This document explains how web server applications use Google API Client Libraries or Google OAuth 2.0 endpoints to implement OAuth 2.0 authorization to access Google APIs. OAuth 2.0 allows users to share specific data with an application while keeping their usernames, passwords, and other information private. For example, an application can use OAuth 2.0 to obtain permission from users to store files in their Google Drives.
This OAuth 2.0 flow is specifically for user authorization. It is designed for applications that can store confidential information and maintain state. A properly authorized web server application can access an API while the user interacts with the application or after the user has left the application.
Web server applications frequently also use service accounts to authorize API requests, particularly when calling Cloud APIs to access project-based data rather than user-specific data. Web server applications can use service accounts in conjunction with user authorization.
Client libraries
The language-specific examples on this page use Google API Client Libraries to implement OAuth 2.0 authorization. To run the code samples, you must first install the client library for your language.
When you use a Google API Client Library to handle your application's OAuth 2.0 flow, the client library performs many actions that the application would otherwise need to handle on its own. For example, it determines when the application can use or refresh stored access tokens as well as when the application must reacquire consent. The client library also generates correct redirect URLs and helps to implement redirect handlers that exchange authorization codes for access tokens.
Client libraries are available for the following languages:
Prerequisites
Enable APIs for your project
Any application that calls Google APIs needs to enable those APIs in the API Console. To enable the appropriate APIs for your project:
- Open the Library page in the API Console.
- Select the project associated with your application. Create a project if you do not have one already.
- Use the Library page to find each API that your application will use. Click on each API and enable it for your project.
Create authorization credentials
Any application that uses OAuth 2.0 to access Google APIs must have authorization credentials that identify the application to Google's OAuth 2.0 server. The following steps explain how to create credentials for your project. Your applications can then use the credentials to access APIs that you have enabled for that project.
- Open the Credentials page in the API Console.
- Click Create credentials > OAuth client ID.
- Complete the form. Set the application type to
Web application
. Applications that use languages and frameworks like PHP, Java, Python, Ruby, and .NET must specify authorized redirect URIs. The redirect URIs are the endpoints to which the OAuth 2.0 server can send responses.
For testing, you can specify URIs that refer to the local machine, such ashttp://localhost:8080
. With that in mind, please note that all of the examples in this document usehttp://localhost:8080
as the redirect URI.
We recommend that you design your app's auth endpoints so that your application does not expose authorization codes to other resources on the page.
After creating your credentials, download the client_secret.json file from the API Console. Securely store the file in a location that only your application can access.
Identify access scopes
Scopes enable your application to only request access to the resources that it needs while also enabling users to control the amount of access that they grant to your application. Thus, there may be an inverse relationship between the number of scopes requested and the likelihood of obtaining user consent.
Before you start implementing OAuth 2.0 authorization, we recommend that you identify the scopes that your app will need permission to access.
We also recommend that your application request access to authorization scopes via an incremental authorization process, in which your application requests access to user data in context. This best practice helps users to more easily understand why your application needs the access it is requesting.
The OAuth 2.0 API Scopes document contains a full list of scopes that you might use to access Google APIs.
Language-specific requirements
To run any of the code samples in this document, you'll need a Google account, access to the Internet, and a web browser. If you are using one of the API client libraries, also see the language-specific requirements below.
PHP
To run the PHP code samples in this document, you'll need:
- PHP 5.4 or greater with the command-line interface (CLI) and JSON extension installed.
- The Composer dependency management tool.
-
The Google APIs Client Library for PHP:
php composer.phar require google/apiclient:^2.0
Python
To run the Python code samples in this document, you'll need:
- Python 2.6 or greater
- The pip package management tool.
-
The Google APIs Client Library for Python:
pip install --upgrade google-api-python-client
-
The
google-auth
,google-auth-oauthlib
, andgoogle-auth-httplib2
for user authorization.pip install --upgrade google-auth google-auth-oauthlib google-auth-httplib2
-
The Flask Python web application framework.
pip install --upgrade flask
-
The
requests
HTTP library.pip install --upgrade requests
Ruby
To run the Ruby code samples in this document, you'll need:
- Ruby 2.2.2 or greater
-
The Google APIs Client Library for Ruby:
gem install google-api-client
-
The Sinatra Ruby web application framework.
gem install sinatra
HTTP/REST
You do not need to install any libraries to be able to directly call the OAuth 2.0 endpoints.
Obtaining OAuth 2.0 access tokens
The following steps show how your application interacts with Google's OAuth 2.0 server to obtain a user's consent to perform an API request on the user's behalf. Your application must have that consent before it can execute a Google API request that requires user authorization.
The list below quickly summarizes these steps:
- Your application identifies the permissions it needs.
- Your application redirects the user to Google along with the list of requested permissions.
- The user decides whether to grant the permissions to your application.
- Your application finds out what the user decided.
- If the user granted the requested permissions, your application retrieves tokens needed to make API requests on the user's behalf.
Step 1: Set authorization parameters
Your first step is to create the authorization request. That request sets parameters that identify your application and define the permissions that the user will be asked to grant to your application.
-
If you use a Google client library for OAuth 2.0 authentication and authorization, you create and configure an object that defines these parameters.
-
If you call the Google OAuth 2.0 endpoint directly, you'll generate a URL and set the parameters on that URL.
The tabs below define the supported authorization parameters for web server applications. The language-specific examples also show how to use a client library or authorization library to configure an object that sets those parameters.
PHP
The code snippet below creates a Google_Client()
object,
which defines the parameters in the authorization request.
That object uses information from your client_secret.json file to identify your application. (See creating authorization credentials for more about that file.) The object also identifies the scopes that your application is requesting permission to access and the URL to your application's auth endpoint, which will handle the response from Google's OAuth 2.0 server. Finally, the code sets the optional access_type and include_granted_scopes parameters.
For example, this code requests read-only, offline access to a user's Google Drive:
$client = new Google_Client(); $client->setAuthConfig('client_secret.json'); $client->addScope(Google_Service_Drive::DRIVE_METADATA_READONLY); $client->setRedirectUri('http://' . $_SERVER['HTTP_HOST'] . '/oauth2callback.php'); $client->setAccessType('offline'); // offline access $client->setIncludeGrantedScopes(true); // incremental auth
The request specifies the following information:
Parameters | |||||||
---|---|---|---|---|---|---|---|
client_id |
Required. The client ID for your application. You can find
this value in the API Console.
