I followed the quickstart example to integrate my django app with google calendar. The difference from quickstart to my situation is that i just want to generate a URL and send it back to my user, through
from google_auth_oauthlib.flow import InstalledAppFlow
SCOPES = ['https://www.googleapis.com/auth/calendar']
flow = InstalledAppFlow.from_client_secrets_file(f"{PATH_TO_FILE}/{CLIENT_SECRET_FILE}", SCOPES)
(auth_url, state) = flow.authorization_url()
if is_dev():
auth_url += '&redirect_uri=http%3A%2F%2Flocalhost%3A43759%2F'
print(auth_url)
(OBS: I added this is_dev option, because no redirect_uri was not considered)
I get this printed URL and get this steps:
1- The URL from auth_url printed when i ran the program
2- After choosing my user
3- and BAM, I cant proceed (i am redirected to localhost:47759 and cant access)
What should I do?
we wen't through one solution, that 3 steps are important to talk about.
1- Create a new credential on Google Cloud, OAuth 2.0 Client ID for Web Application, as js origins with my local url, and another redirect URL authorized (this redirect solved the number 3 error for the question)
2- Also I read some examples about, and to get the user authorization, we send him an URL, if everything goes ok, he is redirected to our endpoint described above
from google_auth_oauthlib.flow import InstalledAppFlow
SCOPES = ['https://www.googleapis.com/auth/calendar']
flow = InstalledAppFlow.from_client_secrets_file(f"{PATH_TO_FILE}/{CLIENT_SECRET_FILE}", SCOPES)
flow.redirect_uri = URL_SAVED_ON_STEP_1
(auth_url, state) = flow.authorization_url()
print(auth_url)
3- And to the URL receiving my code, was necessary an endpoint where we could save the user credential and use it if we wanted to add an event on the user calendar
flow = InstalledAppFlow.from_client_secrets_file(f"{CONFIG_FILES_PATH}/{CLIENT_SECRET_FILE}", SCOPES)
flow.redirect_uri = URL_SAVED_ON_STEP_1
flow.fetch_token(authorization_response=request.url)
creds = flow.credentials
with open(f"{CONFIG_FILES_PATH}/token.json", 'w') as token:
token.write(creds.to_json())
So we can let any user share their calendar and we can manage as they allow
Related
I'm using google api to integrate some google sheet data into my app. I have a server where I can only connect via SSH, as it has no user interface. When I start my app, it gives me this message:
Please visit this URL to authorize this application: https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=XXX-XXX.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A57731%2F&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fspreadsheets.readonly&state=XXX&access_type=offline
Since I don't have a UI on my server, how can I authorize the application? I've just started using the google api, I still can't figure out how to go about it.
The only thing I've tried and that works is to run the code from a windows pc for example and then transfer the token.json file to my server. The problem is that after 30 days it expires and I have to redo the whole procedure again.
Is there something I'm doing wrong? Here is my code:
from __future__ import print_function
from google.auth.transport.requests import Request
from google.oauth2.credentials import Credentials
from google_auth_oauthlib.flow import InstalledAppFlow
from googleapiclient.discovery import build
from googleapiclient.errors import HttpError
import os.path
# If modifying these scopes, delete the file token.json.
SCOPES = ['https://www.googleapis.com/auth/spreadsheets.readonly']
# The ID of a sample spreadsheet.
SPREADSHEET_ID = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
# Google API credentials
googleCredentials = None
def main():
print("Loadin google API...")
global googleCredentials
if os.path.exists("./json/token.json"):
googleCredentials = Credentials.from_authorized_user_file("./json/token.json", SCOPES)
# If there are no (valid) credentials available, let the user log in.
if not googleCredentials or not googleCredentials.valid:
if googleCredentials and googleCredentials.expired and googleCredentials.refresh_token:
googleCredentials.refresh(Request())
else:
flow = InstalledAppFlow.from_client_secrets_file("./json/credentials.json", SCOPES)
googleCredentials = flow.run_local_server(port=0)
# Save the credentials for the next run
with open("./json/token.json", 'w') as token:
token.write(googleCredentials.to_json())
if __name__ == "__main__":
main()
The only thing I've tried and that works is to run the code from a windows pc for example and then transfer the token.json file to my server. The problem is that after 30 days it expires and I have to redo the whole procedure again.
