"This app would like to: Have offline access" when access_type=online

Question

I have a Google App with OAuth 2.0 authentication. Everything used to work fine but recently I started getting the following "Request for permission" screen:

The strange part is that I get this screen when I pass access_type=online. Again, this used to work until recently.

What can be the cause for this? TIA

Edit:

The requested scopes are:

https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile

I have already tried:

• with and without access_type=online
• with and without approval_prompt=auto

Edit #2:

This is the python code I'm using to generate the authentication URL:

encoded_params = urllib.urlencode({
    "response_type" : "code",
    "client_id" : MY_CLIENT_ID,
    "scope" : " ".join(MY_SCOPES),
    "redirect_uri" : MY_REDIRECT_URI,
    "state" : random_security_token,
    "access_type" : "online",
    "approval_prompt" : "auto",
    })

auth_url = "https://accounts.google.com/o/oauth2/auth?" + encoded_params

Update (Oct. 14):

Even with the new scopes, I still get the consent screen. Recently I got it for a new device I was using for the authentication.

Answer 1

I think G does this when your app requests a token and there is still a valid access or refresh token for the user for the scopes in question.

The solution is to revoke tokens when you're done with them (either on user logout or immediately after authenticating the user) by issuing this request:

https://accounts.google.com/o/oauth2/revoke?token={token}

You don't have to provide any app credentials, just the token as a URL argument.

(docs here https://developers.google.com/accounts/docs/OAuth2WebServer#tokenrevoke)

I had the same problem and no combination of access_type or approval_prompt values seemed to solve it. Revoking the token did the trick.

I'm not sure how to revoke all outstanding tokens for your app, unless you happened to store them. To test with your own user account, you can manually revoke the existing token for your app here:

https://security.google.com/settings/security/permissions

Answer 2

UPDATE:

The Scope for E-mail is now

email

Legacy Google+ APIs have been shut down as of March 7, 2019. Scopes previously requested by your apps may now be deprecated or invalid. Developers should update their code to remove or update references to Google+, Google+ APIs, and any related OAuth scopes. source: https://developers.google.com/+/scopes-shutdown

-- OLD ANSWER --

Google recently changed the Scope for Email. You should replace

https://www.googleapis.com/auth/userinfo.email

with:

https://www.googleapis.com/auth/plus.profile.emails.read 

and:

https://www.googleapis.com/auth/plus.login

Then the offline access should disappear.

See also:

https://developers.google.com/+/api/oauth#email

Warning: This scope is deprecated. Google will no longer support this scope after Sept. 1, 2014. For details, see Migrating to Google+ Sign-In.

This also changes the way the email address is received:

https://developers.google.com/+/api/auth-migration#email

Also keep in mind that you have to activate the Google+ API in your management console in order for this to work.

Answer 3

Using http://localhost in the redirect_url parameter of the OAuth request will cause the user to be asked to grant offline access the first time they authenticate after each login.