Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Single oauth token and secret to access multiple services from google

I am using oauth to access different services provided by google.I am able to generate token per service basis. But I want to generate single token to use multiple services from google. Can anyone tell me the solution for this?

like image 617
user1223379 Avatar asked Feb 21 '12 13:02

user1223379


People also ask

Can you have multiple access tokens?

Access tokens are generated for an application, not a user, but yes, there can be multiple access tokens authorized by a single user - the user authorizes the application to perform some operations (scopes) on his behalf.

What is Google OAuth token?

The id_token is used in OpenID Connect protocol, where the user is authenticated as well as authorized. (There's an important distinction between authentication and authorization.) You will get id_token and access_token. The id_token value contains the information about the user's authentication.


1 Answers

https://developers.google.com/accounts/docs/OAuth2

As per the Google OAuth2 docs, it is possible to do this by setting multiple scopes, but be warned, it isn't a happy experience.

When making your request, set the scope parameter to multiple scopes, each separated by a single space.

Example: "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://www.google.com/m8/feeds"

You can currently find a list of scopes here: https://developers.google.com/gdata/faq

Unfortunately, API access is not additive, meaning, if you ask for an access token for the Google Contacts API, then later on as the same application ask for an access token for the Google Profile API, you will end up with two access tokens, and neither can be used to access the other API. Facebook at least has the decency to give you back a single access token that grants access to all the permissions granted so far.

Because of this, you are left having to keep track of multiple access tokens (a horrible nightmare, given they expire very quickly), or ask for all of your permissions up-front, which is a user experience disaster.

Fragmented and disparate, the Google APIs are currently setup to fail if you want to do tight, multi-faceted integration.

like image 146
majelbstoat Avatar answered Nov 15 '22 09:11

majelbstoat