In PHP, call the setAuthConfig function to load
authorization credentials from a client_secret.json file.
$client = new Google_Client(); $client->setAuthConfig('client_secret.json'); |
||||||
redirect_uri |
Required.
Determines where the API server redirects the user after the user
completes the authorization flow. The value must exactly match one of the
authorized redirect URIs for the OAuth 2.0 client, which you configured in
the API Console. If this value doesn't match an authorized URI,
you will get a 'redirect_uri_mismatch' error.
Note that the http or
https scheme, case, and trailing slash ('/ ')
must all match.
To set this value in PHP, call the setRedirectUri function.
Note that you must specify a valid redirect URI for your
API Console project.
$client->setRedirectUri('http://localhost:8080/oauth2callback.php'); |
||||||
scope |
Required. A
space-delimited
list of scopes that identify the
resources that your application could access on the user's behalf. These
values inform the consent screen that Google displays to the user. Scopes enable your application to only request access to the resources that it needs while also enabling users to control the amount of access that they grant to your application. Thus, there is an inverse relationship between the number of scopes requested and the likelihood of obtaining user consent. To set this value in PHP, call the addScope function:
$client->addScope(Google_Service_Drive::DRIVE_METADATA_READONLY);The OAuth 2.0 API Scopes document provides a full list of scopes that you might use to access Google APIs. We recommend that your application request access to authorization scopes in context whenever possible. By requesting access to user data in context, via incremental authorization, you help users to more easily understand why your application needs the access it is requesting. |
||||||
access_type |
Recommended. Indicates whether your application can refresh
access tokens when the user is not present at the browser. Valid parameter
values are online , which is the default value, and
offline .Set the value to offline if your application needs to refresh
access tokens when the user is not present at the browser. This is the
method of refreshing access tokens described later in this document. This
value instructs the Google authorization server to return a refresh token
and an access token the first time that your application exchanges
an authorization code for tokens.
To set this value in PHP, call the setAccessType function:
$client->setAccessType('offline'); |
||||||
state |
Recommended. Specifies any string value that your application
uses to maintain state between your authorization request and the
authorization server's response. The server returns the exact value that
you send as a name=value pair in the hash
(# ) fragment of the
redirect_uri after the user consents
to or denies your application's access request.You can use this parameter for several purposes, such as directing the user to the correct resource in your application, sending nonces, and mitigating cross-site request forgery. Since your redirect_uri
can be guessed, using a state value can increase your
assurance that an incoming connection is the result of an authentication
request. If you generate a random string or encode the hash of a cookie or
another value that captures the client's state, you can validate the
response to additionally ensure that the request and response originated
in the same browser, providing protection against attacks such as
cross-site request forgery. See the OpenID Connect
documentation for an example of how to create and confirm a
state token.
To set this value in PHP, call the setState function:
$client->setState($sample_passthrough_value); |
||||||
include_granted_scopes |
Optional. Enables applications to use incremental authorization
to request access to additional scopes in context. If you set this
parameter's value to true and the authorization request is
granted, then the new access token will also cover any scopes to which the
user previously granted the application access. See the
incremental authorization section
for examples.
To set this value in PHP, call the setIncludeGrantedScopes
function:
$client->setIncludeGrantedScopes(true); |
||||||
login_hint |
Optional. If your application knows which user is trying to
authenticate, it can use this parameter to provide a hint to the Google
Authentication Server. The server uses the hint to simplify the login
flow either by prefilling the email field in the sign-in form or by
selecting the appropriate multi-login session. Set the parameter value to an email address or sub
identifier, which is equivalent to the user's Google ID.
To set this value in PHP, call the setLoginHint function:
$client->setLoginHint('user@example.com'); |
||||||
prompt |
Optional. A space-delimited, case-sensitive list of prompts to
present the user. If you don't specify this parameter, the user will be
prompted only the first time your app requests access.
To set this value in PHP, call the setApprovalPrompt
function:
$client->setApprovalPrompt('consent');Possible values are:
|
Python
The following code snippet uses the google-auth-oauthlib.flow
module to construct the authorization request.
The code constructs a Flow
object, which identifies your
application using information from the client_secret.json file
that you downloaded after creating authorization
credentials. That object also identifies the scopes that your
application is requesting permission to access and the URL to your
application's auth endpoint, which will handle the response from Google's
OAuth 2.0 server. Finally, the code sets the optional
access_type
and include_granted_scopes
parameters.
For example, this code requests read-only, offline access to a user's Google Drive:
import google.oauth2.credentials import google_auth_oauthlib.flow # Use the client_secret.json file to identify the application requesting # authorization. The client ID (from that file) and access scopes are required. flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file( 'client_secret.json', scope=['https://www.googleapis.com/auth/drive.metadata.readonly']) # Indicate where the API server will redirect the user after the user completes # the authorization flow. The redirect URI is required. The value must exactly # match one of the authorized redirect URIs for the OAuth 2.0 client, which you # configured in the API Console. If this value doesn't match an authorized URI, # you will get a 'redirect_uri_mismatch' error. flow.redirect_uri = 'https://www.example.com/oauth2callback' # Generate URL for request to Google's OAuth 2.0 server. # Use kwargs to set optional request parameters. authorization_url, state = flow.authorization_url( # Enable offline access so that you can refresh an access token without # re-prompting the user for permission. Recommended for web server apps. access_type='offline', # Enable incremental authorization. Recommended as a best practice. include_granted_scopes='true')
The request specifies the following information:
Parameters | |||||||
---|---|---|---|---|---|---|---|
client_id |
Required. The client ID for your application. You can find
this value in the API Console.
In Python, call the from_client_secrets_file method to
retrieve the client ID from a client_secret.json file. (You can
also use the from_client_config method, which passes the
client configuration as it originally appeared in a client secrets file
but doesn't access the file itself.)
flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file( 'client_secret.json', scope=['https://www.googleapis.com/auth/drive.metadata.readonly']) |
||||||
redirect_uri |
Required.
Determines where the API server redirects the user after the user
completes the authorization flow. The value must exactly match one of the
authorized redirect URIs for the OAuth 2.0 client, which you configured in
the API Console. If this value doesn't match an authorized URI,
you will get a 'redirect_uri_mismatch' error.
