com.google.api.client.googleapis.auth.oauth2

Class GoogleCredential

java.lang.Object

com.google.api.client.auth.oauth2.Credential

com.google.api.client.googleapis.auth.oauth2.GoogleCredential

All Implemented Interfaces:

HttpExecuteInterceptor, HttpRequestInitializer, HttpUnsuccessfulResponseHandler

Direct Known Subclasses:

AppIdentityCredential.AppEngineCredentialWrapper, CloudShellCredential, MockGoogleCredential

Deprecated.

Please use google-auth-library for handling Application Default Credentials and other non-OAuth2 based authentication.

@Deprecated
public class GoogleCredential
extends Credential

Thread-safe Google-specific implementation of the OAuth 2.0 helper for accessing protected resources using an access token, as well as optionally refreshing the access token when it expires using a refresh token.

There are three modes supported: access token only, refresh token flow, and service account flow (with or without impersonating a user).

If all you have is an access token, you simply pass the TokenResponse to the credential using Credential.setFromTokenResponse(TokenResponse). Google credential uses BearerToken.authorizationHeaderAccessMethod() as the access method. Sample usage:

 public static GoogleCredential createCredentialWithAccessTokenOnly(TokenResponse tokenResponse) {
   return new GoogleCredential().setFromTokenResponse(tokenResponse);
 }
 

If you have a refresh token, it is similar to the case of access token only, but you additionally need to pass the credential the client secrets using GoogleCredential.Builder.setClientSecrets(GoogleClientSecrets) or GoogleCredential.Builder.setClientSecrets(String, String). Google credential uses GoogleOAuthConstants.TOKEN_SERVER_URL as the token server URL, and ClientParametersAuthentication with the client ID and secret as the client authentication. Sample usage:

 public static GoogleCredential createCredentialWithRefreshToken(
     HttpTransport transport, JsonFactory jsonFactory,
     GoogleClientSecrets clientSecrets, TokenResponse tokenResponse) {
  return new GoogleCredential.Builder().setTransport(transport)
                        .setJsonFactory(jsonFactory)
                        .setClientSecrets(clientSecrets)
                        .build()
                        .setFromTokenResponse(tokenResponse);
 }
 

The service account flow is used when you want to access data owned by your client application. You download the private key in a .p12 file from the Google APIs Console. Use GoogleCredential.Builder.setServiceAccountId(String), GoogleCredential.Builder.setServiceAccountPrivateKeyFromP12File(File), and GoogleCredential.Builder.setServiceAccountScopes(Collection). Sample usage:

 public static GoogleCredential createCredentialForServiceAccount(HttpTransport transport,
     JsonFactory jsonFactory,
     String serviceAccountId, Collection<String> serviceAccountScopes, File p12File)
     throws GeneralSecurityException, IOException {
   return new GoogleCredential.Builder().setTransport(transport).setJsonFactory(jsonFactory)
       .setServiceAccountId(serviceAccountId).setServiceAccountScopes(serviceAccountScopes)
       .setServiceAccountPrivateKeyFromP12File(p12File).build();
 }
 

You can also use the service account flow to impersonate a user in a domain that you own. This is very similar to the service account flow above, but you additionally call GoogleCredential.Builder.setServiceAccountUser(String). Sample usage:

 public static GoogleCredential createCredentialForServiceAccountImpersonateUser
     (HttpTransport transport, JsonFactory jsonFactory, String serviceAccountId,
      Collection<String> serviceAccountScopes, File p12File,
      String serviceAccountUser) throws GeneralSecurityException, IOException {
   return new GoogleCredential.Builder()
       .setTransport(transport)
       .setJsonFactory(jsonFactory)
       .setServiceAccountId(serviceAccountId)
       .setServiceAccountScopes(serviceAccountScopes)
       .setServiceAccountPrivateKeyFromP12File(p12File)
       .setServiceAccountUser(serviceAccountUser)
       .build();
 }
 

If you need to persist the access token in a data store, use DataStoreFactory and GoogleCredential.Builder.addRefreshListener(CredentialRefreshListener) with DataStoreCredentialRefreshListener.

If you have a custom request initializer, request execute interceptor, or unsuccessful response handler, take a look at the sample usage for HttpExecuteInterceptor and HttpUnsuccessfulResponseHandler, which are interfaces that this class also implements.

Since:

1.7

Author:

Yaniv Inbar

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	GoogleCredential.Builder Deprecated. Google credential builder.

