zuplo 6.72.3 → 6.72.8

package/docs/policies/upstream-aws-federated-auth-inbound/intro.md

@@ -0,0 +1,20 @@
+Authenticate to AWS upstreams with **no stored AWS keys** using Workload
+Identity Federation. This policy exchanges Zuplo's ambient OIDC identity for an
+IAM role's short-lived temporary credentials via STS AssumeRoleWithWebIdentity,
+and makes them available to the AWS Lambda handler and to custom code, which
+sign upstream requests with AWS Signature Version 4.
+
+With this policy, you'll benefit from:
+
+- **No Long-Lived Secrets**: No AWS access keys are stored anywhere — the
+  gateway proves its identity with a short-lived, audience-bound OIDC token
+- **Least Privilege**: Assume a specific IAM role whose trust policy trusts only
+  the Zuplo OIDC identity provider
+- **Automatic Token Management**: Temporary credentials are cached in memory and
+  refreshed before they expire
+- **Reusable Credentials**: Resolve credentials once and use them from the AWS
+  Lambda handler or your own code via `AwsClient.fromContext(context)`
+
+To set this up you configure an IAM OIDC identity provider that trusts Zuplo's
+issuer, and an IAM role whose trust policy permits AssumeRoleWithWebIdentity for
+that provider.

package/docs/policies/upstream-aws-federated-auth-inbound/schema.json

@@ -0,0 +1,104 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-aws-federated-auth-inbound.json",
+  "type": "object",
+  "title": "Upstream AWS Federated Auth",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": true,
+  "isInternal": false,
+  "isBeta": true,
+  "isHidden": false,
+  "requiresAI": false,
+  "products": ["api-gateway"],
+  "description": "Resolves AWS credentials with STS AssumeRoleWithWebIdentity using Zuplo's ambient OIDC identity — no AWS keys are stored anywhere. The role's trust policy must trust the Zuplo OIDC identity provider. Resolved credentials are registered on the request context for the AWS Lambda handler and custom code to sign upstream requests with `AwsClient.fromContext`. This policy does not itself sign or forward the request.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "UpstreamAwsFederatedAuthInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "UpstreamAwsFederatedAuthInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["roleArn", "region"],
+          "properties": {
+            "roleArn": {
+              "type": "string",
+              "examples": ["arn:aws:iam::123456789012:role/zuplo-gateway"],
+              "description": "The IAM role to assume with STS AssumeRoleWithWebIdentity. The role's trust policy must trust the Zuplo OIDC identity provider."
+            },
+            "region": {
+              "type": "string",
+              "examples": ["us-east-1"],
+              "description": "The AWS region used for the STS endpoint and as the default signing region for consumers of the resolved credentials."
+            },
+            "audience": {
+              "type": "string",
+              "default": "sts.amazonaws.com",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The audience ('aud' claim) of the Zuplo-issued OIDC token. Must match a client ID configured on the IAM OIDC identity provider."
+            },
+            "roleSessionName": {
+              "type": "string",
+              "default": "zuplo-gateway",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The STS role session name recorded in AWS CloudTrail. Must match the pattern \\[\\\\w+=,.@-\\]{2,64}."
+            },
+            "durationSeconds": {
+              "type": "number",
+              "default": 3600,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value."
+            },
+            "stsEndpoint": {
+              "type": "string",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China."
+            },
+            "tokenRetries": {
+              "type": "number",
+              "default": 3,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The number of times to retry fetching temporary credentials in the event of a failure."
+            },
+            "expirationOffsetSeconds": {
+              "type": "number",
+              "default": 300,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The number of seconds before credential expiration at which cached credentials are discarded and refreshed."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "UpstreamAwsFederatedAuthInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "region": "us-east-1",
+            "roleArn": "arn:aws:iam::123456789012:role/zuplo-gateway"
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/upstream-aws-service-auth-inbound/doc.md

