I am writing a program which uses a local token.pickle file to access the user's Google Calendar.
It runs on a server and what I want is for the user to be able to login through a web interface and then the server creates and stores the token.pickle file, created from the auth code the page sends back to the server.
Where I am at is that my Python backend receives the authorization code but I don't know how to create the token.pickle file from that... I know I need to exchange the code for the user's credentials though and I probably need to use the following snippets:
with open('token.pickle', 'wb') as token:
pickle.dump(creds, token)
and
# Set path to the Web application client_secret_*.json file you downloaded from the
# Google API Console: https://console.developers.google.com/apis/credentials
CLIENT_SECRET_FILE = '/path/to/client_secret.json'
# Exchange auth code for access token, refresh token, and ID token
credentials = client.credentials_from_clientsecrets_and_code(
CLIENT_SECRET_FILE,
['https://www.googleapis.com/auth/drive.appdata', 'profile', 'email'],
auth_code)
Thanks, I would greatly appreciate any help.
EDIT:
Okay, so I would like to save some sort of way of getting the credentials or the credentials themselves from the access token, so I can access them from:
service = build('calendar', 'v3', credentials=creds)
Can anybody clarify or give me a way to do this please?
Related
I'm using google api to integrate some google sheet data into my app. I have a server where I can only connect via SSH, as it has no user interface. When I start my app, it gives me this message:
Please visit this URL to authorize this application: https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=XXX-XXX.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A57731%2F&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fspreadsheets.readonly&state=XXX&access_type=offline
Since I don't have a UI on my server, how can I authorize the application? I've just started using the google api, I still can't figure out how to go about it.
The only thing I've tried and that works is to run the code from a windows pc for example and then transfer the token.json file to my server. The problem is that after 30 days it expires and I have to redo the whole procedure again.
Is there something I'm doing wrong? Here is my code:
from __future__ import print_function
from google.auth.transport.requests import Request
from google.oauth2.credentials import Credentials
from google_auth_oauthlib.flow import InstalledAppFlow
from googleapiclient.discovery import build
from googleapiclient.errors import HttpError
import os.path
# If modifying these scopes, delete the file token.json.
SCOPES = ['https://www.googleapis.com/auth/spreadsheets.readonly']
# The ID of a sample spreadsheet.
SPREADSHEET_ID = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
# Google API credentials
googleCredentials = None
def main():
print("Loadin google API...")
global googleCredentials
if os.path.exists("./json/token.json"):
googleCredentials = Credentials.from_authorized_user_file("./json/token.json", SCOPES)
# If there are no (valid) credentials available, let the user log in.
if not googleCredentials or not googleCredentials.valid:
if googleCredentials and googleCredentials.expired and googleCredentials.refresh_token:
googleCredentials.refresh(Request())
else:
flow = InstalledAppFlow.from_client_secrets_file("./json/credentials.json", SCOPES)
googleCredentials = flow.run_local_server(port=0)
# Save the credentials for the next run
with open("./json/token.json", 'w') as token:
token.write(googleCredentials.to_json())
if __name__ == "__main__":
main()
The only thing I've tried and that works is to run the code from a windows pc for example and then transfer the token.json file to my server. The problem is that after 30 days it expires and I have to redo the whole procedure again.
It sounds like you have done exactly what you should do. The token.json file should be just fine stored on your machine. The question is why is your refresh token expireing.
If your app is still in the testing phase the refresh token will expire after seven days. The solution for that is to go to google cloud console for your app then to the Oauth2 consent screen and set it to production the next time you create a refresh token it will not expire.
I'm a bit curious as to why you say this lasts 30 days which me think you might be getting a new refresh token back every time it refreshes your access token and its not being saved but that's not supposed to happen with the python library its supposed to handle that I will have to test it.
If you are only connecting to this single sheet, Have you considered using a service account instead?
service account
Just make sure to share the sheet with the service accounts email address, just like you would any other user via the google drive web app. It will have access to your sheet without any user intervension.
credentials = ServiceAccountCredentials.from_json_keyfile_name(
KEYFILE,
scopes=SCOPES,
)
How to create service account credentials
Should you be using a Google service account
Token.json explained
Below is the contense of a token.json file, this is exactly what an authorization server returns to you as the final step in the oauth flow.
