Allow to use Google service account credential in HTTP request node

[Loan_J]

Allowing to use a Google service account credential in the HTTP node would help a lot in building a workflow that automatically updates a domain users’ signature.
Any plans on adding this?

Don’t hesitate to ask for more details.
Regards.

[Loan_J]

Otherwise, anyone has an idea on how to build a workflow to change the email signatures of a Google Workspace domain users?

[ianhyzy]

This is an ugly workaround, but you could use Apps Scripts to built your signature logic and then call that function with a webhook in n8n.

[Loan_J]

Not necessarily ugly, but very overkill for what I want.

My workflow works, the only blocking point is authentication, and we all know that issuing an access token using JWT on n8n is a hassle.
Allowing the use of a Google service account in the HTTP request node would really make things easier and much faster.

@jan Any plans on integrating this?

[_jd]

Hi there, I confirm this would be very useful as Google APIs are full of ressources and built-in nodes don’t cover them all.

[Jon]

I believe this is something we will look at doing but I am not sure where it is on the priority scale at the moment.

[Loan_J]

I succeeded on making a workflow that allows me to issue JWT for Google APIs. How can I submit a template to add in the n8n template library?

[Jelle_de_Rijke]

Hi @Loan_J ,

I also managed to get a request to the Google API’s going by using Online JWT tool.

Did you manage to automate this process in a workflow and if so do you mind sharing your findings or even workflow?

Thanks!

[Jelle_de_Rijke]

For anyone wanting to generate a JWT token to use with google API’s (in my case dialogflow), it turns out it is fairly easy to deploy a google cloud function that handles this.

You need to create a node.js function, and call the entry point something like jwtGenerator

This goes into your index.js

/**
 * Responds to any HTTP request.
 *
 * @param {!express:Request} req HTTP request context.
 * @param {!express:Response} res HTTP response context.
 */

const { JWT } = require('google-auth-library');
const keys = require('./keys.json');

exports.jwtGenerator = async (req, res) => {
  const client = new JWT({
    email: keys.client_email,
    key: keys.private_key,
    scopes: ['https://www.googleapis.com/auth/dialogflow'],

  });

  const jwt = await client.authorize();
  res.status(200).send(jwt);
};

This goes into package.json:

{
  "dependencies": {
    "google-auth-library": "^7.10.2"
  }
}

And you put the content of your private key json in a new file called keys.json.

Now you can call the function api and you will get a Bearer token that works for the Google API defined in your scope.

ps: still wouldn’t mind having this in n8n, without using another cloud function.

ps2: if you want to secure your function easily, generate some (some random key value) and use this:

const { JWT } = require('google-auth-library');
const keys = require('./keys.json');

exports.jwtGenerator = async (req, res) => {
  const apiKey = '(some random key value)';
  const requestApiKey = req.get('x-api-key');

  if (!requestApiKey || requestApiKey !== apiKey) {
    res.status(403).send('Forbidden: Invalid API Key.');
    return;
  }

  const client = new JWT({
    email: keys.client_email,
    key: keys.private_key,
    scopes: ['https://www.googleapis.com/auth/dialogflow'],
  });

  const jwt = await client.authorize();
  res.status(200).send(jwt);
};

[Jon]

I just use this option…

This then lets me use this service account in the HTTP Request node…

This is a feature that I am currently reviewing the PR for and in theory should be available in a release of n8n very soon.

[Jelle_de_Rijke]

You are making me jealous! That is exactly what I need, but from what I can tell you can’t use the service account with the request node, currently. Right?

[Jon]

Hey @Jelle_de_Rijke,

Yeah at the moment you can’t do it but I suspect this will be available in 0.225.0 next week.

[Loan_J]

Hey @Jon
Thanks for the heads up, that’s exactly what I was looking for as a feature.

[Jon]

Hey @Loan_J,

The good news is the change has been merged so this should be in 0.225.0 next week

[sebasortiz.dev]

@Jelle_de_Rijke

asy to deploy a google cloud function that handles this.

Thank you!! It worked like a charm

[tkey]

Hey team,

I am trying to use the Google Service account with Request node as I need to contact Alert Center API, but I am having problems that the Requests cannot reach the credentials, even through I enabled “Set up for use in HTTP Request node”. Anyone run into this problem as well?

I am using n8n cloud 0.228.2.

BR,
Tomas

[Jon]

Hey @tkey,

That is strange, It was working when I did a test in 0.225.0 before it was released. Are you using credential sharing or anything?

[tkey]

It seems it is somehow caused by sharing of the credentials. The weird thing is that I assigned the permissions to all accounts and still I see the error. But when I created the credential from workspace admin it doesn’t show the error.

[Loan_J]

As someone who uses this method, it works as of today on n8n@latest

[tkey]

Hey team,
I have yet another question as I am still fighting to get it working with GSuite Alert Center API.

I have setup the GSuite service account - it works fine, I validated it via Tines, but I am getting errors from n8n. My first question is about the format of the private key - in the n8n docs it says that since version 0.156 we should remove the \n, but such key return me an error - secretOrPrivateKey must be asymmetric key when using RS256. I tried to put it with \n and it accept it, but I have some error later on.

Could you confirm how should I input the Private key?

My second question is about Impersonate a User option. Is it used to fill in “sub” field in JWT?

Thanks