Pubsub API unauthenticated error on AppEngine

[Jake Hall]

I've written a microservice using the nestjs architecture (specifically based on https://github.com/crallen/nestjs-google-pubsub). Locally i'm running this using cloud code and its working fine, however when I deploy the service to App Engine I get the following error when I tries to subscribe to the pubsub topics.

at processTicksAndRejections (node:internal/process/task_queues:78:11)

at /workspace/node_modules/@grpc/grpc-js/build/src/call-stream.js:187:78)

at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:328:181)

at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:365:141)

at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client.js:189:52)

at Object.callErrorFromStatus (/workspace/node_modules/@grpc/grpc-js/build/src/call.js:31:26)

[PubSubServer] [Error: 16 UNAUTHENTICATED: Failed to retrieve auth metadata with error: Could not refresh access token: Unsuccessful response status code. Request failed with status code 500

I've granted the app engine service account the PubSub Editor role, is there an additional role it needs or is the PubSub API not properly setup to use the service account in app engine via ADC and I need to explicitly set the GOOGLE_APPLICATION_CREDENTIALS? Thanks for your attention.

[Jose Gutierrez Paliza]

What you need to set is the Verification Token you can see here[1] how to set it in App Engine.

[1]https://cloud.google.com/appengine/docs/flexible/nodejs/writing-and-responding-to-pub-sub-messages#creating_a_topic_and_subscription 

[Jake Hall]

Thanks, I'm not sure this is the issue however.  If I manually set the service account by uploading a service.account.json file and passing it in explicitly to the PubSub({ keyFileName: 'service.account.json'}) the subscription works when run on app engine.  Currently I'm unable to subscribe at all to a topic.  We also get the same error when we attempt to publish to a topic unless I explicitly pass the service account to the PubSub constructor.

Jake

[Raul Saucedo Ramirez]

You can check the logs and see if you have an error description or use monitoring to see if you have a warning or error.