The first on Token is actually your access token, the expire says when that access token will expire. When your code loads it will check if the access token in the file has expired if it has it will request a new one using the refresh token. look for: googleCredentials.expired
{
"token": "[Redacted Access Token]",
"refresh_token": "[Redacted refresh Token]",
"token_uri": "https://oauth2.googleapis.com/token",
"client_id": "[REDACTED]",
"client_secret": "[REDACTED]",
"scopes": [
"https://www.googleapis.com/auth/calendar.readonly"
],
"expiry": "2022-10-25T12:06:40.318779Z"
}
I am working on a project to let a client authorize their google ads account, and then use those authorized credentials to download data on their behalf. I have a webapp that successfully Authorizes the app to do things on the clients behalf. This generates an access code that I then trade for two credentials, an access token and a refresh token. This refresh token then gets passed to a database, where a separate app attempts to query the googleAds API.
It is my understanding that the Google Oauth engine only needs the refresh token.
I am trying to authorize by use of load_from_dict() or load_from_env() methods of the GoogleAdsClient class. Both yield the same error: google.auth.exceptions.RefreshError: ('invalid_client: Unauthorized', {'error': 'invalid_client', 'error_description': 'Unauthorized'})
I have verified the developer_token, client_id, and client_secret are all accurate to what is in the API console. I have also verified the refresh_token is being passed correctly to the credential dict.
I am really at a loss on where to go from here. I have read many stack overflow threads with similar titles, and yet I am still stuck at the same place.
Here are some relevant links.
Google Ads API configuration
Google Identity and Server side web apps
Google's example of an API call
Relevant code
class GoogleAds:
def __init__(self):
self.scope = ['https://www.googleapis.com/auth/adwords']
self.client_id = os.getenv('GOOGLE_ADS_CLIENT_ID')
self.client_secret = os.getenv('GOOGLE_ADS_CLIENT_SECRET')
self.developer_token = os.getenv('GOOGLE_ADS_DEVELOPER_TOKEN')
self.refresh_token = os.getenv('GOOGLE_ADS_REFRESH_TOKEN')
def authorize(self):
credentials = {
"developer_token": self.developer_token,
"refresh_token": self.refresh_token,
"client_id": self.client_id,
"client_secret": self.client_secret,
"use_proto_plus":"True",
"grant_type": "refresh_token",
}
print(credentials)
googleads_client = GoogleAdsClient.load_from_dict(credentials)
service = googleads_client.get_service("GoogleAdsService")
request = googleads_client.get_type("SearchGoogleAdsRequest")
return service, request
'error': 'invalid_client', 'error_description': 'Unauthorized' Can be a very hard error to debug. It can mean a number of things.
Currently it Implies to me that the user has not authorized this client.
First ensure that the refresh token has not expired. Second ensure that the client id and client secrete used to create the refresh token are the same one that you are using to request a new access token.
oauth2#expiration
I ended up refreshing the Client_Secret in the google API client and that seemed to have gotten me through.
Q: It is outside the scope of this question, but is it possible to get that value from the authorization step?
A: You can get the customer IDs you have access to with the client.get_service("CustomerService") method. There is also a way to get account hierarchy. I will probably be using (Frankensteining) that to move forward
I am simply trying to create a new folder on google drive using the Google Drive API.
I have created a Service Account as well as a OAuth 2.0 Client IDs (and have downloaded their respective client secret .json files) for a project in which the Drive API has been enabled.
However, I am still encountering endless problems. The template example below has not worked for me (nor have any other solutions to people encountering the same problem).
file_metadata = {
'name': 'Invoices',
'mimeType': 'application/vnd.google-apps.folder'
}
file = drive_service.files().create(body=file_metadata,
fields='id').execute()
print 'Folder ID: %s' % file.get('id')
If I am using:
SCOPE = ['https://www.googleapis.com/auth/drive']
credentials = ServiceAccountCredentials.from_json_keyfile_name(CLIENT_SECRET_FILE, SCOPE)
then plugging in the .json downloaded from the Service Account for CLIENT_SECRET_FILE, I get the error Client secrets must be for a web or installed app
If I instead try to authenticate CLIENT_SECRET_FILE with a key json file generated via OAuth2 credentials I get and Authorization Error
Error 400: redirect_uri_mismatch
The redirect URI in the request, http://localhost:8080/, does not match the ones authorized for the OAuth client...
