OAuth 2.0 refresher Talk

OAuth 2.0
+Paul Matthews, Google, Inc.


Agenda
1. What is OAuth 2.0?

1
2

2. Preparation
3. Obtain an Access Token

3

4. Detail of OAuth 2.0 flows
5. Best practice


4
5

What is OAuth 2.0?


What is OAuth 2.0?
● Authorization for AdWords API
● Secure
● Simple
● Standard


The security of OAuth2
● No Usernames or Passwords
● Only Tokens

● Specific Access Control
● Restrict Scope
● Easily revoke


The simplicity of OAuth2

Get Access
Ask approval

Interact with the AdWords API


The standard of OAuth2
● Have you seen the dialog?
● User Consent
●

Accept

●

Cancel


The OAuth2 Flow
Interact with the AdWords API

Grant Access
1) Build URL

3) Exchange Code

Your Application

2) Accept Consent
The MCC User
OAuth2 Servers
The AdWords API
Google Servers

4) Make Request

5) Refresh Access

Access comes with 2 Tokens
● access_token

● refresh_token

● For making requests

● Regenerates access_token

● Lifetime 00:60

● Lifetime indefinite
● Store it!


Preparation


Register your application
http://code.google.com/apis/console
● Get an application identifier
● client_id
● client_secret


Create a new project at Google API Console


Create an OAuth 2.0 client ID


Web server or installed application?
Choose Installed application unless you have many
client accounts that need authorization.

Choose Web server application when using many
separately authorized accounts.


Choose your application type

Installed Application

Now, you have client_id and client_secret


Obtain Access
access_token & refresh_token


Why an Access Token?

Get Access & Refresh Tokens
Ask approval


With or without Client Libraries
● With Client Libraries
● Without Client Libraries


Client Libraries can Help
● Check your library for details!
● Example:
● Run script
● Authorize application
● Add refresh_token to config


How to get an Access Token
1. Construct URL
2. Obtain Consent
3. Receive Authorization Code
4. Exchange Code for Token
5. Store credentials

1. Construct a URL
https://accounts.google.com/o/oauth2/auth?
access_type=offline&
scope=https://adwords.google.com/api/adwords&
redirect_uri=urn:ietf:wg:oauth:2.0:oob&
response_type=code&
client_id=xxxxxxx.apps.googleusercontent.com


2. Obtain Consent
● Send User
● Accept permissions


3. Receive Authorization Code

> Enter authorization code here:
4/v6xr77ewYqhvHSyW6UJ1w7jKwAzu


4. Exchange Code for Token
HTML

POST /o/oauth2/token HTTP/1.1
Host: accounts.google.com
Content-Type: application/x-www-form-urlencoded

code=4/v6xr77ewYqhvHSyW6UJ1w7jKwAzu&
client_id=xxxxxxx.apps.googleusercontent.com&
client_secret={client_secret}&
redirect_uri=&
grant_type=authorization_code


5. Store credentials
{
"access_token" : "yaxx.xxxxxxxxxxxx",
"token_type" : "Bearer",
"expires_in" : 3600,
"refresh_token" : "1/xxxxxxxxxxxxxxxxxxxg"
}


Detail of OAuth 2.0 Flows


OAuth 2.0 Flows Google Supports
Google supports common OAuth 2.0 scenarios
● Installed applications
● Web server applications
● Applications on limited-input devices


Differences Between Flows
Registration to API Registration Use
Console
to API
Authentication
Console
Code

Client
Secret

Refresh
Token

Redirection

Installed
applications

Required

Yes

Required

Available

URL, Text

Web server
applications

Required

Yes

Required

Available

URL

Applications on
limited-input device

Required

-

Required

Available

-


Offline or Online?
Choose offline access when your applications works
while a data owner is not in front of your application
Offline access is good for typical AdWords API client which
access Google Server to fetch user data and set value in
background.


Best Practices


Best Practices
● Use offline as access type to get a refresh_token
● Store refresh_token to get a new access_token
● Use the MCC structure
● Authorize the top MCC


Storing & Sharing
● Storing Access Tokens
● Store the timestamp

● Sharing Access Tokens Between Threads


Useful information for Errors
● AuthenticationError.OAUTH_TOKEN_INVALID
○ On: Access Token expired
○ Resolution: get a new Access Token with Refresh token

● AuthenticationError.INVALID_GRANT_ERROR
○ On: Refresh Token revoked
○ Resolution: re-auth app with user consent


Appendix


Resources


Resources

Docs Links:
https://developers.google.com/accounts/docs/OAuth2
https://developers.google.com/accounts/docs/OAuth2WebServer
https://developers.google.com/accounts/docs/OAuth2InstalledApp
https://developers.google.com/adwords/api/docs/authentication#oauth
https://code.google.com/apis/console

Questions?


OAuth 2.0 refresher Talk

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to OAuth 2.0 refresher Talk

Similar to OAuth 2.0 refresher Talk (20)

More from marcwan

More from marcwan (20)

Recently uploaded

Recently uploaded (20)

OAuth 2.0 refresher Talk