Question

I'm working with 3 Google API Services(Analytics, Webmasters, PageSpeed). I have a single Google API client ID(with all 3 services activated) and common Google API PHP SDK in my server.

User of this aplication should be able to grant and revoke access for each service independently at any point of time depending on his usage. Is this possible?

Testcase: If user wants to use only analytics service initially, he should be able to grant access for only analytics and later if he wants to use pagespeed service also, he should be able to grant for pagespeed also without compromising access for analytics.
If he wants to use analytics & webmasters later, he should be able to revoke only pagespeed access without compromising the access for analytics or webmasters.

Was it helpful?

Solution

When you request an access token, you specify the resources you want access to. If later you need to access another resource, you request another token for that resource.

You can simplify your implementation by setting the include_granted_scopes to true when requesting the token. This will include all previous authorizations so you only need to deal with the new token.

AFAIK there's no way to revoke access to specific scopes, even though the documentation mentions that "When you revoke a token which represents a combined authorization, all of the authorizations are revoked simultaneously;". This actually happens even when revoking individual tokens. Also, the Google account user interface does not allow the user to specify which permissions he wants to keep, it's only possible to revoke all access from an application.

See the docs for incremental authorization.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top