It sounds like you have done exactly what you should do. The token.json file should be just fine stored on your machine. The question is why is your refresh token expireing.
If your app is still in the testing phase the refresh token will expire after seven days. The solution for that is to go to google cloud console for your app then to the Oauth2 consent screen and set it to production the next time you create a refresh token it will not expire.
I'm a bit curious as to why you say this lasts 30 days which me think you might be getting a new refresh token back every time it refreshes your access token and its not being saved but that's not supposed to happen with the python library its supposed to handle that I will have to test it.
If you are only connecting to this single sheet, Have you considered using a service account instead?
service account
Just make sure to share the sheet with the service accounts email address, just like you would any other user via the google drive web app. It will have access to your sheet without any user intervension.
credentials = ServiceAccountCredentials.from_json_keyfile_name(
KEYFILE,
scopes=SCOPES,
)
How to create service account credentials
Should you be using a Google service account
Token.json explained
Below is the contense of a token.json file, this is exactly what an authorization server returns to you as the final step in the oauth flow.
The first on Token is actually your access token, the expire says when that access token will expire. When your code loads it will check if the access token in the file has expired if it has it will request a new one using the refresh token. look for: googleCredentials.expired
{
"token": "[Redacted Access Token]",
"refresh_token": "[Redacted refresh Token]",
"token_uri": "https://oauth2.googleapis.com/token",
"client_id": "[REDACTED]",
"client_secret": "[REDACTED]",
"scopes": [
"https://www.googleapis.com/auth/calendar.readonly"
],
"expiry": "2022-10-25T12:06:40.318779Z"
}
Working with google-api-python-client for the first time, I'm trying to generate a "link" in my authorization flow that I can pass to a user for them to allow the app to access their calendar, then I need google to pass-back the token to my app.
Currently I have something like this (basically the getcredentials() function from the quickstart demo, with user-specific tokens and WebApplication credentials.json):
def find_creds(user_id):
creds = None
token_pickle = f'./credentials/{user_id}.token.pickle'
if os.path.exists(token_pickle):
with open(token_pickle, 'rb') as token:
creds = pickle.load(token)
if not creds or not creds.valid:
if creds and creds.expired and creds.refresh_token:
creds.refresh(Request())
else:
flow = InstalledAppFlow.from_client_secrets_file(
'OAUTH.json', SCOPES) # Google WebApplication.json for OAUTH
creds = flow.run_local_server(port=0)
with open(token_pickle, 'wb') as token:
pickle.dump(creds, token)
return creds
This would work great if the user was running my application locally, however the issue is it's prompting on the server (vm) for a login, rather than passing the request to my users. No bueno.
The users are accessing my application through another application (which I don't control), so I can't really serve them a page to authorize the app - though I could pass them a URL/link to click.
This introduces a few new hurdles since the user isn't logging in locally, so I can't just "save" their authorization token.
The Authorization "flow" I'm trying to achieve should be (I think) something like this:
Pass the user a google authorization URL (I'm not sure how to generate this url/link, though I think it can be done with the google_auth_oauthlib.flow.InstalledAppFlow class. Maybe using authorization.url?)
User Authorizes app to access limited scope (calendar)
Google returns the users token back to my app (I guess this will need to be done via a return URi? So I think my server will need to run apache and have a listener running to collect/store credentials accordingly)
In tackling that first step, I'm already getting stuck though. I suspect that my flow object needs to change but I'm having a difficult time finding documentation on InstalledAppFlow:
Does it sound like I'm on the right track here? Any help/tips (or documentation) on InstalledAppFlow or google.oauth2.credentials class would be helpful too.
I've read through google-auth-library-python so far without figuring it out.
I am working on my company domain to connect any amount, n, of google sheets to a python script to scrape data and create another spreadsheet. The company does not allow direct sharing of google sheets to their gcp environment.
So I have gone the route of Oauth to accomplish this. I found the code below on stack (forgive me for losing the link) and adjusted it to my needs.
