authentication header vs query parameter in google cloud endpoints

Question

I have tried everything, yet I cannot access my API using google cloud endpoints using a Authentication:Bearer header. According to Cloud Endpoints Docs:

When you send a request using an authentication token, for security reasons, we recommend that you put the token in the Authorization:Bearer header.

it also says:

If you cannot use the header when sending the request, you can put the authentication token in a query parameter called access_token.

I can perfectly access the API using access_token=" +idToken in my URL. However, when I try to send an HTTP request with the Authentication header like this:

const url =
        "https://<PROJECTNAME>.appspot.com/getbalance";
    axios
        .get(url,{headers:{'Authentication':'Bearer '+idToken}})
        .then(response => {
            console.log(response.data);
        })
        .catch(error => {
            console.log(error);
        });

I get this error:

JWT validation failed: Missing or invalid credentials

Is sending the token in a query parameter as safe as sending it in the header?

Answer 1

Your code example shows you setting an Authentication header, not an Authorization header. You should not typically use a query parameter as it will likely get logged in Cloud Console.