How to trigger a Web App from another script? - google-apps-script

Question

I deployed a Google Apps Script Web App which uses a service account to access the Google Directory. I deployed it that everyone has access to the app and that the app runs under the user executing it.
I would like to trigger this web app by calling the POST trigger from another app script which is part of a Google form. Something like this:
function onPost(){
var data = {
'name': 'Bob Smith',
'age': 35,
'pets': ['fido', 'fluffy']
};
var options = {
'method' : 'post',
'contentType': 'application/json',.
'payload' : JSON.stringify(data)
};
var resp = UrlFetchApp.fetch('https://script.google.com/a/my.domain.com/m.../exec', options);
}
However, I get back:
Exception: Request failed for https://script.google.com returned code 401.
When I try to use the GET trigger with some query parameters the response back looks like a google sign in page.
How can I trigger my web app from another app script all in the same domain?
Updated code with token:
function onPost(){
var token = ScriptApp.getOAuthToken();
var data = {
'name': 'Bob Smith',
'age': 35,
'pets': ['fido', 'fluffy']
};
var options = {
'headers':'Bearer '+token,
'method' : 'post',
'contentType': 'application/json',.
'payload' : JSON.stringify(data)
};
var resp = UrlFetchApp.fetch('https://script.google.com/a/my.domain.com/m.../exec', options);
}

Answer 1

The response back looks like a Google sign-in page
This is because you received the 401 Unauthorized HTTP status code prompting you that the request should contain valid user credentials. Since Google primarily uses OAuth 2.0, you will need to include an Authorization header set to Bearer YourTokenHere.
As of recently, the OAuth token can be obtained via getOAuthToken(), which will contain a claim in its payload that will match scopes granted to the application that is making the request (either automatically or explicitly).
You can also use the official OAuth 2.0 library if you need more fine-grained control over token management, or build from scratch if you feel like it, the Utilities class has everything you need for generating a custom JWT.
I deployed it that everyone has access to the app and that the app runs under the user executing it
Web Apps have several deployment modes across two permission settings:
"Execute the app as"
Me
User accessing the web app
"Who has access to the app"
Only myself
Anyone
Anyone, even anonymous
Google won't let you just strip the security and expose a public API (which is a good thing), so if you want everyone to be able to access your Web App without authorization, you will have to authorize the script yourself and let your users access the application under your authority.
Only one combination of options allows you to do that:
Execute as me, access to anyone, even anonymous