The previous code creates a new PropertyKey both in RestApiServlet and GetExternalIds. These two keys are actually different, which must be the same to get the right external id. Add a PropertyKey in CurrentUser to get the external id. It can't be added in IdentifiedUser as the RestApiServlet will be called by anonymous users, too. Change-Id: If1f4a31e3fc2c781c99aad786de4e741ee626e06