To get OAuth client ID, client secret, access token, and refresh token for Google applications

In the Google Cloud Platform, you configure details for OAuth 2.0 authentication and authorization in a project. You can either use an existing project or create a new project for IBM App Connect.

1. Open the Google Cloud Platform https://console.developers.google.com/apis/dashboard.

   (Sign in with your Google account)

2. From the project menu, select an existing project or create a new project, as follows.
   1. Click NEW PROJECT
   2. If displayed, agree to the terms of service for Google Cloud Platform to continue
   3. Enter a project name that identifies the project.

      Project for IBM App Connect

   4. Click CREATE.

You use the consent screen to get an access token and refresh token for IBM App Connect use.

1. Select the OAuth consent screen option
2. If you're not a Google Workspace user, the External checkbox is selected, so you can use your app yourself or make your app available to any user with a Google account. These users might see an unverified app screen when they configure an access token and refresh token, but they can use the OAuth credentials to connect IBM App Connect to Google apps. As a Google Workspace user, you can select the Internal checkbox to make your app available to other users in your organization. In the Google Admin console, depending on your organizational structure, settings, and policies, users can create their own Client ID and Client secret. Alternatively, they might use the Google Workspace account holder's Client ID and Client secret. Those users don't see an unverified app screen when they configure an access token and refresh token, and they can use the OAuth credentials to connect IBM App Connect to Google apps.
3. Click CREATE.
4. Enter a name to identify the application, such as App for IBM App Connect.
5. In the Authorized domains field, enter ibm.com, then press return to add the value to your list of authorized domains.
6. Click Save.

Use the Credentials option to get an OAuth client ID and secret.

1. Click the Credentials option
2. Click + CREATE CREDENTIALS
3. Click OAuth client ID
4. Click the Web application checkbox
5. Enter a Name to help you manage OAuth for IBM App Connect; for example: Web client for IBM App Connect
6. In the Authorized redirect URIs field, enter the redirect URI for Google API playground (you need this value later to get the access token and refresh token): https://developers.google.com/oauthplayground, then press return to add this value to your list
7. Click Create

For your project, enable the Google APIs that can be used. You define the scopes of API use that you want to allow later. For example, to only retrieve messages or to create new spreadsheets.

1. Click the Library option.
2. Select a Google API that you want to use in IBM App Connect flows, then click ENABLE.

Repeat these steps for each of the Google apps that you want to use in IBM App Connect; for example:

• Gmail: Gmail API
• Google Analytics: Google Analytics API
• Google Drive: Google Drive API
• Google Sheets: Google Sheets API and Google Drive API
• Google Calendar: Google Calendar API
• Google Translate: Google Translate API
• Google Contacts: Google Contacts API
• Google Chat: Google Chat API
• Google Groups: Google Groups API
• Google Tasks: Google Tasks API
• Google Gemini: Google Gemini API

The following steps use the Google Developers OAuth 2.0 Playground to get an access token and refresh token, and select the scopes of APIs for each of the Google apps that you want to use in IBM App Connect. This stage selects the API scopes and gets an access token and refresh token for the Google account that you want IBM App Connect to use. That account can be different to the Google account used in earlier stages to create the Google app (to get the client ID and client secret). If you want IBM App Connect to be able to perform a complete set of events and actions, you can select the scopes with the highest permissions, as listed in this section. You can limit the permissions for IBM App Connect so that it can only perform a subset of events and actions; by getting an access token with only the scopes needed for one Google application, and by selecting only the most-restricted scopes that are needed for an event or action. You can get several access tokens, each with a different restricted selection of scopes needed for events/actions on one or more Google applications. For example, you might get an access token with the scope https://www.googleapis.com/auth/gmail.readonly to permit IBM App Connect flows to be triggered by the New email event and to perform the Retrieve emails action.