The problem is I cannot get authenticated as I keep getting the Error 400: redirect_url_mismatch - The redirect URl in the request , http://localhost:8080/, does not match the ones authorized.
The authorized url is: `http://localhost:8080' and this is the same call I make in the code (this same url is authorized in the javascript origins as well).
I think the problem is that the trailing / is not captured in the authorized URls on the gcp environment, but I am told by that team that the trailing / is not supported (URl will not save because of the / so it was omitted).
I have spent a full day on this and am not certain what is the issue or how to work around.
from oauth2client.tools import run_flow, argparser
from oauth2client.file import Storage
rscope = ['https://spreadsheets.google.com/feeds','https://www.googleapis.com/auth/drive']
CLIENT_ID = 'MY CLIENT ID'
CLIENT_SECRET = 'MY CLIENT SECRET'
flow = OAuth2WebServerFlow(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET,
scope=rscope,
redirect_url='http://localhost:8080')
storage = Storage('mycredentials.csv')
credentials = run_flow(flow, storage, argparser.parse_args([]))
import requests
import gspread, ast
from oauth2client.client import AccessTokenCredentials
data = {
'refresh_token' : credentials.refresh_token,
'client_id' : credentials.client_id,
'client_secret' : credentials.client_secret,
'grant_type' : 'refresh_token',
}
r = requests.post('https://accounts.google.com/o/oauth2/token', data = data)
try :
credentials.access_token = ast.literal_eval(r.text)['access_token']
except Exception:
pass;
gc = gspread.authorize(credentials)
Where have I gone wrong?
Answer:
You need to set https://localhost:8080 as your redirect URL in GCP.
More Information:
When you set up your Client credentials in GCP, you need to set up the redirect URL for the credentials. This is the callback URL for your client to go back to after a grant has been given - which is not the same as the authorized domains in the OAuth consent screen.
Steps:
In the GCP console for your Project, go to APIs & Services > Credentials and click + CREATE CREDENTIALS > OAuth Client ID.
Click Web Application and give your client credentials a name.
Under Authorized redirect URIs, enter https://localhost:8080
Create your credentials.
Now, you will need to download these new credentials and use them with your application. It is also possible you may need to change the protocol listed in your app to use https as in:
# ...
redirect_url='https://localhost:8080')
I have been exploring the YouTube Data API. The premise of my project is simple: using the API, authenticate (yes, I have the credentials for the account) and then simply retrieve the list of all my videos, public and private.
I have been able to accomplish this successfully, except for the fully automated part. I have used code from various sources and when I run it on the command line, it provides me a link to be used in a browser so that the authorization takes place.
It looks something like this:
Please visit this URL to authorize this application: https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=7932902759886-cb8ai84grcqshe24nn459ka46uh45ssj.apps.googleusercontent.com&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutube.readonly&state=zNVvgEyO47nmacvdEEAhDsQipY194k&prompt=consent&access_type=offline&code_challenge=aF7uTCghjwgwjg49o3fgiIU-_ryK19rDeX4l1uzr37w&code_challenge_method=S256
Enter the authorization code:
....
Here's a snippet of my python code:
import google_auth_oauthlib.flow
import googleapiclient.discovery
import googleapiclient.errors
...
...
# Get credentials and create an API client
flow = google_auth_oauthlib.flow.InstalledAppFlow.from_client_secrets_file(
client_secrets_file, scopes)
credentials = flow.run_console()
youtube = googleapiclient.discovery.build(
api_service_name, api_version, credentials=credentials)
## MAKE youtube SEARCH REQUEST
last_date = '2018-10-01T00:00:00Z'
request = youtube.search().list(
part="snippet",
forMine=True,
maxResults=50,
order="date",
type="video"
)
all_items = []
response = request.execute()
My question here is the following: Is it possible to programatically perform the authorization so that the app can run standalone and not have to wait for this user action (to literally copy the URL from CMD, visit to get the token, and the copy and paste the token again)? I'd like to schedule this and therefore would like it to run and authenticate without human intervention. Is this possible at all? If so, can someone please point me to some working examples and/or other resources to help me get there? Thanks a million.
