1

I have successfully verified the user ID Token on my node.js backend (as described here), and now I want to access the Google Spreadsheets API on behalf of that user, but I can't seem to find information about how to do it.

Thanks in advance for your time.

Ruslan Plastun
  • 1,985
  • 3
  • 21
  • 48

2 Answers2

1

I'm currently working on a similar implementation and might be able to share some information from what I've learned. First, an overview of tokens used in Firebase you find here. What you need in order to access a Google API is an OAuth2 token. The standard token you obtain from the Firebase login, however, is a Firebase ID token, not an OAuth2 token.

There is an OAuth2 token involved when you use Sign In with Google on Firebase Auth but like mentioned by Frank van Puffelen and also in this StackOverflow answer, Firebase Authentication "does not manage OAuth tokens for users". And as far as I understand you just cannot get to the OAuth2 tokens within Firebase Auth.

EDIT: I just came across the last example in the docs for handling the Google sign in flow, where it says

Then, you can also retrieve the Google provider's OAuth token by calling getRedirectResult when your page loads

I did not try this as I use the Google Sign In library but it seems that it is now possible to retrieve the OAuth2 token also directly from a Google Sign In with the Firebase Auth library. This corresponds to client-side authorization as you do not obtain a refresh token here.

What you can do, however, is to use the "Sign In With Google" library. It separates between authentication (who someone is, like Google account) and authorization (granting access to data, like calling a Google API). For obtaining the token to call Google APIs you need to implement the authorization flow. Here you have two options:

  • client-side authorization, called "implicit flow" where the token you obtain from the user giving consent in the google pop up is only a short-lived access token.
  • server-side authorization, called "authorization code flow" where you obtain a refresh token that you store in your database and use for obtaining access tokens over a longer period of time.

A very helpful comparison of both authorization flows you find here. Which one you use is up to you. In any case, you end up with the access token you need in order to call a Google API on behalf of the user.

And now back to Firebase: Since you want to log your user also into Firebase, you can use the "manual" authentication with Firebase by passing the token you obtained from the Google Sign In library to signInWithCredential:

function handleCredentialResponse(response) {
  // Build Firebase credential with the Google ID token.
  const idToken = response.credential;
  const credential = GoogleAuthProvider.credential(idToken);

  // Sign in with credential from the Google user.
  signInWithCredential(auth, credential).catch((error) => {
    // Handle Errors here.
    const errorCode = error.code;
    const errorMessage = error.message;
    // The email of the user's account used.
    const email = error.email;
    // The credential that was used.
    const credential = GoogleAuthProvider.credentialFromError(error);
    // ...
  });
}
luigisuncorner
  • 51
  • 4
  • I needed to migrate my firebase app that syncs with a google calendar because of the depreciation of gapi.auth2. I just created an app using the step-by-step process outlined in the document. It does give you a token that you can then use to access a Google API. https://firebase.google.com/docs/auth/web/google-signin#handle_the_sign-in_flow_with_the_firebase_sdk – Greg Harner Nov 27 '22 at 03:53
0

To access a Google Spreadsheet you need an OAuth token for a Google user.

An ID token from Firebase Authentication identifies a Firebase user.

The two token types are not the same and each have their own set of users. You can't use a Firebase ID token to allow that Firebase Authentication user to access a Google Spreadsheet (or any other API that requires a OAuth token).

To access the Google Spreadsheet as that user, you'll need to use their OAuth token, which is the same token you used when signing the user in to Firebase on the client.

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
  • `which is the same token you used when signing the user in to Firebase on the client` not sure I understand it correctly, I have used `signInWithPopup` method from `firebase` npm package in react, what kind of OAuth token on client are you talking about? – Ruslan Plastun Aug 19 '22 at 16:01
  • Ah, so you're signing users in to Firebase on a web app (that's always good to mention in your question). In that case, the OAuth token is indeed more hidden from you than in native iOS and Android app. This seems relevant: https://medium.com/google-cloud/using-google-apis-with-firebase-auth-and-firebase-ui-on-the-web-46e6189cf571 as does https://stackoverflow.com/questions/71106731/get-google-access-token-after-firebase-authorization – Frank van Puffelen Aug 19 '22 at 16:51