A Cloud Run application needs a supported Google API using its runtime identity, without a downloaded service-account key. Which approach best fits?

1. Persist an idempotency record tied to the webhook's stable business identifier.
2. Use the attached service account with application default credentials.
3. Honor retry guidance with bounded backoff and a defined failure path.
4. Validate authentication tokens and enforce authorization in the service.