Note that the http or
https scheme, case, and trailing slash ('/ ')
must all match.
To set this value in Python, set the flow object's
redirect_uri property:
flow.redirect_uri = 'https://www.example.com/oauth2callback' |
||||||
scope |
Required. A
list of scopes that identify the
resources that your application could access on the user's behalf. These
values inform the consent screen that Google displays to the user. Scopes enable your application to only request access to the resources that it needs while also enabling users to control the amount of access that they grant to your application. Thus, there is an inverse relationship between the number of scopes requested and the likelihood of obtaining user consent. In Python, use the same method you use to set the client_id to specify the list
of scopes.
flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file( 'client_secret.json', scope=['https://www.googleapis.com/auth/drive.metadata.readonly'])The OAuth 2.0 API Scopes document provides a full list of scopes that you might use to access Google APIs. We recommend that your application request access to authorization scopes in context whenever possible. By requesting access to user data in context, via incremental authorization, you help users to more easily understand why your application needs the access it is requesting. |
||||||
access_type |
Recommended. Indicates whether your application can refresh
access tokens when the user is not present at the browser. Valid parameter
values are online , which is the default value, and
offline .Set the value to offline if your application needs to refresh
access tokens when the user is not present at the browser. This is the
method of refreshing access tokens described later in this document. This
value instructs the Google authorization server to return a refresh token
and an access token the first time that your application exchanges
an authorization code for tokens.
In Python, set the access_type parameter by specifying
access_type as a keyword argument when calling the
flow.authorization_url method:
authorization_url, state = flow.authorization_url( access_type='offline', include_granted_scopes='true') |
||||||
state |
Recommended. Specifies any string value that your application
uses to maintain state between your authorization request and the
authorization server's response. The server returns the exact value that
you send as a name=value pair in the hash
(# ) fragment of the
redirect_uri after the user consents
to or denies your application's access request.You can use this parameter for several purposes, such as directing the user to the correct resource in your application, sending nonces, and mitigating cross-site request forgery. Since your redirect_uri
can be guessed, using a state value can increase your
assurance that an incoming connection is the result of an authentication
request. If you generate a random string or encode the hash of a cookie or
another value that captures the client's state, you can validate the
response to additionally ensure that the request and response originated
in the same browser, providing protection against attacks such as
cross-site request forgery. See the OpenID Connect
documentation for an example of how to create and confirm a
state token.
In Python, set the state parameter by specifying
state as a keyword argument when calling the
flow.authorization_url method:
authorization_url, state = flow.authorization_url( access_type='offline', state=sample_passthrough_value, include_granted_scopes='true') |
||||||
include_granted_scopes |
Optional. Enables applications to use incremental authorization
to request access to additional scopes in context. If you set this
parameter's value to true and the authorization request is
granted, then the new access token will also cover any scopes to which the
user previously granted the application access. See the
incremental authorization section
for examples.
In Python, set the include_granted_scopes parameter by
specifying include_granted_scopes as a keyword argument
when calling the flow.authorization_url method:
authorization_url, state = flow.authorization_url( access_type='offline', include_granted_scopes='true') |
||||||
login_hint |
Optional. If your application knows which user is trying to
authenticate, it can use this parameter to provide a hint to the Google
Authentication Server. The server uses the hint to simplify the login
flow either by prefilling the email field in the sign-in form or by
selecting the appropriate multi-login session. Set the parameter value to an email address or sub
identifier, which is equivalent to the user's Google ID.
In Python, set the login_hint parameter by specifying
login_hint as a keyword argument when calling the
flow.authorization_url method:
authorization_url, state = flow.authorization_url( access_type='offline', login_hint='user@example.com', include_granted_scopes='true') |
||||||
prompt |
Optional. A space-delimited, case-sensitive list of prompts to
present the user. If you don't specify this parameter, the user will be
prompted only the first time your app requests access.
In Python, set the prompt parameter by specifying
prompt as a keyword argument when calling the
flow.authorization_url method:
authorization_url, state = flow.authorization_url( access_type='offline', prompt='consent', include_granted_scopes='true')Possible values are:
|
Ruby
Use the client_secrets.json file that you created to configure a client object in your application. When you configure a client object, you specify the scopes your application needs to access, along with the URL to your application's auth endpoint, which will handle the response from the OAuth 2.0 server.
For example, this code requests read-only, offline access to a user's Google Drive:
require 'google/apis/drive_v2' require 'google/api_client/client_secrets' client_secrets = Google::APIClient::ClientSecrets.load auth_client = client_secrets.to_authorization auth_client.update!( :scope => 'https://www.googleapis.com/auth/drive.metadata.readonly', :redirect_uri => 'http://www.example.com/oauth2callback', :additional_parameters => { "access_type" => "offline", # offline access "include_granted_scopes" => "true" # incremental auth } )
Your application uses the client object to perform OAuth 2.0 operations, such as generating authorization request URLs and applying access tokens to HTTP requests.
HTTP/REST
Google's OAuth 2.0 endpoint is at https://accounts.google.com/o/oauth2/v2/auth
.
This endpoint is accessible only over HTTPS. Plain HTTP connections are
refused.
The Google authorization server supports the following query string parameters for web server applications:
Parameters | |||||||
---|---|---|---|---|---|---|---|
client_id |
Required. The client ID for your application. You can find this value in the API Console. | ||||||
redirect_uri |
Required.
Determines where the API server redirects the user after the user
completes the authorization flow. The value must exactly match one of the
authorized redirect URIs for the OAuth 2.0 client, which you configured in
the API Console. If this value doesn't match an authorized URI,
you will get a 'redirect_uri_mismatch' error.