1. Display the Google Developers OAuth 2.0 Playground: https://developers.google.com/oauthplayground/
2. Specify your client ID and client secret:
   1. Click the Settings icon (on the right)
   2. Select the Use your own OAuth credentials checkbox
   3. Enter your OAuth Client ID and OAuth Client secret
   4. Click Close

   

   (Click image to view full size)

3. In 'Step 1 Select & authorize APIs', select the scopes of APIs for each of the Google apps that you want to use in IBM App Connect. To enable IBM App Connect to perform all events and actions, we recommend you select from the following scope list for the Google applications that you want to use:
   • For Gmail app – (Under Gmail API v1)
     • https://www.googleapis.com/auth/gmail.modify
   • For Google Drive app – (Under Drive API v3)
     • https://www.googleapis.com/auth/drive
   • For Google Sheets app – (Under Google Sheets API v4)
     • https://www.googleapis.com/auth/drive
   • For Google Analytics app – (Under Google Analytics API v4)
     • https://www.googleapis.com/auth/analytics
     • https://www.googleapis.com/auth/analytics.edit
     • https://www.googleapis.com/auth/analytics.manage.users
     • https://www.googleapis.com/auth/analytics.manage.users.readonly
   To enable IBM App Connect to perform only a subset of events and actions, such as 'New email' event to trigger flows or 'Send email' action to send emails, you can select scopes with smaller permissions; for example, for Gmail events and actions you can select the following smaller scopes:
   • 'New email' event and 'Retrieve emails' action:
     • https://www.googleapis.com/auth/gmail.readonly
   • 'Send email' action:
     • https://www.googleapis.com/auth/gmail.readonly
     • https://www.googleapis.com/auth/gmail.send
   • 'Delete email' action:
     • https://www.googleapis.com/auth/gmail.readonly
     • https://www.googleapis.com/auth/gmail.compose
   • Update email labels action requires the scope https://www.googleapis.com/auth/gmail.modify, which enable IBM App Connect to perform all events and actions.

   (For the minimum API scopes for Gmail, Google Analytics, Google Drive, Google Sheets, Google Calendar, Google Translate, Google Contacts, Google Chat, Google Groups, Google Tasks, and Google Gemini, see the footnote on this page.)

   

   (Click image to view full size)

4. Click Authorize APIs.
5. On the Choose an account window, select the Google account that you want to use in IBM App Connect. If this displays the message 'This app isn't verified', it is because the app that you are configuring hasn't been verified by Google. To continue:
   1. Click the Advanced link, to show the option to continue
   2. Click the Go to link (for the OAuth consent screen that you defined earlier)

   This shows dialog windows for each of the Google APIs that you selected earlier. For each dialog window, click Allow. (If you have concerns about any permissions shown, you can later go back and change the Google APIs that you selected.) After the last dialog window, the OAuth consent screen that you defined earlier is displayed (populated with the Google APIs that you have allowed.

   

   (Click image to view full size)

6. In the OAuth consent window, click Allow. (If you have concerns about any permissions shown, you can clear option checkboxes or can go back and change the Google APIs that you enabled.)
7. Under Step 2 Exchange authorization code for tokens
   1. Select the check box Auto-refresh the token before it expires
   2. Click Exchange authorization code for tokens.

These steps generate an access token and a refresh token and the scope for the APIs that you selected, as shown in the following example.

{
  "access_token": "ya29.Il-9B2KbXhweZamxIsHe3_rjblkc7Xh_...VyvmQlj-JgAuWsTeTw29Hl22ivqHUIdwuDVn9ixxaEGJoDkZBZAkaCss4w", 
  "scope": "https://www.googleapis.com/auth/analytics.manage.users.readonly https://www.googleapis.com/auth/analytics https://www.googleapis.com/auth/analytics.readonly https://www.googleapis.com/auth/gmail.modify https://www.googleapis.com/auth/analytics.manage.users https://www.googleapis.com/auth/analytics.edit https://www.googleapis.com/auth/drive", 
  "token_type": "Bearer", 
  "expires_in": 3599, 
  "refresh_token": "1//04g2mKH5RhxUECgYIARAAGAQSNwF-L9IreLqEqk...x5eDp6nTKBRsxCRMVW6gU9ijJnY02uQRuw"
}