I have also created an API Key for the project. Is there an easier way to achieve this by using the API Key, as opposed to the .json files?
Any help would be much appreciated.
You should add the redirect URIs needed into the list.
Working with google-api-python-client for the first time, I'm trying to generate a "link" in my authorization flow that I can pass to a user for them to allow the app to access their calendar, then I need google to pass-back the token to my app.
Currently I have something like this (basically the getcredentials() function from the quickstart demo, with user-specific tokens and WebApplication credentials.json):
def find_creds(user_id):
creds = None
token_pickle = f'./credentials/{user_id}.token.pickle'
if os.path.exists(token_pickle):
with open(token_pickle, 'rb') as token:
creds = pickle.load(token)
if not creds or not creds.valid:
if creds and creds.expired and creds.refresh_token:
creds.refresh(Request())
else:
flow = InstalledAppFlow.from_client_secrets_file(
'OAUTH.json', SCOPES) # Google WebApplication.json for OAUTH
creds = flow.run_local_server(port=0)
with open(token_pickle, 'wb') as token:
pickle.dump(creds, token)
return creds
This would work great if the user was running my application locally, however the issue is it's prompting on the server (vm) for a login, rather than passing the request to my users. No bueno.
The users are accessing my application through another application (which I don't control), so I can't really serve them a page to authorize the app - though I could pass them a URL/link to click.
This introduces a few new hurdles since the user isn't logging in locally, so I can't just "save" their authorization token.
The Authorization "flow" I'm trying to achieve should be (I think) something like this:
Pass the user a google authorization URL (I'm not sure how to generate this url/link, though I think it can be done with the google_auth_oauthlib.flow.InstalledAppFlow class. Maybe using authorization.url?)
User Authorizes app to access limited scope (calendar)
Google returns the users token back to my app (I guess this will need to be done via a return URi? So I think my server will need to run apache and have a listener running to collect/store credentials accordingly)
In tackling that first step, I'm already getting stuck though. I suspect that my flow object needs to change but I'm having a difficult time finding documentation on InstalledAppFlow:
Does it sound like I'm on the right track here? Any help/tips (or documentation) on InstalledAppFlow or google.oauth2.credentials class would be helpful too.
I've read through google-auth-library-python so far without figuring it out.
I have been exploring the YouTube Data API. The premise of my project is simple: using the API, authenticate (yes, I have the credentials for the account) and then simply retrieve the list of all my videos, public and private.
I have been able to accomplish this successfully, except for the fully automated part. I have used code from various sources and when I run it on the command line, it provides me a link to be used in a browser so that the authorization takes place.
It looks something like this:
Please visit this URL to authorize this application: https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=7932902759886-cb8ai84grcqshe24nn459ka46uh45ssj.apps.googleusercontent.com&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutube.readonly&state=zNVvgEyO47nmacvdEEAhDsQipY194k&prompt=consent&access_type=offline&code_challenge=aF7uTCghjwgwjg49o3fgiIU-_ryK19rDeX4l1uzr37w&code_challenge_method=S256
Enter the authorization code:
....
Here's a snippet of my python code:
import google_auth_oauthlib.flow
import googleapiclient.discovery
import googleapiclient.errors
...
...
# Get credentials and create an API client
flow = google_auth_oauthlib.flow.InstalledAppFlow.from_client_secrets_file(
client_secrets_file, scopes)
credentials = flow.run_console()
youtube = googleapiclient.discovery.build(
api_service_name, api_version, credentials=credentials)
## MAKE youtube SEARCH REQUEST
last_date = '2018-10-01T00:00:00Z'
request = youtube.search().list(
part="snippet",
forMine=True,
maxResults=50,
order="date",
type="video"
)
all_items = []
response = request.execute()
My question here is the following: Is it possible to programatically perform the authorization so that the app can run standalone and not have to wait for this user action (to literally copy the URL from CMD, visit to get the token, and the copy and paste the token again)? I'd like to schedule this and therefore would like it to run and authenticate without human intervention. Is this possible at all? If so, can someone please point me to some working examples and/or other resources to help me get there? Thanks a million.