@@ -0,0 +1,89 @@
+## Overview
+
+The Upstream AWS Service Auth policy resolves AWS credentials and registers them
+on the request context. Unlike the other upstream auth policies, it does **not**
+add an `Authorization` header itself — AWS Signature Version 4 signs the exact
+final request (method, host, path, query and body hash), which is only known
+inside the handler. Instead, the AWS Lambda handler and your own code read the
+resolved credentials and sign the requests they build.
+
+There are two modes:
+
+- **Static credentials** — the configured `accessKeyId` / `secretAccessKey`
+  (and optional `sessionToken`) are used directly.
+- **Assumed role** — when `roleArn` is set, the policy calls STS `AssumeRole`
+  (signed with the configured keys) and uses the role's short-lived temporary
+  credentials. These are cached in memory and refreshed before they expire.
+
+## Using the credentials
+
+### With the AWS Lambda handler
+
+Attach this policy to a route whose handler is `awsLambdaHandler`, and omit the
+handler's own `accessKeyId` / `secretAccessKey`. The handler will use the
+credentials resolved by the policy.
+
+```json
+{
+  "paths": {
+    "/lambda/{path}*": {
+      "x-zuplo-route": {
+        "handler": {
+          "export": "awsLambdaHandler",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "region": "us-east-1",
+            "functionName": "my-function"
+          }
+        },
+        "policies": { "inbound": ["upstream-aws-service-auth"] }
+      }
+    }
+  }
+}
+```
+
+### With custom code (for example, API Gateway with IAM auth, or S3)
+
+Attach the policy, then sign outbound requests with `AwsClient.fromContext`:
+
+```typescript
+import { AwsClient } from "@zuplo/runtime/aws";
+import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
+
+export default async function (request: ZuploRequest, context: ZuploContext) {
+  const aws = AwsClient.fromContext(context, {
+    service: "execute-api",
+    region: "us-east-1",
+  });
+  return aws.fetch(
+    "https://abc123.execute-api.us-east-1.amazonaws.com/prod/orders"
+  );
+}
+```
+
+If a route does not attach the policy, you can run it on demand from custom code
+with `await context.invokeInboundPolicy("upstream-aws-service-auth", request)`
+before calling `AwsClient.fromContext`.
+
+## Configuration
+
+```json
+{
+  "name": "upstream-aws-service-auth",
+  "policyType": "upstream-aws-service-auth",
+  "handler": {
+    "export": "UpstreamAwsServiceAuthInboundPolicy",
+    "module": "$import(@zuplo/runtime)",
+    "options": {
+      "accessKeyId": "$env(AWS_ACCESS_KEY_ID)",
+      "secretAccessKey": "$env(AWS_SECRET_ACCESS_KEY)",
+      "region": "us-east-1",
+      "roleArn": "arn:aws:iam::123456789012:role/my-gateway-role"
+    }
+  }
+}
+```
+
+Store `accessKeyId` and `secretAccessKey` in environment variables using
+`$env(...)` — never commit them to source.

package/docs/policies/upstream-aws-service-auth-inbound/intro.md

@@ -0,0 +1,19 @@
+Authenticate to AWS upstreams using an IAM access key pair, optionally exchanged
+for an IAM role's temporary credentials via STS AssumeRole. This policy resolves
+AWS credentials and makes them available to the AWS Lambda handler and to custom
+code, which sign upstream requests with AWS Signature Version 4.
+
+With this policy, you'll benefit from:
+
+- **Reusable Credentials**: Resolve AWS credentials once and use them from the
+  AWS Lambda handler or your own code via `AwsClient.fromContext(context)`
+- **Role Assumption**: Optionally assume an IAM role (STS AssumeRole) to obtain
+  short-lived, least-privilege temporary credentials
+- **Automatic Token Management**: Temporary credentials are cached in memory and
+  refreshed before they expire
+- **Credential Security**: Store access keys securely in your Zuplo environment
+  and keep them out of source control
+
+To avoid storing any long-lived AWS keys at all, use the
+`upstream-aws-federated-auth` policy instead, which uses Workload Identity
+Federation.

