Handling OAuth 2.0 Refresh Tokens

anshjain232 · August 10, 2021, 12:58pm

I have been working with OAuth2 User-Agent flow method of authentication for one of my Google APIs . Here is how I configured it -

Despite checking the access_type=offline option, I get an error about my token being expired. The APIs stop working after a day or two and the user doesn’t remain logged in forever. How to configure it so that it handles refresh tokens automatically?

elmo.gomes · November 4, 2021, 3:41pm

Ecco that. Having the same problem.

boston85719 · November 4, 2021, 3:46pm

Is this an issue when you are constructing the API calls or when the user is using the application?

lottemint.md · November 4, 2021, 3:56pm

We had the same issue multiple times.

Inexplicably, it randomly stops refreshing tokens. One user may have a valid one without reauthenticating even after 20 days, while another user’s token may expire in a day.

The best way to create a manual OAuth 2.0 flow.

segongora9 · November 4, 2021, 4:02pm

Hey @anshjain232 , what Google API are you trying to use? Google Drive?

elmo.gomes · November 4, 2021, 4:56pm

In my case is Goggle Calendar

robbin · July 12, 2022, 10:24am

Has anyone found a solution to this?

Facing a similar problem with People API where the token expires in a few hrs & the API stops working

anshjain232 · July 12, 2022, 11:14am

Checking this thread after a looong time !

Pathfix seems to be a good solution to this. Auth setup in minutes. Other way is to store the tokens returned from the API in the database.

it18 · July 12, 2022, 1:57pm

Or instead of using user-agent flow or paid Pathfix you can also manually handled the OAuth proces by Bubble API connector. But three are more steps needed.
For example, it could look like this:

Redirect user to your google OAuth screen with scopes by URL.
when user accept scopes google back them to your redirect URL where you must catch autorization code from URL.
then make a API call with your auth code to get Access token and refresh token.
now you can make your API call with your Access token in header parametrs. But you must handle refreshing the Access token when it expired (~1h) you will get the exact expiried time in seconds when you get your Access token.

I did this this way, it maybe little complicated but free and reliable.

pratima.dudhewar · September 7, 2022, 6:58am

@it18
This is i’m trying to perform google authentication.

here in second screenshot i’m making post call at token endpoint.

but i’m getting below error for that.

I need to resolve this ASAP. Can you guide me with this?
Thank you

it18 · September 13, 2022, 7:09pm

@pratima.dudhewar sorry for late response…
I think your problem is that you try to use oauth authorization call inside “OAuth2 User-Agent Flow” API call, if you want to make authorization by yourself manualy (with is much better), You must change Authentication to “None - Self handled”.
Second thing is, did you set your cloud.google account properly?
Or did you solve your problem yet?

pratima.dudhewar · September 14, 2022, 4:23am

@it18
Thank you for your reply.
Well i shifted to “None-self handled”.
This is the first GET call i’m making.

" https://accounts.google.com/o/oauth2/v2/auth?client_id=603815555059-qpisv8v9uumole4j.apps.googleusercontent.com&redirect_uri=https://uk-stats.bubbleapps.io/api/1.1/oauth_redirect&scope=https://www.googleapis.com/auth/userinfo.profile&response_type=code"

now i made client_id to be dynamic. And what should be the data type for this call ? Right now it is text. I tried with using Empty and JSON option.

In response body its coming in text format.

But when i’m calling this API from front end nothing is initaiting. Also not getting code in URL.
What is getting wrong? Is this first step correct for google auth?

it18 · September 14, 2022, 10:03am

Don’t make an API call to this url. Just redirect user to this page “Open an external website” Action, and you will recive your code back in url, after granting scopes.

Or just coppy this link into your broswer.

Then you must make API cal to authorize with recived code:

you will recive this data:

Now you have access and refresh tokens and expiriation time, you can mke an API call that you want.

or refresh token if needed:

Hope this could help you

pratima.dudhewar · September 14, 2022, 10:10am

@it18
Ohhh… Amazing… you have explained so well… Thank you so much.
I just can’t express my feeling when i saw idtoken in your screenshot.
Will try that right now. I hope it will work for me too.

Btw just one thing can you send me that link “open external website” which you have in screenshot? Also what is that state parameter you put as"12345". Should I copy it from URL?

Also will ping you here if i stuck at any point. Once again thanks a lott.

pratima.dudhewar · September 14, 2022, 10:33am

Hey @it18

after selecting the account from consent screen getting below error.

Am i missing on something?

it18 · September 14, 2022, 10:48am

This is kind of Temporary ID (not realy important).

Hmmm, at this error i dont know how to help you…
At this stage, any error you receive should be caused by, an error in the redirect link or an error in Google Cloud console settings.
Did you set your redirect url and right scopes in google cloud ?
Share your google console ss, then we maybe find out something wrong.

pratima.dudhewar · September 14, 2022, 10:49am

@it18
Sure will share.

pratima.dudhewar · September 14, 2022, 11:05am

Hello @it18
Please check below screenshots.

Here in second ss the second number uri is redirect uri which i’m using.

Is that all okay?

it18 · September 14, 2022, 12:00pm

Make sure that This url (that I dont see well)

is in your Authorised redirect URLs

I see here you write URLs with “…/api/1.1/oauth_redirect” but this is redirect url for Automatic OAuth2 - User agent flow, you do it manually so you must type here page url, from your redirect url from your first redirection link, (the page where you try to chatch the code).

In addition remember to include …/version-test/… of the page and url with"?debug_mode=true" so it gives you 4 possible combinations of URLs.

This is my redirect url

pratima.dudhewar · September 14, 2022, 12:43pm

@it18
you mean so say the page from where i open the external website and get the code back.
In my case the page URL is
https://uk-stats.bubbleapps.io/version-test/manual_auth?debug_mode=true

is that you are saying? Ans should i add this URL in google console?