AppIdentityError: Wrong recipient while verifying Bearer token

0
votes

We are using One Click Action Email Markup in our application. Our email has been white-listed the email id ([email protected]) from which we are sending the emails.

We are getting AppIdentityError: Wrong recipient, when we try to verify the Bearer Token. Complete stacktrace:

File "./app/components/happier_pages/py/lib/oauth2client/util.py", line 142, in positional_wrapper return wrapped(*args, **kwargs) File "./app/components/happier_pages/py/lib/oauth2client/client.py", line 1706, in verify_id_token return crypt.verify_signed_jwt_with_certs(id_token, certs, audience) File "./app/components/happier_pages/py/lib/oauth2client/crypt.py", line 170, in verify_signed_jwt_with_certs (aud, audience, json_body)) AppIdentityError: Wrong recipient, "domain.com" != "service-account-id" {"iss":"accounts.google.com","aud":"mydomain.com","sub":"1234556789","email_verified":true,"azp":"[email protected]","id":"123456789","verified_email":true,"email":"[email protected]","cid":"[email protected]","iat":123,"exp":123}

Below is code snippet for verifying bearer token:

GMAIL_ISSUEE = '[email protected]'
GOOGLE_API_CLIENT_SERVICE_ID = '[email protected]'
BEARER_TOKEN=self.request.headers["Authorization"].split('Bearer ')[1]
token = client.verify_id_token(BEARER_TOKEN.strip(), GOOGLE_API_CLIENT_SERVICE_ID)

The above code is extracted from https://developers.google.com/gmail/markup/actions/verifying-bearer-tokens:

1
pythongoogle-app-engineoauth-2.0google-schemas
Are you literally seeing "mydomain.com" in the response token? Or are you seeing your sender domain? Because you should see your domain as the audience. – Franco
@Franco we are seeing the sender domain. But while verifying it throws AppIdentityError: Wrong recipient – Kartik Domadiya
We are seeing our sender domain.But required client service id as a audience while verifying Bearer Token. – Sagar Kanabar
Make sure your code follows the documentation (developers.google.com/gmail/markup/actions/…) Instead of doing: client.verify_id_token(BEARER_TOKEN, GOOGLE_API_CLIENT_SERVICE_ID) Use the sender domain as the intended audience like so: client.verify_id_token(BEARER_TOKEN, "yourdomain.com") Once you've tried that and are still running into errors, provide the trace of the new error. – Franco
@Franco Using the sender domain as the intended audience, its working fine.Thanks. – Sagar Kanabar

1 Answers

2
votes

@Sagar has confirmed this has worked.

Instead of:

client.verify_id_token(BEARER_TOKEN, GOOGLE_API_CLIENT_SERVICE_ID)

Use the sender domain as the intended audience: 

client.verify_id_token(BEARER_TOKEN, "yourdomain.com")