外部 API：使用 Authorization 要求標頭，向第三方 API 進行驗證。請參閱本文的「向外部 API 發出經過驗證的要求」。
Google Cloud API：如要使用 Workflows connector，系統會自動透過工作流程的服務帳戶提供必要驗證。如果無法使用連接器，請透過 OAuth 2.0 發出 HTTP 要求，與其他 Google Cloud API 建立連線。凡是以 .googleapis.com 主機名稱結尾的 API，都接受這種驗證方法。請參閱本文的「向 Google Cloud API 發出經過驗證的要求」。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-11 (世界標準時間)。"],[],[],null,["# Make authenticated requests from a workflow\n\nTo make authenticated HTTP requests, your workflow must be associated with a\nservice account (identified by its email address) that has the appropriate\ncredentials. For more information about attaching an Identity and Access Management (IAM)\nservice account to a workflow, and granting it the permissions required to\naccess resources, see\n[Grant a workflow permission to access Google Cloud resources](/workflows/docs/authentication).\n\nAuthentication tokens\n---------------------\n\nBy default, HTTP requests don't contain identity or access tokens for security\nreasons. You must explicitly add authentication information to your workflow\ndefinition.\n\nTo authenticate between Workflows and an HTTP target that requires such\nauthentication, Workflows uses a token in the authorization\nheader based on the credentials of the service account attached to the workflow,\nand sends the token using HTTPS to the target service. When connecting with\nCloud Run functions or Cloud Run, use an\n[ID token](/docs/authentication/token-types#id) (OIDC). For APIs hosted on\n`googleapis.com`, use an\n[access token](/docs/authentication/token-types#access) (OAuth 2.0).\n\nTo make an authenticated request from within a workflow, do one of the\nfollowing depending on the service you are calling:\n\n- **External APIs** ---Use an `Authorization` request header to authenticate with a\n third-party API. In this document, see\n [Make authenticated requests to external APIs](#authenticate-external-apis).\n\n- **Google Cloud APIs** ---If available, use a Workflows\n [connector](/workflows/docs/connectors), which automatically provides the\n required authentication using the workflow's service account. If you can't\n use a connector, use an HTTP\n request with OAuth 2.0 to connect with other Google Cloud APIs. Any\n API that ends with a hostname of `.googleapis.com` accepts this authentication\n method. In this document, see\n [Make authenticated requests to Google Cloud APIs](#authenticate-apis).\n\n- **Cloud Run functions or Cloud Run** ---Use OIDC to connect\n with Cloud Run or Cloud Run functions. In this document,\n see\n [Make requests to Cloud Run or Cloud Run functions](#auth-requests-run-functions).\n\n- **Private on‑premises, Compute Engine, Google Kubernetes Engine (GKE),\n or other Google Cloud endpoints** ---Use Identity-Aware Proxy (IAP) with OIDC\n to enforce access control policies for your endpoints. For more information,\n see [Invoke private on‑prem, Compute Engine, GKE,\n or other endpoint](/workflows/docs/enable-iap-call-private-endpoints) and\n [learn how to authenticate to an IAP-secured resource from a\n user or service account](/iap/docs/authentication-howto).\n\nMake authenticated requests to external APIs\n--------------------------------------------\n\nIf you're integrating a third-party API, include an `Authorization` request\nheader with the credentials necessary to carry out the authentication. For\nexample, include an ID token in an\n`Authorization: Bearer `\u003cvar translate=\"no\"\u003eID_TOKEN\u003c/var\u003e header in the request to\nthe service. For more information, consult the API provider's documentation.\n\nMake authenticated requests to Google Cloud APIs\n------------------------------------------------\n\n| **Note:** This authentication method is restricted to HTTPS endpoints with a hostname that ends in `.googleapis.com`.\n\nA workflow's service account can generate OAuth 2.0 tokens that the workflow can\nuse to authenticate to any Google Cloud API. When you use this\nauthentication method, the workflow authenticates as its associated service\naccount. To make an HTTP request using the OAuth 2.0 protocol, add an `auth`\nsection to the `args` section of your workflow's definition, after you specify\nthe URL. In this example, a request is sent to the Compute Engine API to stop a\nVM:\n\n\u003cbr /\u003e\n\n### YAML\n\n```yaml\n - step_A:\n call: http.post\n args:\n url: https://compute.googleapis.com/compute/v1/projects/myproject1234/zones/us-central1-b/instances/myvm001/stop\n auth:\n type: OAuth2\n scopes: OAUTH_SCOPE\n \n```\n\n### JSON\n\n```json\n [\n {\n \"step_A\": {\n \"call\": \"http.post\",\n \"args\": {\n \"url\": \"https://compute.googleapis.com/compute/v1/projects/myproject1234/zones/us-central1-b/instances/myvm001/stop\",\n \"auth\": {\n \"type\": \"OAuth2\",\n \"scopes\": \"\u003cvar translate=\"no\"\u003eOAUTH_SCOPE\u003c/var\u003e\"\n }\n }\n }\n }\n ]\n \n```\nThe `scopes` key is optional, but can be used to specify OAuth 2.0 scopes for the token. Replace \u003cvar translate=\"no\"\u003eOAUTH_SCOPE\u003c/var\u003e with a string or list of strings. Space and comma-separated strings are also supported. By default, the value is set to `https://www.googleapis.com/auth/cloud-platform`.\n\n\u003cbr /\u003e\n\nMake requests to Cloud Run functions or Cloud Run\n-------------------------------------------------\n\n| **Note:** This authentication method is restricted to HTTPS endpoints.\n\nWhen making requests to Cloud Run functions or Cloud Run,\nuse OIDC to authenticate.\n\nTo make an HTTP request using OIDC, add an `auth` section to the `args` section\nof your workflow's definition, after you specify the URL. In this example, a\nrequest is sent to invoke a Cloud Run function:\n\n\u003cbr /\u003e\n\n### YAML\n\n```yaml\n - step_A:\n call: http.get\n args:\n url: https://us-central1-project.cloudfunctions.net/functionA\n query:\n firstNumber: 4\n secondNumber: 6\n operation: sum\n auth:\n type: OIDC\n audience: OIDC_AUDIENCE\n \n```\n\n### JSON\n\n```json\n [\n {\n \"step_A\": {\n \"call\": \"http.get\",\n \"args\": {\n \"url\": \"https://us-central1-project.cloudfunctions.net/functionA\",\n \"query\": {\n \"firstNumber\": 4,\n \"secondNumber\": 6,\n \"operation\": \"sum\"\n },\n \"auth\": {\n \"type\": \"OIDC\",\n \"audience\": \"\u003cvar translate=\"no\"\u003eOIDC_AUDIENCE\u003c/var\u003e\"\n }\n }\n }\n }\n ]\n \n```\nThe `audience` key is optional, but can be used to specify the OIDC audience for the token. By default, \u003cvar translate=\"no\"\u003eOIDC_AUDIENCE\u003c/var\u003e is set to the same value as `url`.\n\n\u003cbr /\u003e\n\nNote that it's possible for Workflows to invoke\nCloud Run functions or Cloud Run services that have ingress\nrestricted to internal traffic. With this configuration, your services are\nunreachable from the internet but can be reached from Workflows.\n\nFor more information, see [Invoke Cloud Run functions or Cloud Run](/workflows/docs/calling-run-functions).\n\nWhat's next\n-----------\n\n- [Make an HTTP request](/workflows/docs/http-requests)\n- [Workflows roles and permissions](/workflows/docs/access-control)"]]