# Serverless tip #5 — How to invoke a secured Cloud Run service locally

> Easily invoke your secured Cloud Run service locally for testing; this guide shows how to authenticate with gcloud identity tokens.

Author: [Guillaume Laforge](https://glaforge.dev/) | Published: 2019-12-11 | Topics: serverless, google-cloud, cloud-run, tips | Canonical: https://glaforge.dev/posts/2019/12/11/serverless-tip-5-how-to-invoke-a-secured-cloud-run-service-locally/


Requirements:

-   an existing Google Cloud Platform account with a project
-   you have enabled the Cloud Run service and already deployed a container image
-   your local environment's gcloud is already configured to point at your GCP project

By default, when you deploy a [Cloud Run](https://cloud.run/) service, it is secured by default, unless you use the --allow-unauthenticated flag when using the gcloud command-line (or the appropriate checkbox on the Google Cloud Console).

But once deployed, if you want to call it locally from your development machine, for testing purpose, you'll have to be authenticated.

If you look at the Cloud Console, alongside the URL of the service, you can hover the little icon next to the URL, and you'll see the a pop-up showing how you can invoke that service with a curl command:

![](/img/serverless-tips/st5-cr-call-authenticated-service.png)

```bash
curl -H \
    "Authorization: Bearer $(gcloud auth print-identity-token)" \
    https://authenticated-x2rq3lgmra-uc.a.run.app
```

Note how a bearer token generated by the gcloud command is passed as header to the curl request.

More information

-   [https://cloud.run](https://cloud.run/), the serverless container platform
-   [Authentication overview documentation](https://cloud.google.com/run/docs/authenticating/overview)
-   [Unauthenticated invocations](https://cloud.google.com/run/docs/authenticating/public) of your services
-   [gcloud auth print-identity-token](https://cloud.google.com/sdk/gcloud/reference/auth/print-identity-token)