Could not obtain Google oAuth 2 token on POSTMan - google-api

Well, since the Other problem(solved) remain unsolved, I was thinking to use POSTMan to do Trial and Error on each steps that the Client library will do.
So I read the Basic steps of Google OAuth2 again, created another OAuth 2 ID at Api Manager > Credentials in Dev Console and ID type is Web Application, and filled them into the POSTMan:
New tab in POSTMan, then click the Authorization label.
Choose type as OAuth 2.0 and select "Add token to the url"
Auth URL: https://accounts.google.com/o/oauth2/v2/auth
Access Token URL: https://www.googleapis.com/oauth2/v4/token
Client ID: [the Client ID that I just received]
Client Secret: [the Client secret that I just received]
Scope: [empty]
Grant Type: Authorization Code
Request access token locally: Selected
Click "Request Token"
POSTMan replied me: "Could not complete OAuth2.0 login"
Do I missed something?
(Google redirect URI could be found here)
(API scope could be found here)

You get access Token only when a Google User Logs in through the google signin page.
Step 1:
Redirect
https://accounts.google.com/o/oauth2/auth?client_id=" + GoogleClientID + "&redirect_uri=" + Url.Encode(GoogleRedirectURL) + "&response_type=code&scope=email"
Step 2:
Now you are on google signin page and you would enter your google credentials.
Step 3 :
Google will redirect you back to the redirect_uri that you have configured in the Google Developer Console and you can get the "code" from the QueryString
Step 4:
Now you post a form to https://www.googleapis.com/oauth2/v4/token
with client_id, client_secret, redirect_uri, code(you obtained in Step 3), and the grant_type=authorization_code
Result: You should now receive the access_token from Google

BigHomie's suggestion of scope to 'email' worked for me as well.
But I used a different Auth URL and Access Token URL than BigHomie, because I think it's been updated.
Auth URL:
https://accounts.google.com/o/oauth2/auth
Access Token URL:
https://accounts.google.com/o/oauth2/token

I followed Rajat's instructions, and they worked but afterward I tried what the OP did again but this time setting the scope to 'email' instead of leaving it blank, I got a prompt to enter my gmail creds, and was able to get access token.

Related

How to get new acess token from refres token for google api in postman

I am trying to get new access token from my refresh token for google drive api. In my google playground it works but when I want to create the same request in postman or my code it doesn't work and I always get error "Invalid grand type". I don't know to find what is problem.
google developers playground
postman headers and body
You need to understand that there is three steps to the Oauth2 dance.
step one is requesting access of the user and getting the authorization code.
HTTP GET https://accounts.google.com/o/oauth2/auth?client_id={clientid}.apps.googleusercontent.com&redirect_uri=urn:ietf:wg:oauth:2.0:oob&scope=https://www.googleapis.com/auth/analytics.readonly&response_type=code
Note &response_type=code tells the server you want an authorization code returned.
step two is to exchange that code for an access token and refresh token.
POST https://accounts.google.com/o/oauth2/token
code=4/X9lG6uWd8-MMJPElWggHZRzyFKtp.QubAT_P-GEwePvB8fYmgkJzntDnaiAI&client_id={ClientId}.apps.googleusercontent.com&client_secret={ClientSecret}&redirect_uri=urn:ietf:wg:oauth:2.0:oob&grant_type=authorization_code
Note the part where it says &grant_type=authorization_code. this tells the server you are giving them an authorization code.
3 the final step is refreshing your access token.
POST https://accounts.google.com/o/oauth2/token
client_id={ClientId}.apps.googleusercontent.com&client_secret={ClientSecret}&refresh_token=1/ffYmfI0sjR54Ft9oupubLzrJhD1hZS5tWQcyAvNECCA&grant_type=refresh_token
Note &grant_type=refresh_token you are telling the server you are sending them a refresh token.
You appear to be sending a refresh token with the wrong grant type.
I have a video on how to set up postman to use google oauth2
How to set up Oauth2 in PostMan.
Google 3 Legged OAuth2 Flow
Note: Due to a recent change with Making Google OAuth interactions safer by using more secure OAuth flows redirect uri of urn:ietf:wg:oauth:2.0:oob is going to stop working soon.

