diff --git a/appengine/standard_python3/building-an-app/building-an-app-3/main.py b/appengine/standard_python3/building-an-app/building-an-app-3/main.py
index 0d953d83745..b9294601cac 100644
--- a/appengine/standard_python3/building-an-app/building-an-app-3/main.py
+++ b/appengine/standard_python3/building-an-app/building-an-app-3/main.py
@@ -16,6 +16,8 @@
 
 # [START gae_python38_auth_verify_token]
 # [START gae_python3_auth_verify_token]
+import os
+
 from flask import Flask, render_template, request
 from google.auth.transport import requests
 from google.cloud import datastore
@@ -64,7 +66,9 @@ def root():
             # session store (see for instance
             # http://flask.pocoo.org/docs/1.0/quickstart/#sessions).
             claims = google.oauth2.id_token.verify_firebase_token(
-                id_token, firebase_request_adapter
+                id_token,
+                firebase_request_adapter,
+                audience=os.environ.get("GOOGLE_CLOUD_PROJECT"),
             )
         except ValueError as exc:
             # This will be raised if the token is expired or any other
diff --git a/appengine/standard_python3/building-an-app/building-an-app-4/main.py b/appengine/standard_python3/building-an-app/building-an-app-4/main.py
index 464d256f10e..22505198a1b 100644
--- a/appengine/standard_python3/building-an-app/building-an-app-4/main.py
+++ b/appengine/standard_python3/building-an-app/building-an-app-4/main.py
@@ -13,6 +13,7 @@
 # limitations under the License.
 
 import datetime
+import os
 
 from flask import Flask, render_template, request
 from google.auth.transport import requests
@@ -71,7 +72,9 @@ def root():
             # session store (see for instance
             # http://flask.pocoo.org/docs/1.0/quickstart/#sessions).
             claims = google.oauth2.id_token.verify_firebase_token(
-                id_token, firebase_request_adapter
+                id_token,
+                firebase_request_adapter,
+                audience=os.environ.get("GOOGLE_CLOUD_PROJECT"),
             )
 
             store_time(claims["email"], datetime.datetime.now(tz=datetime.timezone.utc))