# -*- coding: utf-8 -*-
# Sample Python code for youtube.channels.list
# See instructions for running these code samples locally:
# https://developers.google.com/explorer-help/guides/code_samples#python
#!/usr/bin/python3.7
import os
import pickle
import google_auth_oauthlib.flow
import googleapiclient.discovery
import googleapiclient.errors
scopes = ["https://www.googleapis.com/auth/youtube.readonly"]
client_secrets_file = "client_secret.json"
api_service_name = "youtube"
api_version = "v3"
def main():
# Disable OAuthlib's HTTPS verification when running locally.
# *DO NOT* leave this option enabled in production.
os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = "1"
# Get credentials and create an API client
flow = google_auth_oauthlib.flow.InstalledAppFlow.from_client_secrets_file(
client_secrets_file, scopes)
youtube = get_authenticated_service()
request = youtube.channels().list(
part="contentDetails",
mine=True
)
response = request.execute()
print(response)
def get_authenticated_service():
if os.path.exists("CREDENTIALS_PICKLE_FILE"):
with open("CREDENTIALS_PICKLE_FILE", 'rb') as f:
credentials = pickle.load(f)
else:
flow = google_auth_oauthlib.flow.InstalledAppFlow.from_client_secrets_file(client_secrets_file, scopes)
credentials = flow.run_console()
with open("CREDENTIALS_PICKLE_FILE", 'wb') as f:
pickle.dump(credentials, f)
return googleapiclient.discovery.build(
api_service_name, api_version, credentials=credentials)
if __name__ == "__main__":
main()
The Credentials instance from credentials = flow.run_console() has a built-in functionality to refresh token.
It'll will refresh the token when a request being execute if needed.
Therefore you can save the credentials object into pickle, and read it back when need it
A few alteration on Google python sample code:
def get_authenticated_service():
if os.path.exists(CREDENTIALS_PICKLE_FILE):
with open(CREDENTIALS_PICKLE_FILE, 'rb') as f:
credentials = pickle.load(f)
else:
flow = InstalledAppFlow.from_client_secrets_file(CLIENT_SECRETS_FILE, SCOPES)
credentials = flow.run_console()
with open(CREDENTIALS_PICKLE_FILE, 'wb') as f:
pickle.dump(credentials, f)
return build(API_SERVICE_NAME, API_VERSION, credentials = credentials)
copied from https://developers.google.com/identity/protocols/OAuth2InstalledApp
Step 3: Google prompts user for consent
In this step, the user decides whether to grant your application the requested access. At this stage, Google displays a consent window that shows the name of your application and the Google API services that it is requesting permission to access with the user's authorization credentials. The user can then consent or refuse to grant access to your application.
Your application doesn't need to do anything at this stage as it waits for the response from Google's OAuth 2.0 server indicating whether the access was granted. That response is explained in the following step.
Where this is important:
At this stage, Google displays a consent window that shows the name of your application and the Google API services that it is requesting permission to access with the user's authorization credentials.
So, at least as I interpret it, what you want to do should not be done for security reasons.
However: you can "simulate" a browser by how ever python have libs for do such. On the other hand: Once you got the auth-token you can re-use it instead of request a new token each time. I couldn't find it in provided doc on GitHub, but Java as example supports to store an obtained token along with its refresh token so it can be reused once obtained and auto-refreshed. Maybe python provides some way to store the obtained token (check if it contains a refresh token) and re-load it. Also: if you load such token, first you have to do is to refresh it before using it. Java provieds a way to just save a refresh token instead of the whole auth-token wich can be used in a later run to automatic obtain a new auth-token.
As response is a JSON maybe you could build some yourself if the lib doesn't already offer this.
// edit
In addition from https://github.com/googleapis/google-auth-library-python/blob/master/google/oauth2/credentials.py
There are methods to load a credential object either from an "authorized user info" (wich I also somewhere found can be loaded from file) or to load it directly from file. So, I guess you just have to figure out how to store the token. As doc says for from_authorized_user_file:
Creates a Credentials instance from an authorized user json file.