package/docs/policies/upstream-aws-service-auth-inbound/schema.json

@@ -0,0 +1,121 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-aws-service-auth-inbound.json",
+  "type": "object",
+  "title": "Upstream AWS Service Auth",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": true,
+  "isInternal": false,
+  "isBeta": true,
+  "isHidden": false,
+  "requiresAI": false,
+  "products": ["api-gateway"],
+  "description": "Resolves AWS credentials from static access keys (optionally exchanged for an IAM role's temporary credentials via STS AssumeRole) and registers them on the request context. The AWS Lambda handler and custom code read them with `AwsClient.fromContext` to sign upstream requests. This policy does not itself sign or forward the request.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "UpstreamAwsServiceAuthInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "UpstreamAwsServiceAuthInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["accessKeyId", "secretAccessKey", "region"],
+          "properties": {
+            "accessKeyId": {
+              "type": "string",
+              "examples": ["$env(AWS_ACCESS_KEY_ID)"],
+              "description": "The AWS access key ID. Store the value in an environment variable rather than in source."
+            },
+            "secretAccessKey": {
+              "type": "string",
+              "examples": ["$env(AWS_SECRET_ACCESS_KEY)"],
+              "description": "The AWS secret access key. Always store this in an environment variable."
+            },
+            "region": {
+              "type": "string",
+              "examples": ["us-east-1"],
+              "description": "The AWS region. Used for the STS endpoint when 'roleArn' is set, and as the default signing region for consumers of the resolved credentials."
+            },
+            "sessionToken": {
+              "type": "string",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The AWS session token, required only when the configured access key pair is itself a temporary credential."
+            },
+            "roleArn": {
+              "type": "string",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "An IAM role to assume using STS AssumeRole with the configured access keys. When set, the resolved credentials are the role's temporary credentials instead of the static keys."
+            },
+            "externalId": {
+              "type": "string",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The external ID to pass to STS AssumeRole when the role's trust policy requires one."
+            },
+            "roleSessionName": {
+              "type": "string",
+              "default": "zuplo-gateway",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The STS role session name recorded in AWS CloudTrail. Must match the pattern \\[\\\\w+=,.@-\\]{2,64}."
+            },
+            "durationSeconds": {
+              "type": "number",
+              "default": 3600,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value."
+            },
+            "stsEndpoint": {
+              "type": "string",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China."
+            },
+            "tokenRetries": {
+              "type": "number",
+              "default": 3,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The number of times to retry fetching temporary credentials in the event of a failure."
+            },
+            "expirationOffsetSeconds": {
+              "type": "number",
+              "default": 300,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The number of seconds before credential expiration at which cached credentials are discarded and refreshed."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "UpstreamAwsServiceAuthInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "accessKeyId": "$env(AWS_ACCESS_KEY_ID)",
+            "region": "us-east-1",
+            "secretAccessKey": "$env(AWS_SECRET_ACCESS_KEY)"
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/upstream-azure-ad-service-auth-inbound/schema.json

@@ -41,12 +41,12 @@
           "properties": {
             "activeDirectoryTenantId": {
               "type": "string",
-              "examples": ["b8e4141e-31f4-43e3-9a96-f97f3eba1eea"],
+              "examples": ["11111111-1111-1111-1111-111111111111"],
               "description": "Azure Active Directory Tenant ID."
             },
             "activeDirectoryClientId": {
               "type": "string",
-              "examples": ["20edbb34-13e9-42d0-a63c-1b6a0a20d02d"],
+              "examples": ["22222222-2222-2222-2222-222222222222"],
               "description": "The Application (client) ID of the Azure AD App Registration."
             },
             "activeDirectoryClientSecret": {
@@ -57,11 +57,13 @@
             "tokenRetries": {
               "type": "number",
               "default": 3,
-              "description": "The number of times to retry fetching the token in the event of a failure.."
+              "x-advanced": true,
+              "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             }
           }
@@ -72,9 +74,9 @@
           "export": "UpstreamAzureAdServiceAuthInboundPolicy",
           "module": "$import(@zuplo/runtime)",
           "options": {
-            "activeDirectoryClientId": "20edbb34-13e9-42d0-a63c-1b6a0a20d02d",
+            "activeDirectoryClientId": "22222222-2222-2222-2222-222222222222",
             "activeDirectoryClientSecret": "$env(ACTIVE_DIRECTORY_CLIENT_SECRET)",
-            "activeDirectoryTenantId": "b8e4141e-31f4-43e3-9a96-f97f3eba1eea",
+            "activeDirectoryTenantId": "11111111-1111-1111-1111-111111111111",
             "expirationOffsetSeconds": 300,
             "tokenRetries": 3
           }

