Skip to content
Google Auth Library for Ruby
Ruby Other
  1. Ruby 99.4%
  2. Other 0.6%
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github Update github issue templates (#173) Nov 7, 2018
.kokoro chore: use docker images from google-cloud-ruby (#244) Oct 18, 2019
lib Add whitelisted 'postmessage' to valid redirect URIs (#249) Dec 2, 2019
rakelib add v to version in docs url (#246) Oct 29, 2019
.gitignore Ignore emacs backup files and Gemfile.lock Feb 12, 2015
.repo-metadata.json chore: publish to on release (#242) Oct 11, 2019
.rubocop.yml Add whitelisted 'postmessage' to valid redirect URIs (#249) Dec 2, 2019 Release google-auth-library-ruby 0.10.0 (#240) Oct 9, 2019 Add Code of Conduct Jul 2, 2018
COPYING Adds top-level documentation and testing metadata Feb 25, 2015
Gemfile Require Ruby 2.4 and Signet 0.12 (#236) Oct 9, 2019 chore: run linkinator on merges to master (#243) Oct 11, 2019
Rakefile chore: run linkinator on merges to master (#243) Oct 11, 2019
googleauth.gemspec chore: publish to on release (#242) Oct 11, 2019

Google Auth Library for Ruby

Tim Emiola
Copyright © 2015 Google, Inc.
Apache 2.0

Gem Version


This is Google's officially supported ruby client library for using OAuth 2.0 authorization and authentication with Google APIs.


This library is in Alpha. We will make an effort to support the library, but we reserve the right to make incompatible changes when necessary.


Be sure is in your gem sources.

For normal client usage, this is sufficient:

$ gem install googleauth

Example Usage

require 'googleauth'

# Get the environment configured authorization
scopes =  ['',
authorization = Google::Auth.get_application_default(scopes)

# Add the the access token obtained using the authorization to a hash, e.g
# headers.
some_headers = {}

Application Default Credentials

This library provides an implementation of application default credentials for Ruby.

The Application Default Credentials provide a simple way to get authorization credentials for use in calling Google APIs.

They are best suited for cases when the call needs to have the same identity and authorization level for the application independent of the user. This is the recommended approach to authorize calls to Cloud APIs, particularly when you're building an application that uses Google Compute Engine.

User Credentials

The library also provides support for requesting and storing user credentials (3-Legged OAuth2.) Two implementations are currently available, a generic authorizer useful for command line apps or custom integrations as well as a web variant tailored toward Rack-based applications.

The authorizers are intended for authorization use cases. For sign-on, see Google Identity Platform

Example (Web)

require 'googleauth'
require 'googleauth/web_user_authorizer'
require 'googleauth/stores/redis_token_store'
require 'redis'

client_id = Google::Auth::ClientId.from_file('/path/to/client_secrets.json')
scope = ['']
token_store =
authorizer =
  client_id, scope, token_store, '/oauth2callback')

get('/authorize') do
  # NOTE: Assumes the user is already authenticated to the app
  user_id = request.session['user_id']
  credentials = authorizer.get_credentials(user_id, request)
  if credentials.nil?
    redirect authorizer.get_authorization_url(login_hint: user_id, request: request)
  # Credentials are valid, can call APIs
  # ...

get('/oauth2callback') do
  target_url = Google::Auth::WebUserAuthorizer.handle_auth_callback_deferred(
  redirect target_url

Example (Command Line)

require 'googleauth'
require 'googleauth/stores/file_token_store'

OOB_URI = 'urn:ietf:wg:oauth:2.0:oob'

scope = ''
client_id = Google::Auth::ClientId.from_file('/path/to/client_secrets.json')
token_store =
  :file => '/path/to/tokens.yaml')
authorizer =, scope, token_store)

credentials = authorizer.get_credentials(user_id)
if credentials.nil?
  url = authorizer.get_authorization_url(base_url: OOB_URI )
  puts "Open #{url} in your browser and enter the resulting code:"
  code = gets
  credentials = authorizer.get_and_store_credentials_from_code(
    user_id: user_id, code: code, base_url: OOB_URI)

# OK to use credentials

Example (Service Account)

scope = ''

authorizer = Google::Auth::ServiceAccountCredentials.make_creds(
  scope: scope)


Example (Environment Variables)

export GOOGLE_ACCOUNT_TYPE=service_account
export GOOGLE_CLIENT_ID=000000000000000000000
export GOOGLE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"
require 'googleauth'
require 'google/apis/drive_v3'

Drive = ::Google::Apis::DriveV3
drive =

# Auths with ENV vars:
auth = ::Google::Auth::ServiceAccountCredentials
  .make_creds(scope: '')
drive.authorization = auth

list_files = drive.list_files()


Authorizers require a storage instance to manage long term persistence of access and refresh tokens. Two storage implementations are included:

  • Google::Auth::Stores::FileTokenStore
  • Google::Auth::Stores::RedisTokenStore

Custom storage implementations can also be used. See token_store.rb for additional details.

Supported Ruby Versions

This library requires Ruby 2.4 or later.

In general, this library supports Ruby versions that are considered current and supported by Ruby Core (that is, Ruby versions that are either in normal maintenance or in security maintenance). See for further details.


This library is licensed under Apache 2.0. Full license text is available in COPYING.




Please report bugs at the project on Github. Don't hesitate to ask questions about the client or APIs on StackOverflow.

You can’t perform that action at this time.