SignIn directly without prompting sign in popup.

[umesh53]

I'm not calling this as an issue. So what I wanted to know is, is there a work around with which I can provide my Gmail credentials to the API and then get loggedIn without prompting the signIn popup which we get to select the user? I came across apiKey and client_id. Providing both still needs a final checkup to validate the user. So I need this to happen in the backend. Yes I accept the security issues here. But want to know if there are any methods to do so.

[valyrie97]

depending on your use case, you can use refresh tokens for a particular account to not have to log back in after the first popup. however to completely bypass it all together and do it programmatically i believe is impossible without an amount of reverse engineering.

[GEMI]

@marcus13345 how would you refresh the tokens?

[valyrie97]

@GEMI
In the API, its known as Offline Access.

You can get tokens for offline access, by putting offline access in the object with your scopes, when creating the sign in url. for example, with google analytics:

oauth2Client.generateAuthUrl({
  access_type: 'offline',
  approval_prompt: "force",
  scope: ['https://www.googleapis.com/auth/analytics.readonly']
});

in the redirect URL you'll receive a code https://www.example.com/redirect?code=MAGICCODE

that code can then be sent (encrypted, as its sensitive data) to the back end.

From there, you can reconstruct a new credentials object (with the refresh token) like so:

oauth2Client.getToken(code, (err, credentials) => {
  oauth2Client.setCredentials(credentials);
  gapi.options({
    auth: oauth2Client
  });
});

From there, your back end can make authenticated requests forever on the scopes initially requested.

Hope that helps :)

[TMSCH]

Thanks @marcus13345 for your solution.

@umesh53 you can also use grantOfflineAccess from gapi.auth2 for the same result.

In both case, you'll have to store the refresh token exchanged in your backend, and use it to get fresh access token any time you need it. More info here. You'll also have to handle users' sessions yourself.

[kutlaykural]

@marcus13345 could you share a XHR request with authorization tokens please? How should I use it to reach gmail and set cookies.
Thank you

[markb-trustifi]

@marcus13345 can it be used from Chrome extension?
https://developers.google.com/identity/protocols/OAuth2UserAgent