关于GCP API Gateway通配符路径直通连接与OAuth令牌透传的技术咨询

1. Is the wildcard path configuration feasible? #

Absolutely! GCP API Gateway fully supports wildcard path patterns like /myapi/*, which will match all subpaths under /myapi/ (e.g., /myapi/info, /myapi/customer).

Your initial OpenAPI setup is a solid foundation, but you’ll need one critical adjustment to ensure the full request path gets forwarded correctly to your Cloud Run instance: add path_translation: APPEND_PATH_TO_ADDRESS inside the x-google-backend block. Without this, the gateway would send all requests to the root of your Cloud Run URL instead of appending the subpath. Here’s the refined configuration:

paths:
  /myapi/*:
    get:
      summary: Forward GET requests to my-api
      operationId: getMyApi
      x-google-backend:
        address: https://my-api-12345.run.app/
        path_translation: APPEND_PATH_TO_ADDRESS
      responses:
        '200':
          description: OK
    # Repeat for other HTTP methods your backend uses
    post:
      summary: Forward POST requests to my-api
      operationId: postMyApi
      x-google-backend:
        address: https://my-api-12345.run.app/
        path_translation: APPEND_PATH_TO_ADDRESS
      responses:
        '200':
          description: OK

If you want to avoid duplicating config for every HTTP method, use the x-google-any-method extension to cover all methods in one entry:

paths:
  /myapi/*:
    x-google-any-method:
      summary: Forward all requests to my-api
      operationId: proxyMyApi
      x-google-backend:
        address: https://my-api-12345.run.app/
        path_translation: APPEND_PATH_TO_ADDRESS
      responses:
        '200':
          description: OK

This setup exactly implements the "straight through connection" you’re aiming for—acting as a simple proxy for all requests under the wildcard path.

2. How to pass the token through without the gateway processing it? #

To let the gateway forward the Bearer token directly to your backend (without validating it), just remove the security block from your configuration.

The security: - Bearer: [] line tells the API Gateway to validate the OAuth token against your configured auth provider before forwarding the request. By deleting this line, the gateway will ignore the Authorization header entirely and pass it straight to your Cloud Run instance, leaving token validation entirely up to your backend API.

Quick Additional Notes #

• This approach intentionally bypasses the gateway’s built-in auth checks, which aligns with your proxy-only goal. While it deviates from standard OpenAPI practices (where you define explicit endpoints and rules), GCP API Gateway fully supports this proxy mode.
• Cloud Run doesn’t strip incoming request headers by default, so the Authorization header will reach your backend without extra configuration.

内容的提问来源于stack exchange，提问作者Anto