CODEWITHSUNDEEP
node.jsgoogle-apigoogle-tasks-apigoogle-tasks
9er
9er

Reputation: 1734

Google API Authentication Tasks API

I want to create a Lambda function that uses the Google Tasks API to add tasks every evening at a certain time.

I am unsure of how to authenticate with my account and be able to store access tokens / credentials securely in my lambda environment variables.

As I understand it since my lambda is making a request on behalf of a user (which will always be me in this case) it seems like everything in the docs points to needing to use OAuth2.0 to authenticate which makes sense since you'd want the user's permission to make changes in their account. However since I only want to do so on my account, I wanted to know if there was a way to simply authorize my account without doing a OAuth flow which I don't believe is possible from a lambda since I won't be responding to it every time it runs.

How would I authenticate my application so I can make calls to the tasks API and be authenticated against my account?

Upvotes: 1

Views: 1108

Answers (1)

Mavi Domates
Mavi Domates

Reputation: 4521

This is surprisingly more work than I'd imagined and unfortunately google doesn't generate developer tokens which would have solved a lot of this problem.

Authorization & Consent

  1. There are no immediate ways of authorizing your account for the app that you've created without going through the consent flow. Some cloud service providers generate a developer token for testing your app with your credentials - but google doesn't seem to have this functionality. Not for the Tasks API anyways. AdWords API talks about a developer token but I'm not sure if it's the same concept.

  2. You won't have to re-authorize once you've given consent. This general principal applies to other OAuth using parties, unless the level of consent changes (example: the app starts asking for write permissions in addition to previously consented read) you won't get re-prompted. If permission levels change, you'll get re-prompted.

Now - the second part - how do you make one?

Google explains it in detail here - but I'll further simplify because you don't need to setup a web-server for your case, you're only doing this for yourself.

Our goal is to only to get you the initial refresh token. Once you've retrieved the refresh token, you can use that from your Lambda to retrieve a new access + refresh token whenever you're accessing the tasks API. You just need to keep the refresh token stored somewhere, so you can continuously keep on accessing the tasks API. You're just looking to get the access + refresh token.

  1. Head over to https://console.developers.google.com and create a new application.

  2. After the creation, click 'Enable APIs and Services' and look for Tasks API.

  3. Proceed with creating the credentials and make sure you select you'll be calling this API from a Web Server. Selecting Browser (JavaScript) would only give you an access token and not a refresh token, because they would trust you to store the refresh token on your server, but not on a browser. An access token is time-limited to (conventionally) 60 minutes.

  4. You should also select the User Data / Information and not the App Data / Information for the types of data you want to access. The app one is generally used for GSuite.

  5. Set your redirect uri to be http://localhost:8080 - This is where you normally would need a web-server but we'll just redirect back to your machine and get the parameter from here. It obviously won't find a web-server but the parameter we want is in the url, we'll just copy it.

  6. Now here comes the authentication part. Google's auth url is: https://accounts.google.com/o/oauth2/v2/auth

    We will add parameters to this url

    so the whole thing should look like https://accounts.google.com/o/oauth2/v2/auth?access_type=offline&response_type=code&scope=https://www.googleapis.com/auth/tasks&redirect_uri=http://localhost:8080&client_id=

    Go to this URL and you should get prompted for consent. Consent to it and google should redirect you to http://localhost:8080/?code= We'll need that code. That needs to be sent to google to get an access + refresh token.

  7. Code exchange: Make a post request to Google. You can use PostMan. Again normally all of this would be automatically handled by a webserver (detect code parameter, make post request etc..) - but we just need the refresh token here, so we can stick that into our Lambda app.

POST to:

https://www.googleapis.com/oauth2/v4/token

with parameters:

code=<the code you've retrieved>
client_id=<your_client_id>&
client_secret=<your_client_secret>&
redirect_uri=http://localhost:8080&
grant_type=authorization_code

Google should return you the access token and the refresh token. From this point on you need to save the refresh token into your Lambda app - and if it's running on a scheduled job on every bootup:

  1. Read the refresh token
  2. Call Google for a new refresh token + access token
  3. Save the new refresh token.
  4. Use the access token to access your Tasks API.

Upvotes: 1

Related Questions