Note that the http or
https scheme, case, and trailing slash ('/ ')
must all match.
|
||||||
scope |
Required. A
space-delimited
list of scopes that identify the
resources that your application could access on the user's behalf. These
values inform the consent screen that Google displays to the user. Scopes enable your application to only request access to the resources that it needs while also enabling users to control the amount of access that they grant to your application. Thus, there is an inverse relationship between the number of scopes requested and the likelihood of obtaining user consent. The OAuth 2.0 API Scopes document provides a full list of scopes that you might use to access Google APIs. We recommend that your application request access to authorization scopes in context whenever possible. By requesting access to user data in context, via incremental authorization, you help users to more easily understand why your application needs the access it is requesting. |
||||||
access_type |
Recommended. Indicates whether your application can refresh
access tokens when the user is not present at the browser. Valid parameter
values are online , which is the default value, and
offline .Set the value to offline if your application needs to refresh
access tokens when the user is not present at the browser. This is the
method of refreshing access tokens described later in this document. This
value instructs the Google authorization server to return a refresh token
and an access token the first time that your application exchanges
an authorization code for tokens.
|
||||||
state |
Recommended. Specifies any string value that your application
uses to maintain state between your authorization request and the
authorization server's response. The server returns the exact value that
you send as a name=value pair in the hash
(# ) fragment of the
redirect_uri after the user consents
to or denies your application's access request.You can use this parameter for several purposes, such as directing the user to the correct resource in your application, sending nonces, and mitigating cross-site request forgery. Since your redirect_uri
can be guessed, using a state value can increase your
assurance that an incoming connection is the result of an authentication
request. If you generate a random string or encode the hash of a cookie or
another value that captures the client's state, you can validate the
response to additionally ensure that the request and response originated
in the same browser, providing protection against attacks such as
cross-site request forgery. See the OpenID Connect
documentation for an example of how to create and confirm a
state token.
|
||||||
include_granted_scopes |
Optional. Enables applications to use incremental authorization
to request access to additional scopes in context. If you set this
parameter's value to true and the authorization request is
granted, then the new access token will also cover any scopes to which the
user previously granted the application access. See the
incremental authorization section
for examples.
|
||||||
login_hint |
Optional. If your application knows which user is trying to
authenticate, it can use this parameter to provide a hint to the Google
Authentication Server. The server uses the hint to simplify the login
flow either by prefilling the email field in the sign-in form or by
selecting the appropriate multi-login session. Set the parameter value to an email address or sub
identifier, which is equivalent to the user's Google ID.
|
||||||
prompt |
Optional. A space-delimited, case-sensitive list of prompts to
present the user. If you don't specify this parameter, the user will be
prompted only the first time your app requests access.
Possible values are:
|
Step 2: Redirect to Google's OAuth 2.0 server
Redirect the user to Google's OAuth 2.0 server to initiate the authentication and authorization process. Typically, this occurs when your application first needs to access the user's data. In the case of incremental authorization, this step also occurs when your application first needs to access additional resources that it does not yet have permission to access.
PHP
- Generate a URL to request access from Google's OAuth 2.0 server:
$auth_url = $client->createAuthUrl();
- Redirect the user to
$auth_url
:header('Location: ' . filter_var($auth_url, FILTER_SANITIZE_URL));
Python
This example shows how to redirect the user to the authorization URL using the Flask web application framework:
return flask.redirect(authorization_url)
Ruby
- Generate a URL to request access from Google's OAuth 2.0 server:
auth_uri = auth_client.authorization_uri.to_s
- Redirect the user to
auth_uri
.
HTTP/REST
Sample redirect to Google's authorization server
An example URL is shown below, with line breaks and spaces for readability.
https://accounts.google.com/o/oauth2/v2/auth?
scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdrive.metadata.readonly&
access_type=offline&
include_granted_scopes=true&
state=state_parameter_passthrough_value&
redirect_uri=http%3A%2F%2Foauth2.example.com%2Fcallback&
response_type=code&
client_id=client_id
After you create the request URL, redirect the user to it.
Google's OAuth 2.0 server authenticates the user and obtains consent from the user for your application to access the requested scopes. The response is sent back to your application using the redirect URL you specified.
Step 3: Google prompts user for consent
In this step, the user decides whether to grant your application the requested access. At this stage, Google displays a consent window that shows the name of your application and the Google API services that it is requesting permission to access with the user's authorization credentials. The user can then consent or refuse to grant access to your application.
Your application doesn't need to do anything at this stage as it waits for the response from Google's OAuth 2.0 server indicating whether the access was granted. That response is explained in the following step.
Step 4: Handle the OAuth 2.0 server response
The OAuth 2.0 server responds to your application's access request by using the URL specified in the request.
If the user approves the access request, then the response contains an authorization code. If the user does not approve the request, the response contains an error message. The authorization code or error message that is returned to the web server appears on the query string, as shown below:
An error response:
https://oauth2.example.com/auth?error=access_denied
An authorization code response:
https://oauth2.example.com/auth?code=4/P7q7W91a-oMsCeLvIaQm6bTrgtp7
Important: If your
response endpoint renders an HTML page, any resources on that page will be
able to see the authorization code in the URL. Scripts can read the URL
directly, and the URL in the Referer
HTTP header may be sent
to any or all resources on the page.
Carefully consider whether you want to send authorization credentials to all
resources on that page (especially third-party scripts such as social plugins
and analytics). To avoid this issue, we recommend that the server first handle
the request, then redirect to another URL that doesn't include the response
parameters.
Sample OAuth 2.0 server response
You can test this flow by clicking on the following sample URL, which requests read-only access to view metadata for files in your Google Drive:
https://accounts.google.com/o/oauth2/v2/auth? scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdrive.metadata.readonly& access_type=offline& include_granted_scopes=true& state=state_parameter_passthrough_value& redirect_uri=http%3A%2F%2Foauth2.example.com%2Fcallback& response_type=code& client_id=client_id
After completing the OAuth 2.0 flow, you should be redirected to
http://localhost/oauth2callback
, which will likely yield a
404 NOT FOUND
error unless your local machine serves a file
at that address. The next step provides more detail about the information
returned in the URI when the user is redirected back to your application.
Step 5: Exchange authorization code for refresh and access tokens
After the web server receives the authorization code, it can exchange the authorization code for an access token.
PHP
To exchange an authorization code for an access token, use the
authenticate
method:
$client->authenticate($_GET['code']);
You can retrieve the access token with the getAccessToken
method:
$access_token = $client->getAccessToken();
Python
On your callback page, use the google-auth
library to verify
the authorization server response. Then, use the
flow.fetch_token
method to exchange the authorization code
in that response for an access token:
state = flask.session['state'] flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file( 'client_secret.json', scopes=['https://www.googleapis.com/auth/youtube.force-ssl'], state=state) flow.redirect_uri = flask.url_for('oauth2callback', _external=True) authorization_response = flask.request.url flow.fetch_token(authorization_response=authorization_response) # Store the credentials in the session. # ACTION ITEM for developers: # Store user's access and refresh tokens in your data store if # incorporating this code into your real app. credentials = flow.credentials flask.session['credentials'] = { 'token': credentials.token, 'refresh_token': credentials.refresh_token, 'token_uri': credentials.token_uri, 'client_id': credentials.client_id, 'client_secret': credentials.client_secret, 'scopes': credentials.scopes}
Ruby
To exchange an authorization code for an access token, use the
fetch_access_token!
method:
auth_client.code = auth_code auth_client.fetch_access_token!
