Authenticating Google Pull Task Queue with NodeJS client

Question

I have a Pull Task Queue running on App Engine. I am trying to access the queue externally from the NodeJS REST client: https://github.com/google/google-api-nodejs-client

I'm passing my Server API key in with the request:

var googleapis = require('googleapis'),
    API_KEY = '...';

googleapis
    .discover('taskqueue', 'v1beta2')
    .execute(function(err, client) {
       var req = client.taskqueue.tasks.insert({
           project: 'my-project',
           taskqueue: 'pull-queue',
           key: API_KEY
       });
       req.execute(function(err, response) {
           ...
       });
    });

But I am getting back a 401 "Login Required" message. What am I missing?

If I need to use OAuth, how can I get an access token if my client is a NodeJS server instead of user/browser that can process the OAuth redirect URL?

Answer 1

The best way to do this is to take advantage of Service Accounts in GCE. This is a synthetic user account that is usable by anyone in the GCE project. Getting all of the auth lined up can be a little tricky. Here is an example on how to do this in python.

The general outline of what you need to do:

1. Start the GCE instance with the task queue OAuth scope.
2. Add the GCE service account to the task queue ACL in queue.yaml.
3. Acquire an access token. It looks like you can use the computeclient.js credential object to automate the HTTP call to http://metadata/computeMetadata/v1beta1/instance/service-accounts/default/token
4. Use this token in any API calls to the task queue API.

I'm not a Node expert, but searching around I saw found an example of how to connect to the Datastore API from Node using service accounts from GCE. It should be straightforward to adapt this to the task queue API.