Uploading files to Google Cloud Storage using JSON API, Error 401 Unauthorized

Question

I am trying to figure out how to use the JSON API in Android to upload images to Google Cloud Storage but the documentation for doing so seems to be very limited.

The problem I am having I believe is getting the correct API key authentication. The images that are uploaded are images that are considered public but only public to the users of my app so reading Authorize Requests documentation says that I do not need to provide an OAuth key for public data and I can just send an API key

Public API access: A request that does not provide an OAuth 2.0 token must send an API key. The key identifies your project and provides API access, quota, and reports.

so I went to my console created a key (API Manager/Credentials/Create Credentials/API Key) from my SHA1 of my debug and production keystore's.

these API keys are correct because they are used with other google services like google sign-in and they work fine.

When I try to make a request to start a resumable upload this is what I do

String sUrl = "https://www.googleapis.com/upload/storage/v1/b/myBucket/o?uploadType=resumable&name="+mImgName;
URL url = new URL(sUrl);
HttpURLConnection urlConnection = (HttpURLConnection)url.openConnection();
urlConnection.setRequestProperty("Authorization","AIzaSyDT....");
urlConnection.setRequestProperty("X-Upload-Content-Type","image/png");
urlConnection.setRequestProperty("X-Upload-Content-Length",String.valueOf(fileSize));
urlConnection.setRequestMethod("POST");

however I get back Error 401 Unauthorized so I am assuming it is a problem with the key I am sending.

I also saw at the end of the Authorize Requests document that it states I can put my key as a parameter of the request url

After you have an API key, your application can append the query parameter key=yourAPIKey to all request URLs.

so I dont know if I am suppose to do that or have the Authorization property set in the request or both?

So is the key I created the wrong type of key or is there something I am missing here?

Answer 1

You can use an API key for downloading public objects.

But unless your bucket is enabled for public write, which you generally don't want to do, then you still need to use authentication for uploads to the bucket.

In your case, I think you probably want to use Signed URLs.