HTTP/REST
To exchange an authorization code for an access token, call the
https://www.googleapis.com/oauth2/v4/token
endpoint and set the following parameters:
Fields | |
---|---|
code |
The authorization code returned from the initial request. |
client_id |
The client ID obtained from the API Console. |
client_secret |
The client secret obtained from the API Console. |
redirect_uri |
One of the redirect URIs listed for your project in the API Console. |
grant_type |
As defined in the OAuth 2.0 specification, this field must contain a
value of authorization_code . |
The following snippet shows a sample request:
POST /oauth2/v4/token HTTP/1.1 Host: www.googleapis.com Content-Type: application/x-www-form-urlencoded code=4/P7q7W91a-oMsCeLvIaQm6bTrgtp7& client_id=your_client_id& client_secret=your_client_secret& redirect_uri=https://oauth2.example.com/code& grant_type=authorization_code
Google responds to this request by returning a JSON object that contains a
short-lived access token and a refresh token.
Note that the refresh token is only returned if your application set the
access_type
parameter to offline
in the initial
request to Google's authorization server.
The response contains the following fields:
Fields | |
---|---|
access_token |
The token that your application sends to authorize a Google API request. |
refresh_token |
A token that you can use to obtain a new access token. Refresh tokens
are valid until the user revokes access.
Again, this field is only present in this response if you set the
access_type parameter to offline in the
initial request to Google's authorization server.
|
expires_in |
The remaining lifetime of the access token in seconds. |
token_type |
The type of token returned. At this time, this field's value is always
set to Bearer . |
Important: Your application should store both tokens in a secure, long-lived location that is accessible between different invocations of your application. The refresh token enables your application to obtain a new access token if the one that you have expires. As such, if your application loses the refresh token, the user will need to repeat the OAuth 2.0 consent flow so that your application can obtain a new refresh token.
The following snippet shows a sample response:
{ "access_token":"1/fFAGRNJru1FTz70BzhT3Zg", "expires_in":3920, "token_type":"Bearer", "refresh_token":"1/xEoDL4iW3cxlI7yDbSRFYNG01kVKM2C-259HOF2aQbI" }
Calling Google APIs
PHP
Use the access token to call Google APIs by completing the following steps:
- If you need to apply an access token to a new
Google_Client
object—for example, if you stored the access token in a user session—use thesetAccessToken
method:$client->setAccessToken($access_token);
- Build a service object for the API that you want to call. You build a
a service object by providing an authorized
Google_Client
object to the constructor for the API you want to call. For example, to call the Drive API:$drive = new Google_Service_Drive($client);
- Make requests to the API service using the
interface
provided by the service object.
For example, to list the files in the authenticated user's Google Drive:
$files = $drive->files->listFiles(array())->getItems();
Python
After obtaining an access token, your application can use that token to authorize API requests on behalf of a given user account or service account. Use the user-specific authorization credentials to build a service object for the API that you want to call, and then use that object to make authorized API requests.
- Build a service object for the API that you want to call. You build a
service object by calling the
googleapiclient.discovery
library'sbuild
method with the name and version of the API and the user credentials: For example, to call version 2 of the Drive API:from googleapiclient.discovery import build drive = build('drive', 'v2', credentials=credentials)
- Make requests to the API service using the
interface
provided by the service object.
For example, to list the files in the authenticated user's Google Drive:
files = drive.files().list().execute()
Ruby
Use the auth_client
object to call Google APIs by
completing the following steps:
- Build a service object for the API that you want to call.
For example, to call version 2 of the Drive API:
drive = Google::Apis::DriveV2::DriveService.new
- Set the credentials on the service:
drive.authorization = auth_client
- Make requests to the API service using the
interface
provided by the service object.
For example, to list the files in the authenticated user's Google Drive:
files = drive.list_files
Alternately, authorization can be provided on a per-method basis by supplying the options
parameter to a method:
files = drive.list_files(options: { authorization: auth_client })
HTTP/REST
After your application obtains an access token, you can use the token to
make calls to a Google API on behalf of a given user account or service
account. To do this, include the access token in a request to the API by
including either an access_token
query parameter or an
Authorization: Bearer
HTTP header. When possible, the HTTP header
is preferable, because query strings tend to be visible in server logs. In most
cases you can use a client library to set up your calls to Google APIs (for
example, when calling the
Drive Files API).
You can try out all the Google APIs and view their scopes at the OAuth 2.0 Playground.
HTTP GET examples
A call to the drive.files
endpoint (the Drive Files API) using the Authorization: Bearer
HTTP header might look like the following. Note that you need to specify your own access token:
GET /drive/v2/files HTTP/1.1
Authorization: Bearer <access_token>
Host: www.googleapis.com/
Here is a call to the same API for the authenticated user using the
access_token
query string parameter:
GET https://www.googleapis.com/drive/v2/files?access_token=<access_token>
curl
examples
You can test these commands with the curl
command-line application. Here's an example that uses the HTTP header option (preferred):
curl -H "Authorization: Bearer <access_token>
" https://www.googleapis.com/drive/v2/files
Or, alternatively, the query string parameter option:
curl https://www.googleapis.com/drive/v2/files?access_token=<access_token>
Complete example
The following example prints a JSON-formatted list of files in a user's Google Drive after the user authenticates and gives consent for the application to access the user's Drive files.