package/docs/policies/upstream-firebase-admin-auth-inbound/schema.json

@@ -43,11 +43,13 @@
             "tokenRetries": {
               "type": "number",
               "default": 3,
+              "x-advanced": true,
               "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             }
           }

package/docs/policies/upstream-firebase-user-auth-inbound/schema.json

@@ -49,6 +49,11 @@
               "type": "string",
               "description": "The property on the incoming request.user object to retrieve the value of the userId."
             },
+            "webApiKey": {
+              "type": "string",
+              "examples": ["$env(WEB_API_KEY)"],
+              "description": "The Firebase Web API Key (found in project settings)"
+            },
             "developerClaims": {
               "type": "object",
               "tsType": "Record<string, string | number | boolean | null>",
@@ -73,21 +78,19 @@
                   "premium": true
                 }
               ],
+              "x-advanced": true,
               "description": "Additional claims to include in the custom token's payload."
             },
-            "webApiKey": {
-              "type": "string",
-              "examples": ["$env(WEB_API_KEY)"],
-              "description": "The Firebase Web API Key (found in project settings)"
-            },
             "tokenRetries": {
               "type": "number",
               "default": 3,
+              "x-advanced": true,
               "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             }
           }

package/docs/policies/upstream-gcp-federated-auth-inbound/doc.md

@@ -130,9 +130,9 @@ With GCP Workload Federation setup, you can add the policy to your Zuplo API.
     "module": "$import(@zuplo/runtime)",
     "export": "UpstreamGcpFederatedAuthInboundPolicy",
     "options": {
-      "audience": "https://test-basic-vhpkl3cvtq-uc.a.run.app",
+      "audience": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app",
       "serviceAccountEmail": "zup-api@my-project.iam.gserviceaccount.com",
-      "workloadIdentityProvider": "projects/932049231233/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
+      "workloadIdentityProvider": "projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
     }
   }
 }

package/docs/policies/upstream-gcp-federated-auth-inbound/schema.json

@@ -41,7 +41,7 @@
           "properties": {
             "audience": {
               "type": "string",
-              "examples": ["https://hello-k7meruiynq-uc.a.run.app"],
+              "examples": ["https://my-backend-api-a1b2c3d4e5-uc.a.run.app"],
               "description": "The audience for the minted JWT. This is typically the URL of your service. See the document [AuthRequirement](https://cloud.google.com/endpoints/docs/grpc-service-config/reference/rpc/google.api#google.api.AuthRequirement) for details."
             },
             "serviceAccountEmail": {
@@ -52,30 +52,34 @@
             "workloadIdentityProvider": {
               "type": "string",
               "examples": [
-                "projects/932049231233/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
+                "projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
               ]
             },
             "tokenLifetime": {
               "type": "number",
               "x-show-example": false,
               "default": 3600,
+              "x-advanced": true,
               "description": "The lifetime in seconds of the issued token."
             },
             "tokenRetries": {
               "type": "number",
               "x-show-example": false,
               "default": 3,
+              "x-advanced": true,
               "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "x-show-example": false,
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             },
             "useMemoryCacheOnly": {
               "type": "boolean",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "This is an advanced option that should only be used if you do not want to persist information in ZoneCache."
             }
           }
@@ -86,9 +90,9 @@
           "export": "UpstreamGcpFederatedAuthInboundPolicy",
           "module": "$import(@zuplo/runtime)",
           "options": {
-            "audience": "https://hello-k7meruiynq-uc.a.run.app",
+            "audience": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app",
             "serviceAccountEmail": "zup-api@my-project.iam.gserviceaccount.com",
-            "workloadIdentityProvider": "projects/932049231233/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
+            "workloadIdentityProvider": "projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/my-provider"
           }
         }
       ]

