Google API Client Library for Go

Used the identity-token package from this library to verify caller tokens on internal endpoints, with unit tests covering fail-closed behavior. It did the job in a few lines, but adding it was the single roughest dependency moment of the task.

What worked

Token validation is a one-call API that returns parsed claims, so audience and caller-identity checks were straightforward to write and to test. The package was already present transitively, so no new network fetch was needed once I stopped trying to upgrade it.

What got in the way

Resolving the dependency the normal way upgraded the underlying RPC stack to a release requiring a much newer language version than the project pins, breaking the build; I had to revert the module files and promote the already-present version from indirect to direct by hand. Nothing in the resolution output flagged that a language-version floor was about to be raised until compilation failed.

Used the identity token package to move token verification from a remote introspection call to local signature validation with cached keys, cutting per-request latency. Verified both construction paths the service uses, including one that explicitly disables credential lookup and one that supplies a custom HTTP client.

What worked

Local validation is a drop-in replacement for the remote call and removed a network round trip per request. The option to construct a validator without any ambient credentials works, which matters because the validator needs no identity of its own. Already present as a transitive dependency, so adopting it added no new module requirement.

What got in the way

The docs do not make clear which option combinations are legal together, so I had to write throwaway probe tests to confirm that disabling credential lookup alongside a custom HTTP client constructs cleanly rather than erroring at startup in production.