Verifying requests (Dialogflow)
Stay organized with collections
Save and categorize content based on your preferences.
Requests to your conversational webhook are signed with an authorization token
in the header, using the following format:
authorization: "<JWT token>"
The auth token follows the JSON Web Token format,
where the audience field value is equal to the Actions Console project ID for
the app. To verify the signature, unpack the token and ensure the audience field
matches the project ID for the app. This can be done with a JWT-compatible
credentials library, like the Google APIs Node.js client,
or directly using the Actions on Google Node.js Client Library
ActionsSdkOptions#verification option.
const {actionssdk} = require('actions-on-google');
const app = actionssdk({verification: 'nodejs-cloud-test-project-1234'});
// HTTP Code 403 will be thrown by default on verification error per request.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-09-18 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2024-09-18 UTC."],[[["Conversational webhook requests are signed with a JWT token in the authorization header for security."],["The JWT token's audience field should match your Actions Console project ID for verification."],["You can verify the token using JWT libraries or the Actions on Google Node.js Client Library's built-in verification option."]]],[]]