# -*- coding: utf-8 -*-
# Sample Python code for youtube.channels.list
# See instructions for running these code samples locally:
# https://developers.google.com/explorer-help/guides/code_samples#python
#!/usr/bin/python3.7
import os
import pickle
import google_auth_oauthlib.flow
import googleapiclient.discovery
import googleapiclient.errors
scopes = ["https://www.googleapis.com/auth/youtube.readonly"]
client_secrets_file = "client_secret.json"
api_service_name = "youtube"
api_version = "v3"
def main():
# Disable OAuthlib's HTTPS verification when running locally.
# *DO NOT* leave this option enabled in production.
os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = "1"
# Get credentials and create an API client
flow = google_auth_oauthlib.flow.InstalledAppFlow.from_client_secrets_file(
client_secrets_file, scopes)
youtube = get_authenticated_service()
request = youtube.channels().list(
part="contentDetails",
mine=True
)
response = request.execute()
print(response)
def get_authenticated_service():
if os.path.exists("CREDENTIALS_PICKLE_FILE"):
with open("CREDENTIALS_PICKLE_FILE", 'rb') as f:
credentials = pickle.load(f)
else:
flow = google_auth_oauthlib.flow.InstalledAppFlow.from_client_secrets_file(client_secrets_file, scopes)
credentials = flow.run_console()
with open("CREDENTIALS_PICKLE_FILE", 'wb') as f:
pickle.dump(credentials, f)
return googleapiclient.discovery.build(
api_service_name, api_version, credentials=credentials)
if __name__ == "__main__":
main()
The Credentials instance from credentials = flow.run_console() has a built-in functionality to refresh token.
It'll will refresh the token when a request being execute if needed.
Therefore you can save the credentials object into pickle, and read it back when need it
A few alteration on Google python sample code:
def get_authenticated_service():
if os.path.exists(CREDENTIALS_PICKLE_FILE):
with open(CREDENTIALS_PICKLE_FILE, 'rb') as f:
credentials = pickle.load(f)
else:
flow = InstalledAppFlow.from_client_secrets_file(CLIENT_SECRETS_FILE, SCOPES)
credentials = flow.run_console()
with open(CREDENTIALS_PICKLE_FILE, 'wb') as f:
pickle.dump(credentials, f)
return build(API_SERVICE_NAME, API_VERSION, credentials = credentials)
copied from https://developers.google.com/identity/protocols/OAuth2InstalledApp
Step 3: Google prompts user for consent
In this step, the user decides whether to grant your application the requested access. At this stage, Google displays a consent window that shows the name of your application and the Google API services that it is requesting permission to access with the user's authorization credentials. The user can then consent or refuse to grant access to your application.
Your application doesn't need to do anything at this stage as it waits for the response from Google's OAuth 2.0 server indicating whether the access was granted. That response is explained in the following step.
Where this is important:
At this stage, Google displays a consent window that shows the name of your application and the Google API services that it is requesting permission to access with the user's authorization credentials.
So, at least as I interpret it, what you want to do should not be done for security reasons.
However: you can "simulate" a browser by how ever python have libs for do such. On the other hand: Once you got the auth-token you can re-use it instead of request a new token each time. I couldn't find it in provided doc on GitHub, but Java as example supports to store an obtained token along with its refresh token so it can be reused once obtained and auto-refreshed. Maybe python provides some way to store the obtained token (check if it contains a refresh token) and re-load it. Also: if you load such token, first you have to do is to refresh it before using it. Java provieds a way to just save a refresh token instead of the whole auth-token wich can be used in a later run to automatic obtain a new auth-token.
As response is a JSON maybe you could build some yourself if the lib doesn't already offer this.
// edit
In addition from https://github.com/googleapis/google-auth-library-python/blob/master/google/oauth2/credentials.py
There are methods to load a credential object either from an "authorized user info" (wich I also somewhere found can be loaded from file) or to load it directly from file. So, I guess you just have to figure out how to store the token. As doc says for from_authorized_user_file:
Creates a Credentials instance from an authorized user json file.
I guess that means you just have to save the token response you get after the initial authorization was done.