The access token provided by Whatsapp cloud API expires in 24 hours. Is there a way to get a permanent access token?
There is an official link for getting a permanent token on the whatsapp website : Learn how to create a permanent token but it is another rabbit hole which does not state how to get permanent access token.
If someone has done this successfully, please help me and other frustrated developers :)
You need to set up a system user as the admin of your app. You can then generate never expiring access tokens for this system user.
Step by step guide to set it up:
Add a system user to your facebook app if it doesn't exist yet. Make sure it has the admin role.
On the same page, in the "Assigned Assets" section, check whether your app is listed here. If not, add your app via the "Add asset" button, granting "Full control" over your app.
Add the system user to your Whatsapp account in the "People" section, granting "Full control" over your Whatsapp account
Now click the "Generate new token" button for above system user which reveals a "Generate token" popup. Select the 2 permissions whatsapp_business_management and whatsapp_business_messaging and confirm
A new access token is presented to you as a link. Click it and then store the generated token safely as it will not be stored for you by facebook. This token will not expire.
You can get user access token from Facebook oauth using this link: https://www.facebook.com/v8.0/dialog/oauth?client_id=<app_id>&response_type=code%20token&redirect_uri=<redirect_url>&scope=whatsapp_business_management
client_id: App ID of your app on developer.facebook.com
redirect_url: your url where access token will be appended (note: you have to add to "valid oauth redirect urls" of your app "Facebook Login => Settings")
scope: whatsapp_business_management
Once the process is completed the access tokens will be appended to your redirect url.
Related
I am trying to access logs from an app. Apparently, the only way to do that is the herkoku client.
I am working remotely. When I do
heroku login -i
Error: Your account has MFA enabled; API requests using basic authentication with email and password are not supported. Please generate an authorization token for API access.
But there is no link provided where or how to get such a token.
And the documentation does not mention the creation of such a token. Only how to store it.
Any ideas?
While logged in to the Heroku web interface, go to "Account settings" (in the menu under your avatar in the top right) and scroll down to "API Key". Generate one if there isn't one already, or click "Reveal" to see the existing one.
Now, re-run heroku login -i, and enter your email as normal, but enter that API key instead of your account password.
The above method works. But: You have to type this password into the CLI. Cutting and pasting does not work.
I need google oauth for google+ login on my opencart store. My app is requesting the following scopes only and app is public.
https://googleapis.com/auth/plus.me
https://googleapis.com/auth/userinfo.profile
https://googleapis.com/auth/userinfo.email
These are not sensitive scopes and on my oauth consent screen I see the submit verification button is disabled and it says
Your changes don't require verification
Still customers see Unverified app screen (This app isn't verified)
I have also submitted oauth app verification form https://support.google.com/code/contact/oauth_app_verification . Its been more than a week not got any response from google.
Please suggest any way how to remove Unverified app screen for my customers?
Google will ignore your request for verification unless you have one or more sensitive scopes listed in the OAuth consent screen list of "Scopes for Google APIs".
e.g.
There are a bunch of steps for this so I made a video while I add a sensitive scope to an OAuth consent screen.
Here are the steps, written out:
First, be sure that all URIs associated with your project are hosted on HTTPS. This includes the Authorized Javascript URIs and Authorized Redirect URIs listed in each of the OAuth Credentials. Google won't approve any app that uses any insecure connections.
Next, confirm that your OAuth app has enabled access to the sensitive API (such as People or Contacts API).
Then, add the scope to your "OAuth consent screen".
Finally, click the enabled "Submit for verification" button at the bottom of the form.
You should not require app verification if you are only setting up 'Sign in with Google'. An app review is required if you request sensitive scopes. Google+ sign-in is deprecated, you should be using the branding-approved 'Sign in with Google' button: https://developers.google.com/identity/branding-guidelines
If you do use sensitive scopes, you should update the scopes section of the OAuth consent screen configuration to include all sensitive scopes you are requesting before the 'submit for verification' button becomes available. In order to add your sensitive scopes on the configuration page, you need to enable the APIs you would like your project to access. For example, enable the GMail APIs for your project by visiting the API library, then add the GMail scopes to your consent screen configuration, fill out additional information, submit for verification.
Please see the 'User Consent' section of https://support.google.com/cloud/answer/6158849?hl=en for more information.
Well, something is really off with my google account.
[x] All URLS HTTPS
[x] Sensitive scope not added
[x] App submitted for verification
[x] Got an email stating verification not required.
Now if I do the following events:
Open Incognito Browser
Click login with Google
Sign In using a general email id ( I used and email account from Gmail)
Here's the warning: This app isn't verified!!
If I tried doing this in normal browser where I am already signed in, this doesn't show up! This can be really bad for new users, it guarantees a high bounce rate!
can you guys give a try and see if this true.
