Getting Google YouTube API Service Account Access Token in PHP - google-api

Question

I'm trying to obtain an access token from Google so I can use a 'service account' to upload videos to YouTube automatically.
This code:
$credentials = array(
'client_id' => $my_client_id
);
$jwt = JWT::encode($credentials, $private_key);
$client = new Google_Client();
if ($client->authenticate($jwt))
{
// do something
}
Fails with this exception:
Fatal error: Uncaught exception 'Google_Auth_Exception' with message 'Error fetching OAuth2 access token, message: 'invalid_request: Client must specify either client_id or client_assertion, not both'' in /home/google/client/google-api-php-client/src/Google/Auth/OAuth2.php:120
Where am I going wrong?
TY!

Answer 1

I had missed a large section of the documentation as shown here:
https://developers.google.com/accounts/docs/OAuth2ServiceAccount#creatingjwt
I had also missed that the algorithm had to be RSA256 not HSA256 as defaulted to in the JWT PHP encode function.
And further, that I needed to POST a request, appropriately, directly to get an access token to endpoint:
https://www.googleapis.com/oauth2/v3/token
The Google private JSON private key for the service account also was invalid for use by openssl due to the final character being encoded/included as:
\u003d
Swapping this, literally, with:
=
solved that problem.
Here is my now working (ish, see closing statement) code:
$claimset = array(
'iss' => $client_email,
'scope' => 'https://www.googleapis.com/auth/youtube.upload',
'aud' => 'https://www.googleapis.com/oauth2/v3/token',
'exp' => time() + 1800,
'iat' => time(),
'sub' => 'my google account email#gmail.com'); // not sure if reqd
$jwt = JWT::encode($claimset, $private_key, 'RS256');
// Now need to get a token by posting the above to:
// https://www.googleapis.com/oauth2/v3/token
# Our new data
$data = array(
'grant_type' => 'urn:ietf:params:oauth:grant-type:jwt-bearer',
'assertion' => $jwt
);
# Create a connection
$url = 'https://www.googleapis.com/oauth2/v3/token';
$ch = curl_init($url);
# Form data string
$postString = http_build_query($data, '', '&');
# Setting our options
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postString);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
# Get the response
$response = curl_exec($ch);
curl_close($ch);
print "and here is what we got: ";
print_r($response);
exit;
Unfortunately, for some reason the response I'm getting is:
{ "error": "unauthorized_client", "error_description": "Unauthorized client or scope in request." }
Suspect my service account does not yet have the right to upload to YouTube.

Answer 2

I'm not an experr, but you should probably look at removing the "," at the end of you line here:
'client_id' => $private_key['client_id'],
//'client_email' => $private_ket['client_email']
change to:
'client_id' => $private_key['client_id']
//'client_email' => $private_ket['client_email']
I've used this example to get oauth working. It may be helpful:
http://msdn.microsoft.com/en-us/library/dn632721.aspx
you could also try oauth testing here:
https://developers.google.com/oauthplayground/
Good luck!