package/docs/policies/upstream-gcp-service-auth-inbound/doc.md

@@ -50,7 +50,7 @@ protected by Identity Aware Proxy (IAP), use the `audience` property:
   "export": "UpstreamGcpServiceAuthInboundPolicy",
   "module": "$import(@zuplo/runtime)",
   "options": {
-    "audience": "https://my-app-1235.a.run.app",
+    "audience": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app",
     "serviceAccountJson": "$env(GCP_SERVICE_ACCOUNT)"
   }
 }
@@ -59,7 +59,7 @@ protected by Identity Aware Proxy (IAP), use the `audience` property:
 **Audience Values:**
 
 - For **Cloud Run**: Use the full URL of your Cloud Run service (e.g.,
-  `https://my-service.a.run.app`)
+  `https://my-backend-api-a1b2c3d4e5-uc.a.run.app`)
 - For **Identity Aware Proxy**: Use the Client ID of your OAuth application
 - For **Cloud Functions**: Use the full URL of your function
 
@@ -109,7 +109,7 @@ Apply the policy to routes that need to access your Cloud Run service:
             "export": "forwardToOrigin",
             "module": "$import(@zuplo/runtime)",
             "options": {
-              "baseUrl": "https://my-service-1235.a.run.app"
+              "baseUrl": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app"
             }
           }
         }

package/docs/policies/upstream-gcp-service-auth-inbound/schema.json

@@ -37,8 +37,8 @@
           "properties": {
             "audience": {
               "type": "string",
-              "examples": ["https://my-service-a2ev-uc.a.run.app"],
-              "description": "The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-service-a2ev-uc.a.run.app'. If calling a Google API, leave this empty."
+              "examples": ["https://my-backend-api-a1b2c3d4e5-uc.a.run.app"],
+              "description": "The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-backend-api-a1b2c3d4e5-uc.a.run.app'. If calling a Google API, leave this empty."
             },
             "scopes": {
               "type": "array",
@@ -57,17 +57,20 @@
               "type": "number",
               "x-show-example": false,
               "default": 3,
+              "x-advanced": true,
               "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "x-show-example": false,
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             },
             "useMemoryCacheOnly": {
               "type": "boolean",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "This is an advanced option that should only be used if you do not want to persist information in ZoneCache."
             },
             "version": {
@@ -75,12 +78,14 @@
               "default": 1,
               "enum": [1, 2],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The version of the policy."
             },
             "enableSuspiciousHeaderWarning": {
               "type": "boolean",
               "default": true,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "When `true` (the default), emits a warning if the inbound request carries headers like `X-Serverless-Authorization` or `X-Goog-IAP-JWT-Assertion`. Forwarding those to a downstream Cloud Run typically causes a `the access token could not be verified` 401 because Cloud Run prefers `X-Serverless-Authorization` over `Authorization` for IAM checks. Set this to `false` only if you have intentionally chosen to forward those headers (e.g. the upstream service is also IAP-fronted and expects them) — the warning is otherwise a useful diagnostic signal."
             }
           }
@@ -91,7 +96,7 @@
           "export": "UpstreamGcpServiceAuthInboundPolicy",
           "module": "$import(@zuplo/runtime)",
           "options": {
-            "audience": "https://my-service-a2ev-uc.a.run.app",
+            "audience": "https://my-backend-api-a1b2c3d4e5-uc.a.run.app",
             "scopes": ["https://www.googleapis.com/auth/cloud-platform"],
             "serviceAccountJson": "$env(SERVICE_ACCOUNT_JSON)"
           }