2

Using Google Drive's API I'm able to get authorization and a token, but in trying to get a list of files, the API currently returns only one item: a PDF named "Getting Started". Presumably that's the default item in a just-established Google Drive -- an item long since deleted from the intended Google Drive Account we're working with.

Meanwhile using the API Explorer (https://developers.google.com/apis-explorer) returns hundreds of items which are, in fact, representative of the Google Drive for the account in question.

API Explorer says the request it sent was:

GET https://www.googleapis.com/drive/v3/files?corpus=user&pageSize=100&key={YOUR_API_KEY}

Sending that directly returns an "insufficient permissions" error, which makes sense: it's the api_key, not the access_token Switching &key= with &access_token= does return a file list, but the only item in it is the "Getting Started" PDF mentioned above.

The discrepancy between API and the Explorer gives the impression that...

a) Each is referencing a different account, or

b) The permissions / scope / access granted in the API Console (https://console.developers.google.com) are narrow than Explorer

Regarding a) Each referencing a different account: Not likely. The credentials were all created in the API Console while logged into the same Google Account that was used to run API Explorer.

Regarding b) The permissions / scope / access are somehow different: Much more likely, but so far it's not immediately obvious how or what to adjust to make a difference.

The cURL calls sent:

curl https://www.googleapis.com/drive/v3/files?corpus=user&pageSize=100&key={YOUR_API_KEY} (NG.  Needs a token)
curl https://www.googleapis.com/drive/v3/files?corpus=user&pageSize=100&access_token={recently_obtained_token} (this works, but returns only one item -- the "Getting Started" PDF)

The Return:

{"kind": "drive#fileList", "incompleteSearch": false, "files": [{"kind": "drive#file", "id": "XXXX", "name": "Getting started", "mimeType": "application/pdf"}]}

The authorization and token steps used to get this far are listed here... How to connect to the Google Drive API using cURL?

Per this post (Access Google Drive API Returns Empty File List) The scope used was indeed https://www.googleapis.com/auth/drive Under the same link one kvzrock's answers suggests giving "permission to the email address of the service account" Couple of links on that:

Google Drive API, Oauth and service account

How do I authorise an app (web or installed) without user intervention?

But no luck understanding those yet.

Linda Lawton - DaImTo
  • 106,405
  • 32
  • 180
  • 449
WhatsYourFunction
  • 621
  • 1
  • 9
  • 25

2 Answers2

2

It sounds like you have used a Service Account and so the credentials you are using and hence the one file you are seeing, belong to the Service Account, not your user account. Some ways to confirm:-

  1. Check the created date of the file. If it was the same date as you generated the credentials, it's a Service Account.
  2. Check the owner of the file.
  3. Get the About resource https://developers.google.com/drive/api/v3/reference/about

Unfortunately, the Google documentation leads people to conclude that Service Accounts are a convenient way to bypass OAuth in order to get to your files, whereas it should say in large red letter "SERVICE ACCOUNTS ARE NOT THE ACCOUNT YOU THINK THERE ARE!!!"

You have 2 choices:- 1. Share all the files you want to access with the Service Account 1. Stop using Service Accounts and follow the steps in the last link you posted (How do I authorise an app (web or installed) without user intervention?) to access your regular account directly

pinoyyid
  • 21,499
  • 14
  • 64
  • 115
2

How to access the same files list through Google Drive's API as Google's API Explorer?

As you are using a service account this will be very hard. Service accounts are not you a service account is a dummy user that has its own google drive account. Currently its drive account only contains one file. "Getting Started".

Google apis explore allows you to login to your personal google drive account using Oauth2. This is a different authorization flow which requires that the user login to their google account and consent to the application accessing their data. This gives you access to your google drive account.

Service accounts are a different type of authorization flow. The credentials within the flow are used to login the service account user this can only be done server side. Service account authentication can not be done client side. The trick with service accounts is that they can be preauthorized. So you can grant the service account access to data and when it logs in it will not need to consent to the access as the normal Oauth2 flow does. So you can share files and directories on your personal google drive account with the service account. This is done by taking the service account email address and sharing a file or a directory with it like you would any other user. The service account will then have access to that file or directory.

Now for the reason why I said it will be hard to get the exact response that you would be getting from Google APIs explorer. It is not possible to share your root folder with anyone else. If you want the service account to have full access and the same response then you are going to have to share every directory in your root folder and every file in the root of your google drive account with the service account. Any new files or folders that you add you will have to share with the service account.

Linda Lawton - DaImTo
  • 106,405
  • 32
  • 180
  • 449
  • Thanks again. Super clear. And you convinced me: scrap the service account approach. – WhatsYourFunction Jul 19 '18 at 07:20
  • It depends upon what you are doing exactly Service accounts have their uses. But if you are trying to access other users data and not a drive account that you personally control then using a service account is probably not the best idea. – Linda Lawton - DaImTo Jul 19 '18 at 07:30