Google oauthplayground 使刷新令牌不会过期
我开发了一个快速应用程序，其目的是发送电子邮件。我使用谷歌oauth2游乐场和他们的谷歌API授权了一个电子邮件发件人。我想使用这种策略，而不是与第三方电子邮件发件人合作，以免受到供应商锁定。我让系统成功运行，但一天后它停止工作并显示“无效授权”。在生产中，我希望有一个永久的电子邮件地址（在他们的谷歌工作区下），专门用于这些机器人电子邮件。 oauthplayground 说你可以避免 24 小时过期，但我记得以前这样做过，最终得出了无效的授权。有没有更好的方法来设置这样的机器人？或者我应该尝试 oauth 游乐场并使用配置面板来避免刷新令牌再次过期？
I have developed an express app that's purpose is to send emails. I authorized an email sender using googles oauth2 playground, and their google api. I wanted to use this strategy rather than working with a third party email sender to not be subject to vendor lock-in. I had the system working successfully, but after a day it stopped working with "invalid-grant". In production, I'd like to have a permanent email address (under their google workspace) that is solely dedicated to these bot emails. The oauthplayground says you can avoid the 24 hour expiration, but I recall doing that before and it eventually came up with invalid grant. Is there a better way to set up a bot like this? Or should I just try the oauth playground and using the config panel to avoid the refresh token expiration again?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
首先，我要说
invalid-grant意味着您的刷新令牌不再有效。它不再有效，因为 googles oauth2 Playground 仅用于测试目的。访问令牌将在不到一小时内过期，使用它创建的刷新令牌将在 24 小时内过期。
虽然可以将其配置为使用您的个人客户端 ID 和客户端密钥，但这仍然不是最佳方式
即使使用此方法进行生产也不适合您。如果您的应用程序仍处于测试阶段，那么您的刷新令牌将在 7 天后过期。您需要将应用程序设置为生产环境，以获得不会过期的刷新令牌。
那么问题就变成了，为了使用 gmail api，您需要验证您的应用程序。您无法使用 googles oauth2 Playground 作为重定向 URI 来验证您的应用程序，因为您无法验证该应用程序您拥有该域名。
解决您的问题的方法是创建一个在您的域上托管的您自己的应用程序。这将允许您创建所需的凭据并让您的应用程序通过谷歌验证。
在他们的谷歌工作区下，
您发表了一条不清楚的评论。如果您使用的是 Google Workspace 那么为什么不直接使用 设置一个服务帐户域范围委派给域上的用户。您将避免上述所有问题。
To start with let me say that
invalid-grantmeans that your refresh token is no longer valid. It is no longer valid because googles oauth2 playground is intended for use for testing purposes only.Access tokens will expire in less than an hour and refresh tokens created using it will expire in 24 hours.
While it is possible to configure it to uses your personal client id and client secret it is still not the optimal way to go
Even using this method for production is not going to work well for you. If your app is still in testing phase then your refresh token is goin to expire in seven days. You will need to set your app to production in order to have a refresh token that does not expire.
The issue then becomes that in order to use the gmail api your going to need to have your application verified. You can not verify your application using the googles oauth2 playground as a redirect uri as you can not verify that you own this domain.
The solution to your problem is to create an application of your own hosted on your domain. This will allow you to create the credentials you need and have your app verified by google.
under their google workspace
You made one comment that is not clear. If you are using google workspace then why not just set up a service account with domain wide delegation to the user on the domain. You will avoid all the issues you are having above.