Secure Google Cloud Run API Invocation with Service Account - n8n Workflow

• DevOps Engineers and Developers: Needing to securely integrate internal serverless functions (Cloud Run) into business automation processes using an n8n workflow.


• Automation Specialists: Seeking reliable n8n templates for handling complex cloud authentication mechanisms like Google Service Accounts.


• Technical Users: Who need to iterate over large datasets and make secure, authenticated HTTP requests for each item using an n8n node.

When interacting with secure Google Cloud Run services configured to require authentication, a standard HTTP request is insufficient. This sophisticated n8n workflow template solves this challenge by implementing the necessary Google Service Account authentication flow.

This n8n template relies on a dedicated sub-workflow (referenced by the Execute Workflow n8n node) to handle the generation and caching of the ephemeral Google ID Token. This token is essential for invoking the Cloud Run service via an Authorization: Bearer TOKEN> header.

Furthermore, the n8n workflow demonstrates advanced flow control by using Set, Merge, and Split Out n8n nodes to attach the necessary authentication context (idtoken) to every item in an array before iterating and making individual API calls, ensuring high reliability and security throughout the entire execution.

This secure automation process starts with the manual Execute n8n trigger.

1. Configuration: The Vars n8n node defines the necessary endpoint variables, serviceurl and optionally servicepath.


2. Token Generation: The Get Auth n8n node, an Execute Workflow node, calls a dedicated Google Service Auth sub-workflow. This critical component uses the Service Account credentials to generate a valid, time-sensitive Google ID token required for Cloud Run.


3. Context Preparation: Concurrently, the Set Example Context Fields n8n node defines sample data fields (like an arrayofsoups) that need processing.


4. Context Merging: The Collect Context Example Merge n8n node combines the newly retrieved idtoken (from Get Auth) with the data context (from Set Example Context Fields). The authentication details are now tied to the data.


5. Iteration Setup: The Split Out n8n node takes the merged item and splits the arrayofsoups array into multiple individual items, ensuring that the authentication context fields (including the idtoken and service_url) are preserved with every split item.


6. Looping: The Loop Over Items n8n node (a Split In Batches n8n node) processes the items sequentially.


7. Final Authentication Check (Optional): The Check Auth n8n node ensures context variables are correctly passed before the final call.


8. Secure API Call: The Cloud Run Request n8n node executes the HTTP request. It uses dynamic expressions to construct the full URL and applies HTTP Bearer Auth, supplying the Google ID Token obtained earlier as the bearer token to securely invoke the Cloud Run endpoint. The process loops back until all items are processed.

To deploy this secure n8n workflow, follow these steps:

1. Import: Copy the provided JSON into your n8n instance using the 'New' -> 'Import from JSON' function.


2. Sub-Workflow Requirement: This n8n workflow requires a separate 'Service Auth (sub-workflow)' template to handle the token generation. Ensure this sub-workflow is also imported and running, and verify that the Execute Workflow n8n node IDs match.


3. Credential Setup (Google Service Account): You must configure a Google credential of type 'Service Account'.

1. Bearer Auth Credential: Create a generic 'HTTP Bearer Auth' credential. This credential will dynamically receive the ID Token from the workflow flow. You may need to update the credential ID used in the Cloud Run Request n8n node.


2. Configuration: Edit the Vars n8n node and set the serviceurl to your target Google Cloud Run base URL and optionally set the servicepath.


3. Execution: Save the n8n workflow and run it using the Execute n8n trigger.

Execute (Manual Trigger): The starting n8n trigger for manual execution and testing of the n8n workflow.
Vars (Set n8n node): Defines global variables, specifically serviceurl and servicepath, which point to the target Google Cloud Run service endpoint.
Get Auth (Execute Workflow n8n node): Calls the dedicated sub-workflow to retrieve the Google ID token using configured Google Service Account credentials. Key Configuration: Targets Templates — Service Auth (sub-workflow).
Set Example Context Fields (Set n8n node): Demonstrates adding workflow context, including a sample array (arrayofsoups) to be iterated over.
Collect Context Example (Merge n8n node): Combines the authentication token context with the data context, ensuring all items have the required idtoken.
Split Out (Split Out n8n node): Prepares the list for looping by splitting the array field (arrayofsoups) into separate items while including all other fields (crucially, keeping the idtoken, service_url, etc.).
Loop Over Items (Split In Batches n8n node): Manages the iteration process, handling the subsequent API calls one item at a time.
Cloud Run Request (HTTP Request n8n node): Performs the final, secure call to the Cloud Run service. Key Configuration: Uses dynamic URL generation and HTTP Bearer Auth (supplied via the ID token generated earlier in this n8n workflow) for authorization.