Also, as an answer: I would suggest you to kindly check the app in incognito mode or in a fresh browser.
scope parameter in the URL that starts with https://accounts.google.com/o/oauth2/auth?https://accounts.google.com/o/oauth2/auth?scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcontacts.readonly[other params here]
I'm using oauth implicit flow to authorize google assistant user into the system.
The login flow goes like this:
If user is logging in for the first time, the assistant redirect it to my service where user provides its credentials and logs in. Upon successful login, my service generates a JWT token and sends it back to the google oauth endpoint.
Then user returns to the Google assistant with a message: "Your account has been linked to Google".
Now, the big problem is,
How can I logout the user once the token expires?
Or how can I revoke the token from Google Assistant so that it will again redirect the user to my service login page for authentication?
Try not to suggest Authorization code flow because existing architecture does not allow Authorization flow.
If you need more information then please comment below.
Found the solution.
You just have to send 401 Unauthorized Code from the your webhook. On receiving 401 Google automatically revokes the token and exits the application.
Then when user invokes the app again. User is asked to re-link his account with Google.
If you have further questions then comment below.
In my web app, I'm integrating a "Sign In With Google" button with Google Api Client (JS), in order to then integrate with some other Google services.
So far I've already implemented the login logic: the user is able to click the button and proceed to the application, the flow is this:
the user accepts to connect the app to its google account
then I send the response token to my backend (PHP) to check the token and store in the DB the Google UserID (sud)
If the user had already an account with my app, I update the profile to add the google sign in option.
If the user did not have an account I ask him to register client side.
from now on the user can access my app both with my app's login credentials, and with "Google Sign In".
I send back to the client the access authorization to my app.
My problem is, how to sign in the user automatically the next time? At least two scenarios my happen:
the user opens my app from the computer of a friend in which another google account is already logged in. The user chooses to login in my app with my app's credentials (not "Google Sign In"), so once he/she is logged in, by refreshing the token I would get the wrong Google account. Displaying the authorization window again wouldn't be ideal and would surely offset the user seeing someone else's account.
the user opens my app in incognito (private) mode on a friends' computer, and he/she chooses to login using his/her email and password, not the google sign in. Again, I wouldn't know how to re-sign in the user with the google api client.
Since I know in my backend what Google user is "my user", is there a way to pass such information to the google client api, so that it logs in the right user?
Is it possible for me to create an application that can send our requests to access to users' Google Calendar so that I can see the events in there and be able to add, edit, and delete events?
I do not want the users to log into my website to enable this access. Rather, I want to be able to send this request, perhaps via email.
Alternatively, perhaps they could log in the web app and authorize access themselves somehow.
One option would be to e-mail the user a link to the OAuth 2.0 consent screen. The users would still need to open the link in a browser, sign in to their Google account (if not already signed in), and click the "Authorize" button to grant your application access to their Google calendar events.
First, you will need to register your application as a Web App in Google's Developer Console (just like for any other application) and obtain a client_id. Be sure to fill in the name of your application and a link to your website in the "OAuth consent screen" section, because these values will be shown to your users when they click the authorization link.
Then, follow these steps:
Send the user an authorization link in an HTML e-mail message. The link should be constructed according to the guidelines in "Redirecting to Google's OAuth 2.0 server", and pay attention to the following aspects:
Ensure that the redirect_uri parameter in the authorization link points to your application.
Since you already know the e-mail address of the user, consider including the login_hint=<email address> parameter to bypass the account selection screen.
Important: provide a value in the state parameter so that you can link this authorization request with the user.
The link should be placed in an <a> tag somewhere in the body of the e-mail: Allow access to my Google calendar
When the user clicks on this link, their browser will open and show the standard Google consent screen:
Once the user has made a choice, their browser will be redirected to the redirect_uri which you have provided.
Make sure that the redirect_uri will work even if the user isn't signed in to your application. Capture the state and authorization_code values which Google appends to the redirect_uri, and then return a confirmation page (e.g. "Thank you for giving us access to your Google calendar" would be a good idea).
Using the state and authorization_code values, follow the rest of the standard OAuth 2.0 flow and retrieve a refresh_token which will allow you to access the user's Google calendar from your application.
Keep in mind that the calendar owner (the user who is clicking the link in the e-mail and granting your application consent to access the calendar) may not even be a user of your application. This is why it is important to provide as much information as possible on the consent screen and in the confirmation page.
Since your confirmation page will be loaded even if the user does not grant your application consent, you could take the opportunity to give the user a full description of why you are asking for access to their calendar and provide a link that will take them back to the consent screen. This should increase your success rate.
Every request your application sends to the Google Calendar API must
include an authorization token. The token also identifies your
application to Google.
Your application must use OAuth 2.0 to authorize requests. No other
authorization protocols are supported. If your application uses
Google+ Sign-In, some aspects of authorization are handled for you.
The details of the authorization process, or "flow," for OAuth 2.0
vary somewhat depending on what kind of application you're writing.
For more details on the workflow to gain access click here. Once your app has access, it will be able to view and edit a user's calendar events, depending on the approved permissions.