{"id":2262,"date":"2013-07-19T10:07:00","date_gmt":"2013-07-19T10:07:00","guid":{"rendered":"https:\/\/ikaisays.com\/?p=2262"},"modified":"2021-04-20T10:08:43","modified_gmt":"2021-04-20T10:08:43","slug":"debugging-your-google-oauth-2-0-token-when-you-get-http-401s-or-403s","status":"publish","type":"post","link":"https:\/\/ikaisays.com\/2013\/07\/19\/debugging-your-google-oauth-2-0-token-when-you-get-http-401s-or-403s\/","title":{"rendered":"Debugging your Google OAuth 2.0 token when you get HTTP 401s or 403s"},"content":{"rendered":"\n<p>One of the things I get asked about the most is OAuth 2.0 when developers start seeing 401s, 403s, and possibly other HTTP 4xx status codes. This post isn\u2019t meant to be a comprehensive guide on OAuth debugging for Google\/YouTube APIs. Rather, it\u2019s a collection of some of the steps I find myself recommending or repeating when I\u2019m trying to debug issues with OAuth authorization.<\/p>\n\n\n\n<p>I\u2019ve recorded a short video describing how to enable Google API access for use with web and installed apps:<\/p>\n\n\n\n\n\n<p>The checklist is:<\/p>\n\n\n\n<ol><li>Did you create a new API project?<\/li><li>Did you enable the APIs you are looking to use?<\/li><li>Did you create a client ID and client secret?<\/li><\/ol>\n\n\n\n<p>A common step for developers is that they forget step #2 \u2013 enabling the APIs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Getting a token<\/h2>\n\n\n\n<p>Here are my cliff notes on tokens:<\/p>\n\n\n\n<ul><li><strong>Access tokens<\/strong>&nbsp;\u2013 used to make API calls. These expire after an hour<\/li><li><strong>Refresh tokens<\/strong>&nbsp;\u2013 you only get these if you request offline access when you ask a user to authorize. These are exchanged by your client for access tokens. Refresh tokens generally don\u2019t expire.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What causes 401s and other 4xx status codes?<\/h2>\n\n\n\n<p>The common causes for \u201c401 Unauthorized\u201d when making API calls with an access token are:<\/p>\n\n\n\n<ul><li>expired access token (most common)<\/li><li>Developer accidentally disabled the APIs (uncommon)<\/li><li>User revokes token (rare)<\/li><\/ul>\n\n\n\n<p>Sometimes, more explanation exists in the response body of a HTTP 4xx. In the Java client, for example, you should log the error, because it will assist in troubleshooting:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>try {   \n       \/\/ Make your Google API call\n} catch (GoogleJsonResponseException e) {\n      GoogleJsonError error = e.getDetails();\n      \/\/ Print out the message and errors\n}<\/code><\/pre>\n\n\n\n<p>Different versions will have different API signatures. Here\u2019s a link to the&nbsp;<a href=\"http:\/\/javadoc.google-api-java-client.googlecode.com\/hg\/1.15.0-rc\/com\/google\/api\/client\/googleapis\/json\/GoogleJsonError.html\">current version\u2019s Javadocs (1.1.15)<\/a>&nbsp;\u2013 newer versions look like they might be deviating from this a bit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting the token<\/h2>\n\n\n\n<p>You could take your existing code and make an API call here whenever you get a HTTP 4xx and log that response. This\u2019ll return some useful information:<\/p>\n\n\n\n<ul><li>When the token expires<\/li><li>What\u2019s the token\u2019s scope (this is important)<\/li><li>If the token is invalid<\/li><\/ul>\n\n\n\n<p>If you didn\u2019t write the code yourself and inherited it:<\/p>\n\n\n\n<ul><li>Whether this access token came from an offline refresh_token or not (the \u201coffline\u201d field)<\/li><\/ul>\n\n\n\n<p>If the token is invalid \u2026 well, that doesn\u2019t help a lot. I would troubleshoot like this:<\/p>\n\n\n\n<ol><li>Remove the access token from your datastore or database.<\/li><li>Use the refresh token to acquire a new access token (if you are using a refresh token)<\/li><li>Try to make the API call again. If it works, you\u2019re good! If not \u2026<\/li><li>Check the access token against the tokenInfo API<\/li><li>If it\u2019s still invalid, do a full reauth<\/li><\/ol>\n\n\n\n<p>Hope this helps!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>One of the things I get asked about the most is OAuth 2.0 when developers start seeing 401s, 403s, and possibly other HTTP 4xx status &#8230; <a title=\"Debugging your Google OAuth 2.0 token when you get HTTP 401s or 403s\" class=\"read-more\" href=\"https:\/\/ikaisays.com\/2013\/07\/19\/debugging-your-google-oauth-2-0-token-when-you-get-http-401s-or-403s\/\" aria-label=\"More on Debugging your Google OAuth 2.0 token when you get HTTP 401s or 403s\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_generate-full-width-content":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/posts\/2262"}],"collection":[{"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/comments?post=2262"}],"version-history":[{"count":1,"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/posts\/2262\/revisions"}],"predecessor-version":[{"id":2263,"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/posts\/2262\/revisions\/2263"}],"wp:attachment":[{"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/media?parent=2262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/categories?post=2262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ikaisays.com\/wp-json\/wp\/v2\/tags?post=2262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}