Verify requests

  • Conversational webhook requests include an authorization token in the google-assistant-signature header for security purposes.

  • This token is a JSON Web Token (JWT) containing an audience field that matches your Actions console project ID, enabling verification.

  • You can verify the signature using a JWT library or the ConversationOptions#verification setting within the Actions on Google Node.js Client Library.

  • The JWT structure includes standard fields like issuer, audience, issue and expiration timestamps, and a unique identifier.

Requests to your conversational webhook are signed with an authorization token in the header, using the following format:

google-assistant-signature: "<JWT token>"

The auth token follows the JSON Web Token format, where the audience field value is equal to the Actions console project ID for the app. To verify the signature, unpack the token and ensure the audience field matches the project ID for the app. You can do this with a JWT-compatible credentials library, like the Google APIs Node.js client, or directly using the Actions on Google Node.js Client Library ConversationOptions#verification option, as shown in the following code snippet:

const {conversation} = require('@assistant/conversation');

const app = conversation({verification: 'nodejs-cloud-test-project-1234'});
// HTTP Code 403 will be thrown by default on verification error per request.

The JWT format will be in this format:

{
  "iss": "https://accounts.google.com"
  "aud": [project-id],
  "nbf": number,
  "iat": number,
  "exp": number,
  "jti": string
}