Google Cloud Run JWT Token Validator and Refresher - n8n Workflow

Developers building secure integrations with Google Cloud Run services.
n8n users needing reliable, background authentication handling in their main workflows.
Automation specialists looking to implement token refresh logic without writing extensive custom code.
Teams focused on optimizing API quota usage by minimizing unnecessary token requests.

When integrating n8n with secure services like Google Cloud Run, proper authentication management is crucial. Google ID tokens are short-lived, typically expiring every 60 minutes, which can cause workflow failures if not handled proactively. This robust n8n workflow template solves this challenge by serving as an authentication sub-process.

It implements a robust token validation check: if an existing token is provided via the initial n8n trigger, it is decoded. The core logic uses the 'If' n8n node to check the expiration date, adding a 5-minute buffer to ensure the token remains valid throughout subsequent API calls. This efficient reuse prevents unnecessary API calls to the Google authorization endpoint, saving on quota and speeding up overall execution time. If no token is provided, or the token is expiring soon, the n8n workflow automatically signs a new JWT assertion and requests a fresh ID token, ensuring seamless service access.

This efficient n8n workflow is designed to be executed as a sub-workflow, accepting optional inputs for token reuse.

1. Start and Context Setup: The Start n8n trigger accepts idtoken (optional), serviceurl, and servicepath. The Vars n8n node defines static context, including the clientemail (which must be configured) and the Google tokenuri. This data is merged by the Combine Context n8n node.


2. Initial Token Check: The first If Token n8n node checks if an existing idtoken was passed into the n8n workflow.


3. Validation and Decoding: If a token exists, the Decode JWT n8n node verifies its structure and extracts the exp (expiration timestamp) payload.


4. Expiration Buffer Check: The primary If n8n node performs the critical validity check. It uses an advanced expression: (expirationtimestamp * 1000) - 300,000 >= Date.now(). This ensures the token is reused only if it has more than 5 minutes of validity remaining.


5. Token Reuse Path (True Branch): If the token is valid, the Raise Id n8n node passes the existing token forward.


6. Token Refresh Path (False Branch): If no token exists, or the existing token is expiring/expired, the flow proceeds to the Sign New JWT n8n node. This node uses the configured JWT credential (private key) and the necessary claims (iss, aud, exp, targetaudience) to create a new assertion.


7. Request Bearer Token: The signed assertion is sent via the Bearer Token Request n8n node (an HTTP Request) to the Google authorization endpoint, resulting in a fresh ID token.


8. Output: Finally, the Return Values n8n node standardizes the output, providing the valid idtoken (either reused or newly generated), serviceurl, and service_path back to the calling parent n8n workflow.

To deploy and use this powerful n8n workflow template, follow these steps:

1. Import: Copy the entire JSON code and paste it directly into your n8n instance using the 'Import Workflow' feature.


2. Credential Setup: This n8n workflow requires a JWT authentication credential configured with your Google Service Account private key.

1. Integration: This is an auxiliary n8n workflow. Use an 'Execute Workflow' n8n node in your main automation to call this workflow, passing the necessary serviceurl and optionally the previous idtoken for reuse.

Start (Execute Workflow Trigger): Acts as the entry point, defining inputs (idtoken, serviceurl, servicepath) expected from a parent n8n workflow. It is the core n8n trigger for execution.
Vars (Set): A 'Set' n8n node used to define static configuration variables like clientemail and the Google tokenuri for global workflow use.
If Token (If): The first conditional n8n node, checking the existence of an incoming idtoken. This determines whether validation or generation is needed.
Decode JWT (JWT): Decodes the provided idtoken to inspect its payload, specifically extracting the exp (expiration time) required for the crucial logic check.
If (If): This vital decision-making n8n node contains the logic to determine token validity using a 5-minute look-ahead buffer. If the token expires within 5 minutes, it forces a refresh.
Sign New JWT (JWT): When a refresh is required, this n8n node signs a new assertion JWT using the configured private key credential and embeds the targetaudience (serviceurl).
Bearer Token Request (HTTP Request): Sends a POST request to Google’s OAuth endpoint, using the signed JWT assertion to exchange it for the final, usable Bearer idtoken.
Return Values (Set): The final n8n node standardizes the output, packaging the validated or newly generated id_token along with the service endpoints.