Can't stream camera feed to Google Nest devices through the Google Assistant integration

I have several camera entities exposed to Google Assistant set up through Home Assistant cloud (the “automatic” method), but anytime I tell my Google Nest hub to stream a camera, it shows the Home Assistant loading screen, but then fails after about 10-15 seconds.

The Home Assistant Core log shows the following error when that happens:

[homeassistant.components.cast.media_player] Failed to cast media http://<Home Assistant Internal URL>/api/hls/<camera access_token>/master_playlist.m3u8 from internal_url (<Home Assistant Internal URL>). Please make sure the URL is: Reachable from the cast device and either a publicly resolvable hostname or an IP address

The internal URL is using Home Assistant’s LAN IP address and is reachable from the Nest hub, which is on the same network.

If I use the Media menu in Home Assistant to cast a camera to the Nest Hub, it works as expected.

I compared the entity states of the Google Nest hub while trying both methods of streaming, and there is one difference I found:

When I try asking the Nest Hub to stream the camera, the Nest Hub’s media_content_id state attribute shows the same URL in the error message:
media_content_id: http://<Internal URL>/api/hls/<camera access_token>/master_playlist.m3u8

However, when I cast the camera feed from Home Assistant (successfully), the Nest Hub’s media_content_id state attribute shows the same URL in the error message, but with a query parameter called authSig:
media_content_id: http://<Internal URL>/api/hls/<camera access_token>/master_playlist.m3u8?authsig=<long alphanumeric string>

It looks like the Google Assistant integration is missing that authentication token in the URLs, unless it’s authenticating some other way.

Has anyone gotten this to work?

My hip pocket guess, you might need to use the enternal URL or a fully qualified domain address and no self signed stuff.
Google probably doesn’t like that address. (A guess)

I tried changing the URL to my external one, which has a valid SSL cert and it failed the same way. Error message showed the new URL so it seems like it tried it.