+1 to what @Prisoner said, you should be authenticating the user with plus.login and then retrieve the user with the special string me
.
A full example of getting the Photo URL and Cover Photo URL.
<html>
<head>
<script src="https://apis.google.com/js/client:plusone.js"></script>
</head>
<body>
<span id="signinButton">
<span
class="g-signin"
data-callback="signinCallback"
data-clientid="YOUR_CLIENT_ID"
data-cookiepolicy="single_host_origin"
data-requestvisibleactions="http://schemas.google.com/AddActivity"
data-scope="https://www.googleapis.com/auth/plus.login">
</span>
</span>
<script>
function signinCallback (resp) {
gapi.client.load('plus', 'v1', function() {
gapi.client.plus.people.get({userId: 'me'}).execute(getProfilePic);
});
}
function getProfilePic(person){
console.log(person.image.url);
console.log(person.cover.coverPhoto.url);
}
</script>
</body>
</html>
When the page loads, the sign-in button renders, when the user signs in, the callback is triggered. When the callback is triggered, the plus client is loaded. After the plus client loads, the API call to people.get is made.