I guess that means you just have to save the token response you get after the initial authorization was done.
I'm working on a Python based project that would gain access to various Google APIs such as Google Contacts API, Pub/Sub API, Gmail API etc.
Getting the relevant tokens and credentials with OAuth 2.0 for those APIs are highly manual at the moment via Google API console. I'd like automate this for multiple users who're willing to let me manage their gmail mailbox through APIs mentioned above (not just Gmail API).
How can I get the credentials for all these APIs during signup process so that I can save the credentials json file in db and then manage the mailboxes? "Sign-up with Google" feature produce just a basic credentials and I couldn't figure out how to route users to relevant page in which I ask for him/her permission to gain access to mailbox with the APIs (Google Contacts, Gmail and pub/sub APIs). Then I'm planning to use this credentials (object) in my Python script programmatically..
Here is the script that I create the credentials by get_credentials(). As you can see, I need to manually get client-secret-file at first on API Console, and then generate credentials wrt scopes with the following script (this is where I need to automate and get several other credentials during signup process)
SCOPES = 'https://www.googleapis.com/auth/gmail.modify'
CLIENT_SECRET_FILE = "client_secret_pubsub.json"
APPLICATION_NAME = "pub-sub-project-te"
def get_credentials():
home_dir = os.path.expanduser('~')
credential_dir = os.path.join(home_dir, '.credentials')
if not os.path.exists(credential_dir):
os.makedirs(credential_dir)
credential_path = os.path.join(credential_dir,
'gmail-python-quickstart.json')
store = oauth2client.file.Storage(credential_path)
credentials = store.get()
if not credentials or credentials.invalid:
flow = client.flow_from_clientsecrets(CLIENT_SECRET_FILE, SCOPES)
flow.user_agent = APPLICATION_NAME
print('Storing credentials to ' + credential_path)
return credentials
def pull_emails_from_mailbox(credentials_obj):
credentials = get_credentials()
http = credentials.authorize(Http())
GMAIL=discovery.build('gmail', 'v1', http=http)
user_id = 'me'
label_id_one = 'INBOX'
label_id_two = 'UNREAD'
# Getting all the unread messages from Inbox
# labelIds can be changed accordingly
messages = GMAIL.users().messages().list(userId=user_id, maxResults=1000).execute()
#unread_msgs = GMAIL.users().messages().list(userId='me',labelIds=[label_id_one,label_id_two]).execute()
# We get a dictonary. Now reading values for the key 'messages'
mssg_list = messages['messages']
print ("Total messages in inbox: ", str(len(mssg_list)))
final_list = []
new_messages=[]
for mssg in mssg_list:
m_id = mssg['id'] # get id of individual message
new_messages.append(GMAIL.users().messages().get(userId=user_id, id=m_id).execute()) # fetch the message using API
return new_messages
def prepare_raw_db (raw_messages):
messageId=[]
historyId=[]
raw=[]
print ("Total number of emails to be parsed:", len(raw_messages))
for msg in raw_messages:
messageId.append(msg["id"])
historyId.append(msg['historyId'])
raw.append(msg)
#'addLabelIds': ['UNREAD']
GMAIL.users().messages().modify(userId="me", id=msg["id"],body={ 'removeLabelIds': ['UNREAD'] }).execute()
msg_dict={"messageId":messageId, "historyId":historyId, "raw":raw}
df=pd.DataFrame(msg_dict)
df.raw=df.raw.astype(str)
return df
thanks
You've to make web server to do the same. The flow will be following -
User goes to your web app.
User clicks on Sign in with Google.
User will be redirected to Goole OAuth2 url with required scopes (in your case, it is Google Contacts API, Pub/Sub API, Gmail API etc.)
User will give access to your application created on Google Developer Console.
It will return with token/code for your application with required access as per OAuth2 request.
You can store the same in some database and can use it as per OAuth2.
Above process is given step-by-step here.
Make your scopes a list and then add them like that, for example
SCOPES = ['https://www.googleapis.com/auth/drive.metadata.readonly', 'https://www.googleapis.com/auth/spreadsheets']
This worked for me so i hope it helps