Google Apps Script – Register Application and Retrieve Client ID and Secret for OAuth

google-apps-script

How do I register an Apps Script project and get the Client Secret for oAuth, and set the callback URL?

Best Answer

These are instructions for getting the client ID and secret for oAuth.

This explains the process of navigating the Cloud Platform and getting your Apps Script project information including the client ID and secret.

An Apps Script project is initially given a "default" Google Cloud Project, but you will need to create a "standard" Google Cloud Project, and then associate the Apps Script project with the Google Cloud Project. To create a "standard" Google Cloud Project, you must first open the Google Cloud Platform dashboard at:

Google Cloud Platform

Then you need to create a new Cloud Platform Project, get the Cloud Platform Project id number, and add it to the Apps Script Project.

First go to IAM & admin, and choose "Manage resources" Click "Create Project"

Create a project, and get the id number. Go back to the Apps Script code editor, and open the Resources menu. Enter the id number and associate it with the Apps Script project.

In the "Resources" menu, choose the "Cloud Platform Project" item.

Dialog comes up:

Click Blue Link. Developers Console comes up. Navigate to Credentials.

In the Credentials page, click on either the Name or the "Edit OAuth Client" (pencil) icon.

Get the client ID and the client secret. You will need this for the oAuth authorization.

You must also enter a Redirect URI:

Quote from Eric Koleda's apps-script-oauth2: Eric Koleda's apps-script-oauth2

Before you can start authenticating against an OAuth2 provider, you usually need to register your application and retrieve the client ID and secret. Often these registration screens require you to enter a "Redirect URI", which is the URL that users will be redirected to after they've authorized the token. For this library (and the Apps Script functionality in general) the URL will always be in the following format:

https://script.google.com/macros/d/{PROJECT KEY}/usercallback

Direct answer.

To create an installable triggers, open Script Editor (Tools > Script Editor in Spreadsheets or Documents, or in "three dots" menu in Google Forms). Within it go to Edit > Current project's triggers. A pop-up window will appear, listing the current triggers (if any) and prompting you to create a new one.

"On open" in a form

The above will not help because what you are trying to do is impossible. For a form "on open" means the form is opened for editing. This is true for both simple and installable triggers. There is no trigger for "someone opened the form to fill it up. You cannot modify the contents of the form based on who opened it.

Other remarks

a simple onOpen trigger will not be triggered by users other than the owner of the script

This is incorrect. I use simple onOpen triggers to create custom menu items in shared spreadsheets, and they work for every user with access to the spreadsheet.

Google Apps Script Web App URLs – Are They Secret?

As the post linked by Rubén calculates, there is plenty of entropy in the URL of a GAS web app. That post considers document Id, which has 44 characters; by my count, web app URLs have 54-55 random characters. You certainly don't have to worry about brute force attack.

The weak spot is you or your program leaking the URL in some way. This is somewhat troublesome because if you suspect a leak, you can't change the URL easily the way we change passwords. To guard against that scenario, you may want to generate a token for your program to send with its GET or POST request to the app. The app would do something like

doGet(e) {
  if (e.parameter.token == "valid_token") {
    return information;
  }
}

Best Answer

Related Solutions

Google Apps Script – How to Create an Installable Trigger

Direct answer.

"On open" in a form

Other remarks

Google Apps Script Web App URLs – Are They Secret?

Related Topic