1. Home
  2. On-premises 5.1
  3. Guides
  4. Tours
  5. Concepts
  6. Tools
  7. References
    1. Apache Spark
    2. Connectors
    3. Built-in Functions
    4. Incorta Connector SDK
    5. Security
      1. Client credentials for a Google APIs project
      2. Enable Zookeeper SSL
      3. Enable MySQL SSL
      4. HTTPS for Apache Tomcat with OpenSSL
      5. OAuth for Box
      6. OAuth for Dropbox
      7. OAuth for Google API
      8. OAuth for Microsoft Azure Gen1
      9. OAuth for OneDrive
      10. OAuth for Sharepoint
      11. OAuth for Smartsheet
      12. Security Roles
    6. Visualizations
    7. Other
  8. Integrations
  9. Data applications
  10. Releases

Security → Client credentials for a Google APIs project

About a Google APIs project

A Google APIs project defines what type of services and applications you can access from Google applications and services. For example, a Google APIs project supports access to Google Sheets and Google Drive.

There are numerous Google APIs that allow third party applications such as Incorta to access files and folders in Google. To access the Google APIs, you must first create a Google APIs project using either a Google account or a G Suite account.

For your Google APIs project, you will need to create a client credential. A client credential is an OAuth 2.0 credential such as a client ID and a client secret. Only you and Google know these values. OAuth 2.0 is the industry-standard protocol for authorization flows for web applications, desktop applications, mobile phones, and living room devices.

Note

Although it is possible to use a Google Account, you will need to create an External project that includes an OAuth consent screen. This requires an authorized top-level domain (mycompany.com) with a hosted website that includes an Application Homepage, Privacy Policy, and Terms of Service. Configuration also requires adding a scope for ./auth/drive.readonly. As of 2020, Google classifies all Google Drive API scopes as Restricted Scopes for an external project. Google must approve an external project with OAuth consent with a restricted scope. Please review OAuth API verification FAQs for more information.

Create client credentials for a Google Drive and Google Sheets APIs project*

Incorta offers two Google connectors that require client credentials for a Google APIs project:

The Google Sheets connector requires access to Google Drive. For this reason, your Google APIs project needs to enable both the Google Drive API and Google Sheets API.

Important

The Google APIs do not accept self-signed security certificates. You must use a valid certificate for a known public domain. You can generate a valid certificate for a public domain for free from Let’s Encrypt, Certbot and OpenSSL. For more details, please review Security → HTTPS for Apache Tomcat with OpenSSL.

Note

Because Google makes regular changes to the Google Developer Console, the steps below are subject to revision, and serve only as a general guide.

Here are the steps to create client credentials for a Google APIs project:

  • Sign in to the Developer Console for Google APIs.
  • Create a New Project.
  • In New Project, specify the Project name, Organization, and Location.
  • Select Create.
  • In Google APIs, in the header, select the new project in the Project dropdown list.
  • Select + Enable APIs and Services.
  • In the API Library, in G Suite, select Google Drive API.
  • In Google Drive API, select Enable.
  • Go back to the API Library, and in G Suite, select Google Sheets API.
  • In Google Sheets API, select Enable.
  • In Google APIs, in the side bar, select Credentials.
  • In Credentials, select Create Credentials --> OAuth client ID.
  • Select Configure Consent screen.
  • Complete the Consent screen by defining the properties below:
PropertyDescription
Application typeSelect Internal so that only users with a Google Account in your organization can grant access to the scopes requested by this app
Application nameThe name should accurately reflect your application and be consistent with the application name users see elsewhere. Be careful not to use a name that suggests your application is from Google or another company.
Application logoAn image on the consent screen that will help users recognize your app
Support emailThis email address will be shown to users on the consent screen. You can use your email address or a Google Group email address that you manage.
Scopes for Google APIsScopes allow your application to access your user's private data
Authorized domainsTo protect you and your users, Google only allows applications that authenticate using OAuth to use Authorized Domains. Your application's (or applications') links must be hosted on Authorized Domains.
Application Homepage linkShown on the consent screen. Must be hosted on an Authorized Domain.
Application Privacy Policy linkShown on the consent screen. Must be hosted on an Authorized Domain.
Application Terms of Service linkShown on the consent screen. Must be hosted on an Authorized Domain.
  • Make sure that this project is internal and select Save.
  • Select Create Credentials.
  • Select the OAuth client ID option.
  • In Application type, select Web application.
  • In Name, enter the name of the OAuth 2.0 client.
  • Under Authorized redirect URIs, select the + Add URI button.
  • In Authorized JavaScript origins, in URIs, enter the following:
https://<INCORTA_ANALYTICS_HOST>:<INCORTA_HTTPS_PORT_DEFAULT_IS_8443>
  • Select + Add URI.
  • In Authorized redirect URIs, in URIs, enter the following:
https://<INCORTA_ANALYTICS_HOST>:<INCORTA_HTTPS_PORT_DEFAULT_IS_8443>/incorta/service/datasource/oauthRedirect
  • Select + Add URI.
  • Select Create
  • In the OAuth client created dialog, copy Your Client ID and Your Client Secret.
  • Select OK.

Examples of a Client Id and Client Secret

Example of Client ID:

156944882797-q0d9i1vsrvhkx1gbrlbegn4899neh7gh.apps.googleusercontent.com

Example of Client Secret:

qLUqMIoJAlnBKE9oKIcSEgRxTH2104C

Additional Considerations for Incorta Cloud

If you are using Incorta Cloud and are not using your organization’s domain, complete the Consent screen by defining the properties below:

PropertyDescription
Application Homepage linkhttps://cloud.incorta.com/api/gdrive
Application Privacy Policy linkhttps://cloud.incorta.com/api/gdrive
Application Terms of Service linkhttps://cloud.incorta.com/api/gdrive