Nested classes/interfaces inherited from class com.google.api.client.auth.oauth2.Credential

Credential.AccessMethod

Constructor Summary

Constructors

Modifier	Constructor and Description
	GoogleCredential() Deprecated. Constructor with the ability to access protected resources, but not refresh tokens.
protected	GoogleCredential(GoogleCredential.Builder builder) Deprecated.

Method Summary

Modifier and Type	Method and Description
GoogleCredential	createDelegated(String user) Deprecated. Beta For service accounts that need to delegate to a specific user, create a copy of the credential with the specified user.
GoogleCredential	createScoped(Collection<String> scopes) Deprecated. Beta For credentials that require scopes, creates a copy of the credential with the specified scopes.
boolean	createScopedRequired() Deprecated. Beta Indicates whether the credential requires scopes to be specified by calling createScoped before use.
protected TokenResponse	executeRefreshToken() Deprecated.
static GoogleCredential	fromStream(InputStream credentialStream) Deprecated. Beta Return a credential defined by a Json file.
static GoogleCredential	fromStream(InputStream credentialStream, HttpTransport transport, JsonFactory jsonFactory) Deprecated. Beta Return a credential defined by a Json file.
static GoogleCredential	getApplicationDefault() Deprecated. Beta Returns the Application Default Credentials.
static GoogleCredential	getApplicationDefault(HttpTransport transport, JsonFactory jsonFactory) Deprecated. Beta Returns the Application Default Credentials.
String	getServiceAccountId() Deprecated. Returns the service account ID (typically an e-mail address) or null if not using the service account flow.
PrivateKey	getServiceAccountPrivateKey() Deprecated. Returns the private key to use with the service account flow or null if not using the service account flow.
String	getServiceAccountPrivateKeyId() Deprecated. Beta Returns the ID of the private key to use with the service account flow or null if not using the service account flow.
String	getServiceAccountProjectId() Deprecated. Returns the service account Project ID or null if not present, either because this is not using the service account flow, or is using an older version of the service account configuration.
Collection<String>	getServiceAccountScopes() Deprecated. Returns a collection of OAuth scopes to use with the service account flow or null if not using the service account flow.
String	getServiceAccountScopesAsString() Deprecated. Returns the space-separated OAuth scopes to use with the service account flow or null if not using the service account flow.
String	getServiceAccountUser() Deprecated. Returns the email address of the user the application is trying to impersonate in the service account flow or null for none or if not using the service account flow.
GoogleCredential	setAccessToken(String accessToken) Deprecated.
GoogleCredential	setExpirationTimeMilliseconds(Long expirationTimeMilliseconds) Deprecated.
GoogleCredential	setExpiresInSeconds(Long expiresIn) Deprecated.
GoogleCredential	setFromTokenResponse(TokenResponse tokenResponse) Deprecated.
GoogleCredential	setRefreshToken(String refreshToken) Deprecated.
GoogleCredential.Builder	toBuilder() Deprecated. Beta Create a builder from this credential.

Methods inherited from class com.google.api.client.auth.oauth2.Credential

getAccessToken, getClientAuthentication, getClock, getExpirationTimeMilliseconds, getExpiresInSeconds, getJsonFactory, getMethod, getRefreshListeners, getRefreshToken, getRequestInitializer, getTokenServerEncodedUrl, getTransport, handleResponse, initialize, intercept, refreshToken

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

GoogleCredential

public GoogleCredential()

Deprecated.

Constructor with the ability to access protected resources, but not refresh tokens.

To use with the ability to refresh tokens, use GoogleCredential.Builder.

GoogleCredential

protected GoogleCredential(GoogleCredential.Builder builder)

Deprecated.

Parameters:

builder - Google credential builder

Since:

1.14

Method Detail

getApplicationDefault

@Beta
public static GoogleCredential getApplicationDefault()
                                                    throws IOException

Deprecated.

Beta
Returns the Application Default Credentials.

Returns the Application Default Credentials which are credentials that identify and authorize the whole application. This is the built-in service account if running on Google Compute Engine or the credentials file from the path in the environment variable GOOGLE_APPLICATION_CREDENTIALS.

Returns:

the credential instance.

Throws:

IOException - if the credential cannot be created in the current environment.

getApplicationDefault

@Beta
public static GoogleCredential getApplicationDefault(HttpTransport transport,
                                                           JsonFactory jsonFactory)
                                                    throws IOException

Deprecated.

