Cloud Run 403 on invoke: run.invoker and the allUsers trap

TL;DR

Meaning: Cloud Run authenticates callers by default.

Steps

1. Your service deploys fine, but curl gets 403.
2. Meaning: Cloud Run authenticates callers by default. The calling identity needs the run.invoker role (roles/run.invoker) on the service. No grant, no entry.
3. Two setups:

• Public service: deploy with --allow-unauthenticated, which grants run.invoker to allUsers. Fine for genuinely public APIs.
• Private service: keep authentication on and grant invoker to the specific caller:

gcloud run services add-iam-policy-binding [SERVICE] --member serviceAccount:[CALLER-SA] --role roles/run.invoker --region [REGION]

4. The caller then sends an identity token (your auth header audience = service URL). An access token will NOT work; Cloud Run wants an ID token.
5. Agent traps:

• Testing with curl and getting 403, then "fixing" it with --allow-unauthenticated on an internal service. You just made it public. Grant the SA instead.
• Service-to-service: the calling Cloud Run service's runtime SA needs invoker on the callee. Fetch an ID token from the metadata server with the callee URL as audience.
• The 403 page says "Forbidden" with no detail by design. Check the service IAM policy; the answer is always there.

6. Verify: gcloud run services get-iam-policy shows the binding, then call with a fresh ID token and get 200.

When to use

You are seeing this: Your service deploys fine, but curl gets 403. Use this skill when you run into "Cloud Run 403 on invoke: run.invoker and the allUsers trap".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26 on the Cloud Run securing docs: invoker role requirement, allUsers binding for public access, ID token (not access token) for authenticated invocation. The audience-must-be-URL rule is documented.