Secure Cloud Functions for Cloud Scheduler


When you deploy cloud function, it shall ask

gcloud functions deploy FUNCTION_NAME
Allow unauthenticated invocations of new function [FUNCTION_NAME]?
(y/N)? N

NOTE: Select N to restrict cloud functions from public/unauthenticated access.

Google Cloud Console - Cloud Functions

Access Google Cloud Console -> Cloud Functions:

Check the FUNCTION NAME and the right panel will show up with PERMISSIONS tab.

If you select Allow unauthenticated invocations = y during deployment, there shall be a Cloud Functions Invoker roles with Members = allUsers.

NOTE: If you want to prevent unauthenticated access, delete allUsers from Cloud Functions Invoker.

If you select Allow unauthenticated invocations = N during deployment, there might not be aCloud Functions Invoker roles at PERMISSIONS tab.

NOTE: Sometimes you might see with inherited attribute under Cloud Functions Invoker if you have a Service Accounts with the IAM Role Cloud Functions Invoker.

Try access the cloud functions (e.g. and you should get the following message.

Error: Forbidden
Your client does not have permission to get URL /FUNCTION_NAME from this server.

Create Service Account

Access Google Cloud Console -> Service accounts:

Click + Create Service Account

  • Service account name: cloud-functions-invoker
  • Description:

Click Create

At Grant this service account access to project (optional), assign the role Cloud Functions Invoker.

At Grant users access to this service account (optional), leave it as it is.

NOTE: Technically, this new service account should appear at Cloud Functions PERMISSIONS tab under Cloud Functions Invoker with inherited attribute. Sometimes the Web UI might not update properly or in-time.

Cloud Scheduler

Access Google Cloud Console -> Cloud Scheduler:

Click Create Job

Click show more

  • Auth header: Add OIDC account
  • Service account:
  • Audience: If you leave if BLACK, it will copy from URL

NOTE: If you use query parameter for URL (e.g., for Audience you must use without query parameter, else authorization will fail).

After created the job, you can click Run Now to test if the authentication work as expected.


❤️ Is this article helpful?

Buy me a coffee ☕ or support my work via PayPal to keep this space 🖖 and ad-free.

Do send some 💖 to @d_luaz or share this article.

✨ By Desmond Lua

A dream boy who enjoys making apps, travelling and making youtube videos. Follow me on @d_luaz

👶 Apps I built

Travelopy - discover travel places in Malaysia, Singapore, Taiwan, Japan.