refresh_token is missing in Google OAuth2 .Net HttpPost request for access_token

In my Google OAuth request using .Net HttpPost refresh_token value is missing.
Reference: https://developers.google.com/identity/protocols/oauth2/web-server#exchange-authorization-code
My input HTTP post request -
...google oauth post request details..url - (https://accounts.google.com/o/oauth2/token)...
and the postData - (client_id=<client_id>&client_secret=<client_secret_key>&grant_type=authorization_code&redirect_uri=<redirect_url>&code=<authorization_code>&access_type=offline&prompt=consent&approval_prompt=force)
Note: I have a valid response with access_token. However, refresh_token object value with empty record.
Please help.
I already reviewed these links - Not receiving Google OAuth refresh token
The call to exchange the authorization code for an access token and refresh token looks as follows.
HTTP POST https://accounts.google.com/o/oauth2/token
code=4/X9lG6uWd8-MMJPElWggHZRzyFKtp.QubAT_P-GEwePvB8fYmgkJzntDnaiAI&client_id={ClientId}&client_secret={ClientSecret}&redirect_uri={redirectURI}&grant_type=authorization_code
You dont use access_type , approval_prompt, prompt as part of the exchange for the authorization code those are included in the HTTP GET request that shows the consent screen.
Here you can add access_type, if you have created web credentials client on google developer console.
HTTP GET https://accounts.google.com/o/oauth2/auth?client_id={clientid}&redirect_uri=urn:ietf:wg:oauth:2.0:oob&scope=https://www.googleapis.com/auth/analytics.readonly&response_type=code&access_type=offline
If your interested in seeing how the calls are built up this might help. Understanding Google OAuth 2.0 with curl

Failed To authenticate to specific firebase api project?

the project that I am trying to automate is This.
Manual Logged in
When I click on Google logged-in it will redirect to manual login.
after I logged in successfully I can see there Post method
Request URL: https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyAssertion?key=AIzaSyDF-qMBES2pwjDAzWRRsu-FiAxZgJsBuIk
Request Method: POST
with the body
requestUri: "FirebaseappURL"
returnIdpCredential: true
returnSecureToken: true
sessionId: "SessionID???"
after that, it generates a Large respond
context: ""
displayName.
emailverified.
expiresIn:3600
federatedId:...
firstName:.
fullName:.
idToken: <Token>
kind: "identitytoolkit#VerifyAssertionResponse"
lastName: ...
localId: <ID>
oauthAccessToken: <Token>
oauthExpireIn: 3600
oauthIdToken: <Token>
photoUrl: <url>
providerId: "google.com"
rawUserInfo: <long json>
refreshToken: <token>
I want to simulate it with post request with the postman
after that, I will transfer it to Script
What I tried
Google API Config
I went to Google DashBoard Create Project.
Then I go to the OAuth consent screen and add my user as test users.
Add all the Clawee sites as authorizes.
Then I Went to Credentials and add Oauth 2.0 Client ID's of the Desktop client
and got his ClientID and SecretID
Now from postman, I went to
https://accounts.google.com/o/oauth2/v2/auth?client_id=<ClientID>.apps.googleusercontent.com&response_type=code&scope=openid%20email&access_type=offline&redirect_uri=urn:ietf:wg:oauth:2.0:oob
I got my auth-code
now I send a request to
https://oauth2.googleapis.com/token
with params clientid,secretId,authCode,grant_type
and get my Access Token + Refress Token
Now to check that, I navigate to
https://www.googleapis.com/oauth2/v3/userinfo?access_token="
I got My User Info... It works
Now I tried to use that Access Token
To login to Firebase app as they did
but because I using my Own token and not a manual login
I read about the "signInWithIdp" or "verifyCustomToken"
And I tried
with 'postBody': 'access_token=[My_Token]&providerId=google.com' or
token: [My_Token]
Both Failed...
What am I doing wrong?

