Cloud Run Service-to-Service Auth: OIDC Tokens, IAM Conditions, and the Audience Trap
Cloud Run's built-in OIDC identity tokens simplify service-to-service auth, but audience validation, IAM condition limits, and local dev gaps require deliberate design. A worked example shows least-privilege bindings and the metadata server call pattern.