Menu
I know that this is something like a 'RTFM' question, but I can't for the life of me find solid documentation about this.
Specifically, I have a service that uses google's oauth2 REST api to authenticate users. The library I'm using (bell), recently started making calls to the /v2 version of the API endpoint. Those calls no longer seem to support approval_prompt=force in the querystring (or something along those lines, I'm no longer able to use a special route to force a new refresh token).
Realistically, all I need to do is read the documentation for what changed from v1 to v2 of the oauth2 library, or even find v2-specific information. All the documentation on developers.google.com seems to be about the v1 api.
521
OAuth 2.0 clients for web apps must use redirect URIs and JavaScript origins that are compliant with Google's validation rules, including using the HTTPS scheme. Google may reject OAuth requests that don't originate from or resolve to a secure context.
Once the token was generated, OAuth 1.0 required that the client send two security tokens on every API call, and use both to generate the signature. OAuth 2.0 has only one security token, and no signature is required.
OAuth 1 Deprecation. Starting November 30, 2022, API keys will be sunset as an authentication method. Learn more about this change and how to migrate an API key integration to use a private app instead.
A Google Cloud Platform project with an OAuth consent screen configured for an external user type and a publishing status of "Testing" is issued a refresh token expiring in 7 days. There is currently a limit of 100 refresh tokens per Google Account per OAuth 2.0 client ID.
There is no documented list of changes at present. The main changes from/auth to v2/auth, and v3/token to v4/token is that the newer versions are certified compliant with OpenID Connect. The earlier versions had a few inconsistencies with the spec, mostly because when Google launched them the spec was not yet final.
approval_prompt is now prompt. To get your approval_prompt=force behavior on the newer endpoint, specify prompt=consent. Other values for the prompt parameter are defined in section 3.1.2.1 of the spec.
Other changes, in no particular order:
iss value is now https://accounts.google.com, was accounts.google.com
nonce is required for implicit and hybrid flowsprofile scope was requested), saving a call to userinfo.
55
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