PHP
To run this example:
- In the API Console, add the URL of the local machine to the
list of redirect URLs. For example, add
http://localhost:8080
. - Create a new directory and change to it. For example:
mkdir ~/php-oauth2-example cd ~/php-oauth2-example
- Install the
Google API Client Library for PHP using
Composer:
composer require google/apiclient:^2.0
- Create the files
index.php
andoauth2callback.php
with the content below. - Run the example with a web server configured to serve PHP. If you use PHP
5.4 or newer, you can use PHP's built-in test web server:
php -S localhost:8080 ~/php-oauth2-example
index.php
<?php require_once __DIR__.'/vendor/autoload.php'; session_start(); $client = new Google_Client(); $client->setAuthConfig('client_secrets.json'); $client->addScope(Google_Service_Drive::DRIVE_METADATA_READONLY); if (isset($_SESSION['access_token']) && $_SESSION['access_token']) { $client->setAccessToken($_SESSION['access_token']); $drive = new Google_Service_Drive($client); $files = $drive->files->listFiles(array())->getItems(); echo json_encode($files); } else { $redirect_uri = 'http://' . $_SERVER['HTTP_HOST'] . '/oauth2callback.php'; header('Location: ' . filter_var($redirect_uri, FILTER_SANITIZE_URL)); }
oauth2callback.php
<?php require_once __DIR__.'/vendor/autoload.php'; session_start(); $client = new Google_Client(); $client->setAuthConfigFile('client_secrets.json'); $client->setRedirectUri('http://' . $_SERVER['HTTP_HOST'] . '/oauth2callback.php'); $client->addScope(Google_Service_Drive::DRIVE_METADATA_READONLY); if (! isset($_GET['code'])) { $auth_url = $client->createAuthUrl(); header('Location: ' . filter_var($auth_url, FILTER_SANITIZE_URL)); } else { $client->authenticate($_GET['code']); $_SESSION['access_token'] = $client->getAccessToken(); $redirect_uri = 'http://' . $_SERVER['HTTP_HOST'] . '/'; header('Location: ' . filter_var($redirect_uri, FILTER_SANITIZE_URL)); }
Python
This example uses the Flask
framework. It runs a web application at http://localhost:8080
that lets you test the OAuth 2.0 flow. If you go to that URL, you should
see four links:
- Test an API request: This link points to a page that tries to to execute a sample API request. If necessary, it starts the authorization flow. If successful, the page displays the API response.
- Test the auth flow directly: This link points to a page that tries to send the user through the authorization flow. The app requests permission to submit authorized API requests on the user's behalf.
- Revoke current credentials: This link points to a page that revokes permissions that the user has already granted to the application.
- Clear Flask session credentials: This link clears authorization credentials that are stored in the Flask session. This lets you see what would happen if a user who had already granted permission to your app tried to execute an API request in a new session. It also lets you see the API response your app would get if a user had revoked permissions granted to your app, and your app still tried to authorize a request with a revoked access token.
Note: To run this code locally, you must have followed the
directions in the prerequisites section,
including setting http://localhost:8080
as a valid redirect URI
for your credentials and downloading the client_secret.json file
for those credentials to your working directory.
# -*- coding: utf-8 -*- import os import flask import requests import google.oauth2.credentials import google_auth_oauthlib.flow import googleapiclient.discovery # This variable specifies the name of a file that contains the OAuth 2.0 # information for this application, including its client_id and client_secret. CLIENT_SECRETS_FILE = "client_secret.json" # This OAuth 2.0 access scope allows for full read/write access to the # authenticated user's account and requires requests to use an SSL connection. SCOPES = ['https://www.googleapis.com/auth/drive.metadata.readonly'] API_SERVICE_NAME = 'drive' API_VERSION = 'v2' app = flask.Flask(__name__) # Note: A secret key is included in the sample so that it works. # If you use this code in your application, replace this with a truly secret # key. See http://flask.pocoo.org/docs/0.12/quickstart/#sessions. app.secret_key = 'REPLACE ME - this value is here as a placeholder.' @app.route('/') def index(): return print_index_table() @app.route('/test') def test_api_request(): if 'credentials' not in flask.session: return flask.redirect('authorize') # Load credentials from the session. credentials = google.oauth2.credentials.Credentials( **flask.session['credentials']) drive = googleapiclient.discovery.build( API_SERVICE_NAME, API_VERSION, credentials=credentials) files = drive.files().list().execute() # Save credentials back to session in case access token was refreshed. # ACTION ITEM: In a production app, you likely want to save these # credentials in a persistent database instead. flask.session['credentials'] = credentials_to_dict(credentials) return flask.jsonify(**files) @app.route('/authorize') def authorize(): # Create flow instance to manage the OAuth 2.0 Authorization Grant Flow steps. flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file( CLIENT_SECRETS_FILE, scopes=SCOPES) # The URI created here must exactly match one of the authorized redirect URIs # for the OAuth 2.0 client, which you configured in the API Console. If this # value doesn't match an authorized URI, you will get a 'redirect_uri_mismatch' # error. flow.redirect_uri = flask.url_for('oauth2callback', _external=True) authorization_url, state = flow.authorization_url( # Enable offline access so that you can refresh an access token without # re-prompting the user for permission. Recommended for web server apps. access_type='offline', # Enable incremental authorization. Recommended as a best practice. include_granted_scopes='true') # Store the state so the callback can verify the auth server response. flask.session['state'] = state return flask.redirect(authorization_url) @app.route('/oauth2callback') def oauth2callback(): # Specify the state when creating the flow in the callback so that it can # verified in the authorization server response. state = flask.session['state'] flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file( CLIENT_SECRETS_FILE, scopes=SCOPES, state=state) flow.redirect_uri = flask.url_for('oauth2callback', _external=True) # Use the authorization server's response to fetch the OAuth 2.0 tokens. authorization_response = flask.request.url flow.fetch_token(authorization_response=authorization_response) # Store credentials in the session. # ACTION ITEM: In a production app, you likely want to save these # credentials in a persistent database instead. credentials = flow.credentials flask.session['credentials'] = credentials_to_dict(credentials) return flask.redirect(flask.url_for('test_api_request')) @app.route('/revoke') def revoke(): if 'credentials' not in flask.session: return ('You need to <a href="/authorize">authorize</a> before ' + 'testing the code to revoke credentials.') credentials = google.oauth2.credentials.Credentials( **flask.session['credentials']) revoke = requests.post('https://accounts.google.com/o/oauth2/revoke', params={'token': credentials.token}, headers = {'content-type': 'application/x-www-form-urlencoded'}) status_code = getattr(revoke, 'status_code') if status_code == 200: return('Credentials successfully revoked.' + print_index_table()) else: return('An error occurred.' + print_index_table()) @app.route('/clear') def clear_credentials(): if 'credentials' in flask.session: del flask.session['credentials'] return ('Credentials have been cleared.<br><br>' + print_index_table()) def credentials_to_dict(credentials): return {'token': credentials.token, 'refresh_token': credentials.refresh_token, 'token_uri': credentials.token_uri, 'client_id': credentials.client_id, 'client_secret': credentials.client_secret, 'scopes': credentials.scopes} def print_index_table(): return ('<table>' + '<tr><td><a href="/test">Test an API request</a></td>' + '<td>Submit an API request and see a formatted JSON response. ' + ' Go through the authorization flow if there are no stored ' + ' credentials for the user.</td></tr>' + '<tr><td><a href="/authorize">Test the auth flow directly</a></td>' + '<td>Go directly to the authorization flow. If there are stored ' + ' credentials, you still might not be prompted to reauthorize ' + ' the application.</td></tr>' + '<tr><td><a href="/revoke">Revoke current credentials</a></td>' + '<td>Revoke the access token associated with the current user ' + ' session. After revoking credentials, if you go to the test ' + ' page, you should see an <code>invalid_grant</code> error.' + '</td></tr>' + '<tr><td><a href="/clear">Clear Flask session credentials</a></td>' + '<td>Clear the access token currently stored in the user session. ' + ' After clearing the token, if you <a href="/test">test the ' + ' API request</a> again, you should go back to the auth flow.' + '</td></tr></table>') if __name__ == '__main__': # When running locally, disable OAuthlib's HTTPs verification. # ACTION ITEM for developers: # When running in production *do not* leave this option enabled. os.environ['OAUTHLIB_INSECURE_TRANSPORT'] = '1' # Specify a hostname and port that are set as a valid redirect URI # for your API project in the Google API Console. app.run('localhost', 8080, debug=True)
Ruby
This example uses the Sinatra framework.
