Loading...
Loading...
Use when implementing Google authentication in a Node.js or Python web application — Google login, OAuth 2.0 flows, verifying Google ID tokens, service account authentication, Application Default Credentials, Google Identity Services, Workload Identity Federation, API keys, or working with google-auth-library (Node.js) or google-auth (Python). Covers ID token verification and security best practices. Triggers - "google auth", "google login", "google sign in", "OAuth 2.0 Google", "google-auth-library", "Sign In with Google", "Google Identity Services", "GIS", "ADC", "Application Default Credentials", "service account", "Google ID token", "verifyIdToken", "GOOGLE_APPLICATION_CREDENTIALS", "Google SSO", "вход через Google", "авторизация Google", "сервисный аккаунт", "проверить ID-токен", "гугл-логин". For end-user web sign-in only, use the google-signin skill instead.
npx skill4agent add ssheleg/sheleg-dev google-authgoogle-auth-librarygoogleapisnpm install google-auth-library
npm install googleapisgoogle-authgoogle-auth-oauthlibgoogle-api-python-clientpip install google-auth
pip install google-auth-oauthlib
pip install google-api-python-client| Method | Use Case | Node.js Key Class | Python Key Module / Class |
|---|---|---|---|
| ADC | Same identity for all users, server-to-server | | |
| OAuth 2.0 | Actions on behalf of end users | | |
| Sign In with Google (GIS) | User sign-in/sign-up on websites | GIS JS SDK + | GIS JS SDK + |
| JWT / Service Account | Server-to-server, single identity | | |
| API Key | Public data, no user context | | passed to |
| Compute | On GCP with attached service account | | |
| Workload Identity Federation | AWS/Azure/OIDC → GCP without SA keys | | |
const {GoogleAuth} = require('google-auth-library');
const auth = new GoogleAuth({
scopes: 'https://www.googleapis.com/auth/cloud-platform'
});
const client = await auth.getClient();
const res = await client.fetch('https://dns.googleapis.com/dns/v1/projects/...');import google.auth
import google.auth.transport.requests
credentials, project = google.auth.default(
scopes=['https://www.googleapis.com/auth/cloud-platform']
)
request = google.auth.transport.requests.Request()
credentials.refresh(request)gcloud auth application-default loginGOOGLE_APPLICATION_CREDENTIALSconst {OAuth2Client} = require('google-auth-library');
const client = new OAuth2Client({
clientId: CLIENT_ID,
clientSecret: CLIENT_SECRET,
redirectUri: REDIRECT_URI
});
const authUrl = client.generateAuthUrl({
access_type: 'offline',
scope: ['https://www.googleapis.com/auth/userinfo.profile'],
state: crypto.randomBytes(32).toString('hex'),
include_granted_scopes: true
});
// After redirect: exchange code for tokens
const {tokens} = await client.getToken(code);
client.setCredentials(tokens);from google_auth_oauthlib.flow import Flow
flow = Flow.from_client_secrets_file(
'client_secret.json',
scopes=['https://www.googleapis.com/auth/userinfo.profile'],
redirect_uri=REDIRECT_URI
)
authorization_url, state = flow.authorization_url(
access_type='offline',
include_granted_scopes='true'
)
# After redirect: exchange code for tokens
flow.fetch_token(code=code)
credentials = flow.credentialsrefresh_tokenprompt: 'consent'prompt='consent'const {OAuth2Client} = require('google-auth-library');
const client = new OAuth2Client();
const ticket = await client.verifyIdToken({
idToken: token,
audience: WEB_CLIENT_ID,
});
const payload = ticket.getPayload();
const userId = payload['sub'];
const email = payload['email'];
const name = payload['name'];
const picture = payload['picture'];from google.oauth2 import id_token
from google.auth.transport import requests
request = requests.Request()
payload = id_token.verify_oauth2_token(
token,
request,
WEB_CLIENT_ID
)
user_id = payload['sub']
email = payload['email']
name = payload.get('name', '')
picture = payload.get('picture')audexpissconst {JWT} = require('google-auth-library');
const keys = require('./service-account-key.json');
const client = new JWT({
email: keys.client_email,
key: keys.private_key,
scopes: ['https://www.googleapis.com/auth/cloud-platform'],
});
const res = await client.fetch(url);from google.oauth2 import service_account
credentials = service_account.Credentials.from_service_account_file(
'service-account-key.json',
scopes=['https://www.googleapis.com/auth/cloud-platform']
)
# Or from a dict already loaded into memory:
credentials = service_account.Credentials.from_service_account_info(
info,
scopes=['https://www.googleapis.com/auth/cloud-platform']
)const {OAuth2Client} = require('google-auth-library');
const client = new OAuth2Client({ apiKey: 'my-api-key' });
// Or via GoogleAuth:
const {GoogleAuth} = require('google-auth-library');
const auth = new GoogleAuth({
clientOptions: { apiKey: 'my-api-key' }
});from googleapiclient.discovery import build
service = build('customsearch', 'v1', developerKey='my-api-key')client.on('tokens', (tokens) => {
if (tokens.refresh_token) {
// Store refresh_token — only sent on first auth
}
console.log(tokens.access_token);
});from google.auth.transport.requests import Request
if credentials.expired and credentials.refresh_token:
credentials.refresh(Request())
# credentials.token is the new access token
# credentials.expiry is the new expiration datetimeclient_secretstatesubemailrefresh_tokentoken_urlservice_account_impersonation_urlg_csrf_tokengoogle.auth.transport.requests.Request()