透過應用程式後端存取 Google API

如果希望伺服器能代表使用者或在使用者離線時呼叫 Google API，請按照這個程序操作。

事前準備

您必須完成基本的 Google 登入整合。

為應用程式啟用伺服器端 API 存取權

在「在 iOS 應用程式中存取 Google API」頁面中，您的應用程式只會在用戶端驗證使用者，因此只有在使用者主動使用應用程式時，應用程式才能存取 Google API。

按照本頁所述程序操作，伺服器就能在使用者離線時，代表他們呼叫 Google API。舉例來說，相片應用程式可以在後端伺服器上處理相片，然後將結果上傳至另一個相簿，藉此強化使用者 Google 相簿中的相片。如要這麼做，伺服器必須有存取權杖和更新權杖。

如要取得伺服器的存取權杖和更新權杖，您可以要求一次性授權碼，伺服器會將授權碼換成這兩個權杖。成功登入後，您會發現一次性代碼是 serverAuthCode 的 GIDSignInResult 屬性。

1. 如果尚未取得伺服器用戶端 ID，請取得並在應用程式的 Info.plist 檔案中指定該 ID，OAuth 用戶端 ID 下方。

   <key>GIDServerClientID</key>
   <string>YOUR_SERVER_CLIENT_ID</string>

2. 在登入回呼中，擷取一次性授權碼：

   Swift

   GIDSignIn.sharedInstance.signIn(withPresenting: self) { signInResult, error in
       guard error == nil else { return }
       guard let signInResult = signInResult else { return }
   
       let authCode = signInResult.serverAuthCode
   }
   

   Objective-C

   [GIDSignIn.sharedInstance
             signInWithPresentingViewController:self
                                     completion:^(GIDSignInResult * _Nullable signInResult,
                                                  NSError * _Nullable error) {
         if (error) { return; }
         if (signInResult == nil) { return; }
   
         NSString *authCode = signInResult.serverAuthCode;
   }];
   

3. 使用 HTTPS POST 將 serverAuthCode 字串安全地傳遞至伺服器。

4. 在應用程式的後端伺服器上，將授權碼換成存取和更新權杖。請使用存取權杖代表使用者呼叫 Google API，然後可選擇是否儲存更新權杖，方便在存取權杖過期時取得新的存取權杖。

   例如：

   Java

   // (Receive authCode via HTTPS POST)
   
   
   if (request.getHeader("X-Requested-With") == null) {
     // Without the `X-Requested-With` header, this request could be forged. Aborts.
   }
   
   // Set path to the Web application client_secret_*.json file you downloaded from the
   // Google API Console: https://console.cloud.google.com/apis/credentials
   // You can also find your Web application client ID and client secret from the
   // console and specify them directly when you create the GoogleAuthorizationCodeTokenRequest
   // object.
   String CLIENT_SECRET_FILE = "/path/to/client_secret.json";
   
   // Exchange auth code for access token
   GoogleClientSecrets clientSecrets =
       GoogleClientSecrets.load(
           JacksonFactory.getDefaultInstance(), new FileReader(CLIENT_SECRET_FILE));
   GoogleTokenResponse tokenResponse =
             new GoogleAuthorizationCodeTokenRequest(
                 new NetHttpTransport(),
                 JacksonFactory.getDefaultInstance(),
                 "https://oauth2.googleapis.com/token",
                 clientSecrets.getDetails().getClientId(),
                 clientSecrets.getDetails().getClientSecret(),
                 authCode,
                 REDIRECT_URI)  // Specify the same redirect URI that you use with your web
                                // app. If you don't have a web version of your app, you can
                                // specify an empty string.
                 .execute();
   
   String accessToken = tokenResponse.getAccessToken();
   
   // Use access token to call API
   GoogleCredential credential = new GoogleCredential().setAccessToken(accessToken);
   Drive drive =
       new Drive.Builder(new NetHttpTransport(), JacksonFactory.getDefaultInstance(), credential)
           .setApplicationName("Auth Code Exchange Demo")
           .build();
   File file = drive.files().get("appfolder").execute();
   
   // Get profile info from ID token
   GoogleIdToken idToken = tokenResponse.parseIdToken();
   GoogleIdToken.Payload payload = idToken.getPayload();
   String userId = payload.getSubject();  // Use this value as a key to identify a user.
   String email = payload.getEmail();
   boolean emailVerified = Boolean.valueOf(payload.getEmailVerified());
   String name = (String) payload.get("name");
   String pictureUrl = (String) payload.get("picture");
   String locale = (String) payload.get("locale");
   String familyName = (String) payload.get("family_name");
   String givenName = (String) payload.get("given_name");

   Python

   from apiclient import discovery
   import httplib2
   from oauth2client import client
   
   # (Receive auth_code by HTTPS POST)
   
   
   # If this request does not have `X-Requested-With` header, this could be a CSRF
   if not request.headers.get('X-Requested-With'):
       abort(403)
   
   # Set path to the Web application client_secret_*.json file you downloaded from the
   # Google API Console: https://console.cloud.google.com/apis/credentials
   CLIENT_SECRET_FILE = '/path/to/client_secret.json'
   
   # Exchange auth code for access token, refresh token, and ID token
   credentials = client.credentials_from_clientsecrets_and_code(
       CLIENT_SECRET_FILE,
       ['https://www.googleapis.com/auth/drive.appdata', 'profile', 'email'],
       auth_code)
   
   # Call Google API
   http_auth = credentials.authorize(httplib2.Http())
   drive_service = discovery.build('drive', 'v3', http=http_auth)
   appfolder = drive_service.files().get(fileId='appfolder').execute()
   
   # Get profile info from ID token
   userid = credentials.id_token['sub']
   email = credentials.id_token['email']