Appengine-Inbound-Appid. This header is added to the request by the URLFetch service and is not user modifiable, so it safely indicates the requesting application's ID, if present.

In order for this header to be added to the request, the app making the request must tell the UrlFetch service to not follow redirects when it invokes URLFetch. App Engine will then automatically add the header to the HTTP response.

In your application handler, you can check the incoming ID by reading the X-Appengine-Inbound-Appid header and comparing it to a list of IDs allowed to make requests.

Asserting identity to Google APIs

Many Google APIs support OAuth assertions to identify the source of the request. The App Identity API provides a service that creates tokens that can be used to assert that the source of a request is the application itself. The getAccessToken() method returns an access token for a scope, or list of scopes. This token can then be set in the HTTP headers of a call to identify the calling application.

The following illustrates how to use the App Identity API to retrieve Google Calendar contacts using OAuth.

// Retrieves Google Calendar contacts using OAuth

use google\appengine\api\app_identity\AppIdentityService;

function setAuthHeader() {
  $access_token = AppIdentityService::getAccessToken('https://www.google.com/m8/feeds');
  return [sprintf('Authorization: OAuth %s', $access_token['access_token'])];
}

$get_contacts_url = 'https://www.google.com/m8/feeds/contacts/default/full';
$headers = setAuthHeader();
$opts = [
  'http' => [
    'header' => implode("\r\n", $headers),
  ],
];

$context = stream_context_create($opts);

$response = file_get_contents($get_contacts_url, false, $context);

$xml = simplexml_load_string($response);

$email = $xml->author->email;
$service_account = AppIdentityService::getServiceAccountName();

if (strcmp($email, $service_account) != 0) {
  die(sprintf('%s does not match the service account name %s.',
              $email,
              $service_account));
}

Note that the application's identity is represented by the service account name, which is typically applicationid@appspot.gserviceaccount.com. You can get the exact value by using the getServiceAccountName() method. For services which offer ACLs, you can grant the application access by granting this account access.

Asserting identity to other systems

The token generated by getAccessToken() only works against Google systems. However you can use the underlying signing technology to assert the identity of your application to other systems. The signForApp() method will sign bytes using a private key unique to your application, and the getPublicCertificates() method will return certificates which can be used to validate the signature.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 3.0 License, and code samples are licensed under the Apache 2.0 License. For details, see our Site Policies.