Beta
Returns the Application Default Credentials.

Returns the Application Default Credentials which are credentials that identify and authorize the whole application. This is the built-in service account if running on Google Compute Engine or the credentials file from the path in the environment variable GOOGLE_APPLICATION_CREDENTIALS.

Parameters:

transport - the transport for Http calls.

jsonFactory - the factory for Json parsing and formatting.

Returns:

the credential instance.

Throws:

IOException - if the credential cannot be created in the current environment.

fromStream

@Beta
public static GoogleCredential fromStream(InputStream credentialStream)
                                         throws IOException

Deprecated.

Beta
Return a credential defined by a Json file.

Parameters:

credentialStream - the stream with the credential definition.

Returns:

the credential defined by the credentialStream.

Throws:

IOException - if the credential cannot be created from the stream.

fromStream

@Beta
public static GoogleCredential fromStream(InputStream credentialStream,
                                                HttpTransport transport,
                                                JsonFactory jsonFactory)
                                         throws IOException

Deprecated.

Beta
Return a credential defined by a Json file.

Parameters:

credentialStream - the stream with the credential definition.

transport - the transport for Http calls.

jsonFactory - the factory for Json parsing and formatting.

Returns:

the credential defined by the credentialStream.

Throws:

IOException - if the credential cannot be created from the stream.

setAccessToken

public GoogleCredential setAccessToken(String accessToken)

Deprecated.

Overrides:

setAccessToken in class Credential

setRefreshToken

public GoogleCredential setRefreshToken(String refreshToken)

Deprecated.

Overrides:

setRefreshToken in class Credential

setExpirationTimeMilliseconds

public GoogleCredential setExpirationTimeMilliseconds(Long expirationTimeMilliseconds)

Deprecated.

Overrides:

setExpirationTimeMilliseconds in class Credential

setExpiresInSeconds

public GoogleCredential setExpiresInSeconds(Long expiresIn)

Deprecated.

Overrides:

setExpiresInSeconds in class Credential

setFromTokenResponse

public GoogleCredential setFromTokenResponse(TokenResponse tokenResponse)

Deprecated.

Overrides:

setFromTokenResponse in class Credential

executeRefreshToken

@Beta
protected TokenResponse executeRefreshToken()
                                           throws IOException

Deprecated.

Overrides:

executeRefreshToken in class Credential

Throws:

IOException

getServiceAccountId

public final String getServiceAccountId()

Deprecated.

Returns the service account ID (typically an e-mail address) or null if not using the service account flow.

getServiceAccountProjectId

public final String getServiceAccountProjectId()

Deprecated.

Returns the service account Project ID or null if not present, either because this is not using the service account flow, or is using an older version of the service account configuration.

getServiceAccountScopes

public final Collection<String> getServiceAccountScopes()

Deprecated.

Returns a collection of OAuth scopes to use with the service account flow or null if not using the service account flow.

getServiceAccountScopesAsString

public final String getServiceAccountScopesAsString()

Deprecated.

Returns the space-separated OAuth scopes to use with the service account flow or null if not using the service account flow.

Since:

1.15

getServiceAccountPrivateKey

public final PrivateKey getServiceAccountPrivateKey()

Deprecated.

Returns the private key to use with the service account flow or null if not using the service account flow.

getServiceAccountPrivateKeyId

@Beta
public final String getServiceAccountPrivateKeyId()

Deprecated.

Beta
Returns the ID of the private key to use with the service account flow or null if not using the service account flow.

getServiceAccountUser

public final String getServiceAccountUser()

Deprecated.

Returns the email address of the user the application is trying to impersonate in the service account flow or null for none or if not using the service account flow.

createScopedRequired

@Beta
public boolean createScopedRequired()

Deprecated.

Beta
Indicates whether the credential requires scopes to be specified by calling createScoped before use.

createScoped

@Beta
public GoogleCredential createScoped(Collection<String> scopes)

Deprecated.

Beta
For credentials that require scopes, creates a copy of the credential with the specified scopes.

createDelegated

@Beta
public GoogleCredential createDelegated(String user)

Deprecated.

Beta
For service accounts that need to delegate to a specific user, create a copy of the credential with the specified user.

toBuilder

@Beta
public GoogleCredential.Builder toBuilder()

Deprecated.

Beta
Create a builder from this credential.