Authenticate Service Account for Remote Config REST API using Go

Question

Over here the Firebase docs explain how you can retrieve a token required to make requests to the Remote Config Rest API.

It provides example code for Python, Java and Node.js. Because there is no code for Go, it sends me to the Google Client Library (for Go). You might be able to understand why I am getting lost there...

The examples use GoogleCredential in Java, ServiceAccountCredentials in Python and google.auth.JWT in Node.js. I was not able to find any of those here. I do not know why there are no clear naming conventions.

I have found

firebaseremoteconfig-gen.go: The code looks like it already implements what the Firebase documentation page tries to achieve "manually". Comparison: doc, package.

Help

Because the "Usage example" of the package ends strangely abrupt and is the opposite of extensive, I do not understand how to make use of it.

I would be helped if someone could tell me how I can use this:

firebaseremoteconfigService, err := firebaseremoteconfig.New(oauthHttpClient)

I could not figure out where I would get oauthHttpClient from. There is an oauth2 package in the repository, but there I face the same problem:

oauth2Service, err := oauth2.New(oauthHttpClient)

I need oauthHttpClient again, so this cannot be a solution.
http.Client could be anything, but I need to authenticate with a service-account.json file, like shown in the three example snippets here.

Tags explanation

I hope that someone has either had experience with integrating Firebase Remote Config with Go, someone knows how Google Client API authentication works or someone is good enough with Go to get how the usage works.

Answer 1

There are a couple of main ways of authenticating with the google APIs, they are documented here:

Link to docs

The ways documented are "3-legged OAuth", "Using API Keys" and finally "Service Accounts".

From the links that you've included in the question; you are looking at the Python / Java / Node examples of "Service Accounts".

Using Service Accounts in go

The oauthHttpClient that you are referring to, is an http client that will attach the authentication information to the requests automatically.

You can create one using this package:

https://godoc.org/golang.org/x/oauth2/google

The examples linked in other languages use a "service account json key file".

Using the method linked below, you can read that keyfile and create a jwt.Config struct that will give you access to the client that you need.

https://godoc.org/golang.org/x/oauth2/google#JWTConfigFromJSON

The go equivalent of the other language examples linked is;

data, err := ioutil.ReadFile("/path/to/your-project-key.json")
if err != nil {
    log.Fatal(err)
}
conf, err := google.JWTConfigFromJSON(data, "https://www.googleapis.com/auth/firebase.remoteconfig")
if err != nil {
    log.Fatal(err)
}
// Initiate an http.Client. The following GET request will be
// authorized and authenticated on the behalf of
// your service account.
client := conf.Client(oauth2.NoContext)
client.Get("...")