I had the same issue. I wanted to extract the user information. But couldn’t get the exact link to hit. Then I went through the code for Passport Google Strategy at Line number 54. My scopes were [‘profile’, ’email’] GET Request https://www.googleapis.com/oauth2/v3/userinfo?access_token={access_token} Response { “sub”: “23423….”, “name”: “John Doe”, “given_name”: “John”, “family_name”: “Doe”, “picture”: “<Profile … Read more
Check the OAuth 2 flow for Installed Application: https://developers.google.com/accounts/docs/OAuth2InstalledApp It still requires the user to authenticate with a browser the first time, but then you can store the refresh token and use it for subsequent requests. For alternative solutions, check the Device flow or Service Accounts, they are explained in the same documentation set.
There are a couple of different ways in which you can validate the integrity of the ID token on the server side: “Manually” – constantly download Google’s public keys, verify signature and then each and every field, including the iss one; the main advantage (albeit a small one in my opinion) I see here is … Read more
On November 5th 2014 Google made some changes to the APIs terms of Service. Like you I had an issue with the following line. Asking developers to make reasonable efforts to keep their private keys private and not embed them in open source projects. I have several open source projects on GitHub they are basically … Read more
You can set “Authorized redirect URI” to local IP (like http://127.0.0.1/callback), it’s working fine for me. What really agonizing is that google don’t allow user to config an external IP (let’s say your server IP like 99.99.99.99) as “Authorized redirect URI”, google want the “Authorized redirect URI” to end with a public top-level domain (such … Read more