Verify requests

Requests to your conversational webhook are signed with an authorization token in the header, using the following format:

 google-assistant-signature: "<JWT token>" 

The auth token follows the JSON Web Token format , where the audience field value is equal to the Actions console project ID for the app. To verify the signature, unpack the token and ensure the audience field matches the project ID for the app. You can do this with a JWT-compatible credentials library, like the Google APIs Node.js client , or directly using the Actions on Google Node.js Client Library ConversationOptions#verification option, as shown in the following code snippet:

 const 
  
 { 
 conversation 
 } 
  
 = 
  
 require 
 ( 
 '@assistant/conversation' 
 ); 
 const 
  
 app 
  
 = 
  
 conversation 
 ({ 
 verification 
 : 
  
 'nodejs-cloud-test-project-1234' 
 }); 
 // 
  
 HTTP 
  
 Code 
  
 403 
  
 will 
  
 be 
  
 thrown 
  
 by 
  
 default 
  
 on 
  
 verification 
  
 error 
  
 per 
  
 request 
 . 

The JWT format will be in this format:

{
  "iss": "https://accounts.google.com"
  "aud": [project-id],
  "nbf": number,
  "iat": number,
  "exp": number,
  "jti": string
}