应该使用服务帐户还是OAuth 2.0客户ID？
我 我正在创建一个基本应用程序，该应用程序将帮助用户为一个Google帐户添加和修改Google日历事件（该帐户在所有用户之间共享）。我只需要访问该帐户的应用程序，它永远不需要访问任何其他帐户。
在我看来，服务帐户最适合此，但是Google的文档表明，服务帐户仅用于自动化流程（除非我误解）。例如此页面包含以下，描述了何时使用服务帐户。
我的申请是否有资格代表用户行事？
如果是这样，我将要使用OAuth客户端ID凭据，该凭据将要求用户登录Google帐户。在这种情况下，有没有办法保证他们只登录我要修改的一个帐户？
我找不到有关OAuth身份验证请求的任何体面文档，可以自己弄清楚这一点。如果有什么，你能在那里指出我吗？
我敢肯定，我在这里误解了一些基本的东西，但是谢谢您的任何帮助！
Should I use a Service Account or an OAuth 2.0 Client ID?
I'm struggling to understand Google's documentation on authenticating for their APIs. I'm creating a basic application that will help users add and modify Google Calendar events for a single Google account (the account is shared between all users). I only need the application to access that one account, it'll never need to access any others.
It seems to me that Service Account would be best for this, but Google's documentation suggests Service Accounts should only be used for automated processes (unless I'm misunderstanding). For instance this page contains the following, describing when to use Service Accounts.
Would my application qualify as acting on the users behalf?
If so, I would want to use OAuth Client ID credentials, which will ask the user to sign in to a google account. In this case, is there a way I can guarantee they only sign in to the one account I want modified?
I can't find any decent documentation on the OAuth authentication requests to figure this out myself. If there is any could you point me there?
I'm sure I'm misunderstanding something basic here, but thank you for any help!
发布评论
评论（1）
首先，您应该知道，如果您有Google Workspace域帐户，则只能使用Google Aclendar API使用服务帐户。
然后，您可以设置一个日历和域用户，该服务帐户可以代表该日历来控制该日历的访问。
假设您的应用程序将在此日历上进行所有操作，那么是的，我会说您可以为此使用服务帐户。如果您的应用程序BACLE具有带有日历的UI，则仅使用Google日历来存储数据。
但是，如果您打算与用户自己共享此日历，这样他们就可以在自己的Google日历帐户中看到它。我不确定服务帐户是否是必经之路。
如果您希望用户能够看到并进行更改，则可能只想使用OAuth2。授予他们访问日历，然后请求访问其日历帐户。
该选项的缺点将是验证过程。您将可以访问所有用户日历，并且您将需要写入访问。
如果您可以使用服务帐户，您真的应该考虑它，它可以为您节省很多麻烦。
First off you should know that you can only use service accounts with Google aclendar api if you have a google workspace domain account.
You can then set up a calendar and a domain user that the service account can act on behalf of to control the access of that calendar.
Assuming that your application is going to preform all actions on this calendar then yes i would say that you could use a service account for this. If your app bacly has a ui with a calendar on it your just using google calendar to store the data.
However if you intend to share this calendar with the users themselves, this way they could see it within their own google Calendar account. Im not sure a service account would be the way to go.
If you want the users to be able to see it and make changes then you may want to just use Oauth2. Grant them access to the calendar and then request access to their calendar account.
Drawback to that option is going to be the verification process. You will get access to all the users calendars and your going to need write access.
If you can go with a service account you really should consider it it will save you a lot of hassle with verification.