require 'google/apis/drive_v2' require 'google/api_client/client_secrets' require 'json' require 'sinatra' enable :sessions set :session_secret, 'setme' get '/' do unless session.has_key?(:credentials) redirect to('/oauth2callback') end client_opts = JSON.parse(session[:credentials]) auth_client = Signet::OAuth2::Client.new(client_opts) drive = Google::Apis::DriveV2::DriveService.new files = drive.list_files(options: { authorization: auth_client }) "<pre>#{JSON.pretty_generate(files.to_h)}</pre>" end get '/oauth2callback' do client_secrets = Google::APIClient::ClientSecrets.load auth_client = client_secrets.to_authorization auth_client.update!( :scope => 'https://www.googleapis.com/auth/drive.metadata.readonly', :redirect_uri => url('/oauth2callback')) if request['code'] == nil auth_uri = auth_client.authorization_uri.to_s redirect to(auth_uri) else auth_client.code = request['code'] auth_client.fetch_access_token! auth_client.client_secret = nil session[:credentials] = auth_client.to_json redirect to('/') end end
HTTP/REST
This Python example uses the Flask framework and the Requests library to demonstrate the OAuth 2.0 web flow. We recommend using the Google API Client Library for Python for this flow. (The example in the Python tab does use the client library.)
import json import flask import requests app = flask.Flask(__name__) CLIENT_ID = '123456789.apps.googleusercontent.com' CLIENT_SECRET = 'abc123' # Read from a file or environmental variable in a real app SCOPE = 'https://www.googleapis.com/auth/drive.metadata.readonly' REDIRECT_URI = 'http://example.com/oauth2callback' @app.route('/') def index(): if 'credentials' not in flask.session: return flask.redirect(flask.url_for('oauth2callback')) credentials = json.loads(flask.session['credentials']) if credentials['expires_in'] <= 0: return flask.redirect(flask.url_for('oauth2callback')) else: headers = {'Authorization': 'Bearer {}'.format(credentials['access_token'])} req_uri = 'https://www.googleapis.com/drive/v2/files' r = requests.get(req_uri, headers=headers) return r.text @app.route('/oauth2callback') def oauth2callback(): if 'code' not in flask.request.args: auth_uri = ('https://accounts.google.com/o/oauth2/v2/auth?response_type=code' '&client_id={}&redirect_uri={}&scope={}').format(CLIENT_ID, REDIRECT_URI, SCOPE) return flask.redirect(auth_uri) else: auth_code = flask.request.args.get('code') data = {'code': auth_code, 'client_id': CLIENT_ID, 'client_secret': CLIENT_SECRET, 'redirect_uri': REDIRECT_URI, 'grant_type': 'authorization_code'} r = requests.post('https://www.googleapis.com/oauth2/v4/token', data=data) flask.session['credentials'] = r.text return flask.redirect(flask.url_for('index')) if __name__ == '__main__': import uuid app.secret_key = str(uuid.uuid4()) app.debug = False app.run()
Incremental authorization
In the OAuth 2.0 protocol, your app requests authorization to access resources, which are identified by scopes. It is considered a best user-experience practice to request authorization for resources at the time you need them. To enable that practice, Google's authorization server supports incremental authorization. This feature lets you request scopes as they are needed and, if the user grants permission, add those scopes to your existing access token for that user.
For example, an app that lets people sample music tracks and create mixes might need very few resources at sign-in time, perhaps nothing more than the name of the person signing in. However, saving a completed mix would require access to their Google Drive. Most people would find it natural if they only were asked for access to their Google Drive at the time the app actually needed it.
In this case, at sign-in time the app might request the profile
scope to perform basic sign-in, and then later request the
https://www.googleapis.com/auth/drive.file
scope at the time of the
first request to save a mix.
To implement incremental authorization, you complete the normal flow for requesting an access token but make sure that the authorization request includes previously granted scopes. This approach allows your app to avoid having to manage multiple access tokens.
The following rules apply to an access token obtained from an incremental authorization:
- The token can be used to access resources corresponding to any of the scopes rolled into the new, combined authorization.
- When you use the refresh token for the combined authorization to obtain an access token, the access token represents the combined authorization and can be used for any of its scopes.
- The combined authorization includes all scopes that the user granted to the API project even if the grants were requested from different clients. For example, if a user granted access to one scope using an application's desktop client and then granted another scope to the same application via a mobile client, the combined authorization would include both scopes.
- If you revoke a token that represents a combined authorization, access to all of that authorization's scopes on behalf of the associated user are revoked simultaneously.
