googleapis.com/identitytoolkit/v3/relyingparty/verifyCustomToken returning CREDENTIAL_MISMATCH

问题

Final Goal: create a Firebase Custom Token with local NodeJs, post such Custom Token to googleapis/.../verifyCustomToken and get back an idToken that allow me to post a new document to Firestore as explained in other question

Current achivement: I can successfuly create a Custon Token with this Cloud Function and follow successfully next steps (get an idToken from googleapis/.../verifyCustomToken and post successfully a docuemtn to Firestore). But I need the same from a local server (we are not going to use Cloud Function this time).

Current issue: I get this issue when I try to post the Custom Token generated by local NodeJs to googleapis/.../verifyCustomToken:

{
  "error": {
    "code": 400,
    "message": "CREDENTIAL_MISMATCH",
    "errors": [
      {
        "message": "CREDENTIAL_MISMATCH",
        "domain": "global",
        "reason": "invalid"
      }
    ]
  }
}

Here is the whole NodeJs server:

const admin = require('firebase-admin');

exports.serviceAccount = {
  "type": "service_account",
  "project_id": "angular-firebase-auth0-3c084",
  "private_key_id": "6ba2ba41e0bf3837841aa9772c7d880b7ce3be81",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMI... 9fYKA=\n-----END PRIVATE KEY-----\n".replace(/\\n/g, '\n'),
  "client_email": "firebase-adminsdk-lu97a@angular-firebase-auth0-3c084.iam.gserviceaccount.com",
  "client_id": "114324662014690107039",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/firebase-adminsdk-lu97a%40angular-firebase-auth0-3c084.iam.gserviceaccount.com"
}

 admin.initializeApp({
   credential: admin.credential.cert(exports.serviceAccount)
});

var uid = "NSBFu2YJNDgLQJCZ99dRJlP4DRo2"; //copied from https://console.firebase.google.com/project/firetestjimis/authentication/users
var claim = {
  control: true
};
admin.auth().createCustomToken(uid)
  .then(function (customToken) {
    console.log(customToken)
  })
  .catch(function (error) {
    console.log("Error creating custom token:", error);
  });

I copy the printed token and I try:

curl --location --request POST 'https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyCustomToken?key=AIzaSyDAd03oo5fPgV2l--oMWZ2Y23DCGihK3xs' \
--header 'Content-Type: application/json' \
--data-raw '{"token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJodHRwczovL2lkZW50aXR5dG9vbGtpdC5nb29nbGVhcGlzLmNvbS9nb29nbGUuaWRlbnRpdHkuaWRlbnRpdHl0b29sa2l0LnYxLklkZW50aXR5VG9vbGtpdCIsImlhdCI6MTU4NzQ4NjI0NiwiZXhwIjoxNTg3NDg5ODQ2LCJpc3MiOiJmaXJlYmFzZS1hZG1pbnNkay1sdTk3YUBhbmd1bGFyLWZpcmViYXNlLWF1dGgwLTNjMDg0LmlhbS5nc2VydmljZWFjY291bnQuY29tIiwic3ViIjoiZmlyZWJhc2UtYWRtaW5zZGstbHU5N2FAYW5ndWxhci1maXJlYmFzZS1hdXRoMC0zYzA4NC5pYW0uZ3NlcnZpY2VhY2NvdW50LmNvbSIsInVpZCI6Ik5TQkZ1MllKTkRnTFFKQ1o5OWRSSmxQNERSbzIifQ.fSe8ONIHBgoeVg4OkTSemykq4RoFb5TOiHOq52zKiiXCfywmdGAtqZyAWfM_dz-knP4mbSyJM9N3T2A_GQ0fV6AGTlq3lalDaptQPfYX4B7MOiA6YODJSDXGyGVHbdF88MmtNzESszbivF7RoFTBanyawVa9dwy83-84_2nJHylqmq055oFurd-WkM-gnfjyRBvGzQmZp7l76dV1rzRiKg8_ctiO8SOwD84KriXQj6DL-LFze7wb6XJSCJ52epXH0FvjALsB4R1eqCDHAJ3COfEYWiE0Vn5LWhj6yFvtSG3vqLqXy79EDkoXVPw0IJNiBSE4e3gfmat12M9peJEoTw","returnSecureToken":true}'

and then result to CREDENTIAL_MISMATCH.

In case it is relevant, if I generated the Custom Token from this Cloud Funtion I can post successfully to verifyCustomToken

import * as functions from 'firebase-functions';
import * as admin from "firebase-admin";

export const getCustomToken = functions.https.onRequest((request, response) => {
    if (admin.apps.length < 1) {   //Checks if app already initialized
        admin.initializeApp();
    }
    const uid = "NSBFu2YJNDgLQJCZ99dRJlP4DRo2"; 

    admin.auth().createCustomToken(uid)
        .then(function (customToken) {
            console.log(customToken.toString);
            response.send(customToken);
        })
        .catch(function (error) {
            console.log("Error creating custom token:", error);
        });
});

回答1:

Make sure the API key sent in the URL came from the same project as the service account used to mint the custom token.

来源：https://stackoverflow.com/questions/61348847/googleapis-com-identitytoolkit-v3-relyingparty-verifycustomtoken-returning-crede