Error 400: invalid_scope Some requested scopes cannot be shown: [https://www.googleapis.com/auth/homegraph]

So I'm trying to use the Home Graph API by calling the API endpoint
https://homegraph.googleapis.com/v1/devices:requestSync
It is a HTTP POST request and it needs an ACCESS_TOKEN and service account key.
Getting the service account key is easily done as per Google's documentation. The issue is getting the ACCESS_TOKEN.
As per this documentation by Google, I need to get ACCESS_TOKEN created using the following scope of permissions
https://www.googleapis.com/auth/homegraph
I opened OAuth 2.0 Playground to request a developer temporary ACCESS_TOKEN for testing. I wrote all the necessary urls and in scope I wrote this-
scope is written to be authorized
Now after this, I am navigated to my Authorization URL (ie, Google's sign in page). I login with email id and password.
If credentials are correct and scope mentioned is valid then I should have been redirected to OAuth playground page with authorization code which I would have exchanged for access token and refresh token.
But, what actually happens is after I enter my credentials, I get following error and I am never redirected to Oauth Playground page-
Authorization Error
Error 400: invalid_scope
Some requested scopes cannot be shown: [https://www.googleapis.com/auth/homegraph]
Request Details
access_type=offline
o2v=2
response_type=code
redirect_uri=https://developers.google.com/oauthplayground
prompt=consent
client_id=xxxxxxxxx.apps.googleusercontent.com
scope=https://www.googleapis.com/auth/homegraph**
I searched a lot online too, but couldn't find the actual reason.
So due to this issue with scope, I am not able to get ACCESS_TOKEN.
I have followed Google's documentation and the scope was mentioned there.
This is the pic from oauth 2.0 playground settings- OAuth 2.0 configuration
The issue is that you, a user, should not be getting and sending an access token. The service account should be getting and sending an access token. This is to make sure your service is authorized to talk to the Home Graph API.
You indicated you logged into the OAuth playground with "userid and password". But service accounts don't have passwords.
If you are using one of Google's libraries, it will take care of getting the access token for you, and this is the easiest way to do so. If you are just testing and need an access token, you can use something like oauth2l to get the access token based on the service account credentials.
I had implemented the REST approach to call HomeGraph Report State as below.
We need to follow the below steps:
Create a service account for your project and safely store the json file
Using the service account JSON, get the access token from Google
Using Oauth 2.0 token as Bearer authorization, invoke Report State API
Step 1:
This is straightforward. Please follow the steps in the below link
https://developers.google.com/assistant/smarthome/develop/report-state#expandable-1
Step 2:
Refer below code to get the Access token using service account json
GoogleCredentials credentials = GoogleCredentials
.fromStream(Helper.class.getClassLoader().getResourceAsStream("smart-home-key.json"))
.createScoped("https://www.googleapis.com/auth/homegraph");
credentials.refreshIfExpired();
AccessToken token = credentials.getAccessToken();
return token.getTokenValue();
Step 3:
Invoke Report State API
curl -X POST -H "Authorization: Bearer [[Access token from Step 2]]"
-H "Content-Type: application/json"
-d #request-body.json
"https://homegraph.googleapis.com/v1/devices:reportStateAndNotification"
Reference Links :
https://developers.google.com/assistant/smarthome/develop/report-state#http-post
https://cloud.google.com/endpoints/docs/openapi/service-account-authentication
https://developers.google.com/identity/protocols/oauth2/service-account#httprest_1
https://developers.google.com/assistant/smarthome/develop/report-state#expandable-1

Requesting additional scopes returing incorect authorization code

This question is regarding Authorization code and include_granted_scopes in Google OAuth2 for incrementally changing scope.
In my web application, I ask for basic profile info as the scope:
https://www.googleapis.com/auth/userinfo.email )
When a Gmail user signs up with us. After the user preforms some actions, I request additional scopes by setting "include_granted_scopes=true" in authorization url.
At this point, my authorization url looks like this:
https://accounts.google.com/o/oauth2/auth?client_id=3490600xyz00-xyz....apps.googleusercontent.com&login_hint=hello#example.com&redirect_uri=https://www.example.com/google-signup-callback&response_type=code&scope=https://mail.google.com https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/gmail.compose https://www.googleapis.com/auth/gmail.modify&access_type=offline&approval_prompt=force&state=da503933-8979-409b-988a-24a9542ad98a&redirect=label&include_granted_scopes=true
Now in the oauth callback I get the same "Authorization code" which I received when I did oauth earlier using basic profile scope. If I try to get the authorization token by calling "https://accounts.google.com/o/oauth2/token" with "grant_type" set to "authorization_code", it returns
"Code was already deemed".
Now how do I get the new "Auth token" and "Refresh token" which has the new scope? The old auth token does not have the new scope even if I refresh it using the old refresh token.
Prompt=consent is used to force the user to reauthenticate.

Resources