The language-specific code samples in Step 1: Set authorization parameters and the sample HTTP/REST redirect URL in Step 2: Redirect to Google's OAuth 2.0 server all use incremental authorization. The code samples below also show the code that you need to add to use incremental authorization.
PHP
$client->setIncludeGrantedScopes(true);
Python
In Python, set the include_granted_scopes
keyword argument
to true
to ensure that an authorization request includes
previously granted scopes. It is very possible that
include_granted_scopes
will not be the only keyword
argument that you set, as shown in the example below.
authorization_url, state = flow.authorization_url( # Enable offline access so that you can refresh an access token without # re-prompting the user for permission. Recommended for web server apps. access_type='offline', # Enable incremental authorization. Recommended as a best practice. include_granted_scopes='true')
Ruby
auth_client.update!( :additional_parameters => {"include_granted_scopes" => "true"} )
HTTP/REST
GET https://accounts.google.com/o/oauth2/v2/auth? scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdrive.file& state=security_token%3D138r5719ru3e1%26url%3Dhttps://oa2cb.example.com/myHome& redirect_uri=https%3A%2F%2Fmyapp.example.com%2Fcallback& response_type=code& client_id=your_client_id& prompt=consent& include_granted_scopes=true
Refreshing an access token (offline access)
Access tokens periodically expire. You can refresh an access token without prompting the user for permission (including when the user is not present) if you requested offline access to the scopes associated with the token.
- If you use a Google API Client Library, the client object refreshes the access token as needed as long as you configure that object for offline access.
- If you are not using a client library, you need to set the
access_type
HTTP query parameter tooffline
when redirecting the user to Google's OAuth 2.0 server. In that case, Google's authorization server returns a refresh token when you exchange an authorization code for an access token. Then, if the access token expires (or at any other time), you can use a refresh token to obtain a new access token.
Requesting offline access is a requirement for any application that needs
to access a Google API when the user is not present. For example, an app
that performs backup services or executes actions at predetermined times
needs to be able to refresh its access token when the user is not present.
The default style of access is called online
.
Server-side web applications, installed applications, and devices all obtain refresh tokens during the authorization process. Refresh tokens are not typically used in client-side (JavaScript) web applications.
PHP
If your application needs offline access to a Google API, set the API
client's access type to offline
:
$client->setAccessType("offline");
After a user grants offline access to the requested scopes, you can continue to use the API client to access Google APIs on the user's behalf when the user is offline. The client object will refresh the access token as needed.
Python
In Python, set the access_type
keyword argument to
offline
to ensure that you will be able to refresh the
access token without having to re-prompt the user for permission.
It is very possible that access_type
will not be the
only keyword argument that you set, as shown in the example below.
authorization_url, state = flow.authorization_url( # Enable offline access so that you can refresh an access token without # re-prompting the user for permission. Recommended for web server apps. access_type='offline', # Enable incremental authorization. Recommended as a best practice. include_granted_scopes='true')
After a user grants offline access to the requested scopes, you can continue to use the API client to access Google APIs on the user's behalf when the user is offline. The client object will refresh the access token as needed.
Ruby
If your application needs offline access to a Google API, set the API
client's access type to offline
:
auth_client.update!( :additional_parameters => {"access_type" => "offline"} )
After a user grants offline access to the requested scopes, you can continue to use the API client to access Google APIs on the user's behalf when the user is offline. The client object will refresh the access token as needed.
HTTP/REST
To refresh an access token, your application sends an HTTPS POST
request to Google's authorization server (https://www.googleapis.com/oauth2/v4/token
) that includes the following parameters:
Fields | |
---|---|
refresh_token |
The refresh token returned from the authorization code exchange. |
client_id |
The client ID obtained from the API Console. |
client_secret |
The client secret obtained from the API Console. | grant_type |
As defined in the OAuth 2.0 specification, this field must contain a
value of refresh_token . |
The following snippet shows a sample request:
POST /oauth2/v4/token HTTP/1.1 Host: www.googleapis.com Content-Type: application/x-www-form-urlencoded client_id=<your_client_id>
& client_secret=<your_client_secret>
& refresh_token=<refresh_token>
& grant_type=refresh_token
As long as the user has not revoked the access granted to the application, the token server returns a JSON object that contains a new access token. The following snippet shows a sample response:
{ "access_token":"1/fFAGRNJru1FTz70BzhT3Zg", "expires_in":3920, "token_type":"Bearer" }
Note that there are limits on the number of refresh tokens that will be issued; one limit per client/user combination, and another per user across all clients. You should save refresh tokens in long-term storage and continue to use them as long as they remain valid. If your application requests too many refresh tokens, it may run into these limits, in which case older refresh tokens will stop working.
Revoking a token
In some cases a user may wish to revoke access given to an application. A user can revoke access by visiting Account Settings. It is also possible for an application to programmatically revoke the access given to it. Programmatic revocation is important in instances where a user unsubscribes or removes an application. In other words, part of the removal process can include an API request to ensure the permissions granted to the application are removed.
PHP
To programmatically revoke a token, call revokeToken()
:
$client->revokeToken();
Python
To programmatically revoke a token, make a request to
https://accounts.google.com/o/oauth2/revoke
that includes
the token as a parameter and sets the Content-Type
header:
requests.post('https://accounts.google.com/o/oauth2/revoke', params={'token': credentials.token}, headers = {'content-type': 'application/x-www-form-urlencoded'})
Ruby
To programmatically revoke a token, make an HTTP request to the
oauth2.revoke
endpoint:
uri = URI('https://accounts.google.com/o/oauth2/revoke') params = { :token => auth_client.access_token } uri.query = URI.encode_www_form(params) response = Net::HTTP.get(uri)
The token can be an access token or a refresh token. If the token is an access token and it has a corresponding refresh token, the refresh token will also be revoked.
If the revocation is successfully processed, then the status code of the
response is 200
. For error conditions, a status code
400
is returned along with an error code.
HTTP/REST
To programmatically revoke a token, your application makes a request to
https://accounts.google.com/o/oauth2/revoke
and includes the token
as a parameter:
curl -H "Content-type:application/x-www-form-urlencoded" \ https://accounts.google.com/o/oauth2/revoke?token={token}
The token can be an access token or a refresh token. If the token is an access token and it has a corresponding refresh token, the refresh token will also be revoked.
If the revocation is successfully processed, then the status code of the
response is 200
. For error conditions, a status code
400
is returned along with an error code.