Around the authentication of PyDrive2, a package that operates Google Drive with Python

Introduction

In this article, we will take up PyDrive2 (GitHub) from among the packages that operate Google Drive with Python. Google Drive can be operated via Drive API, but I will summarize the authentication part of Drive API in PyDrive2 as a memorandum. Specifically, it deals with the following.

--How to create credentials (OAuth 2.0 client ID) on GCP console --How to authenticate with PyDrive2 --How to save the authentication information on the local terminal and prevent the browser authentication screen from appearing each time

About PyDrive2

PyDrive (GitHub) may be a little known as a package for operating Google Drive with Python. Unfortunately, PyDrive has been out of update for over a year now.

It seems that PyDrive2 was forked from PyDrive recently (January 2020). PyDrive2 claims to be "Maintained fork of PyDrive."

It seems that PyDrive2 hasn't incorporated any backwards incompatible changes yet (as of May 2020). As a PyDrive2 document, PyDrive Document is even linked. In addition, the knowledge accumulated in the issue of PyDrive has the impression that it can be applied as it is to PyDrive2.

Operating environment

$ sw_vers
ProductName:	Mac OS X
ProductVersion:	10.14.6
BuildVersion:	18G3020
$ python -V
Python 3.8.1
$ pip list | grep PyDrive2
PyDrive2                 1.4.10

Start using PyDrive2

Follow the PyDrive documentation Quickstart (https://gsuitedevs.github.io/PyDrive/docs/build/html/quickstart.html).

1. Create the credentials required to operate the Drive API in the GCP console
2. Authentication using the created authentication information

Proceed in the order of.

1. Create credentials from the GCP console

It is assumed that you have a GCP (Google Cloud Platform) account and have one or more projects in GCP. Create an "OAuth client ID" according to Quickstart.

1. If not enabled, enable the Drive API from the GCP console --Go to https://console.cloud.google.com/apis/api/drive.googleapis.com/overview --In this article, we have enabled the Drive API in the "Drive-Template-Copy" project and created an OAuth client ID.

2. Create OAuth client ID (enter document value) --Recommended operation from API and Service Dashboard --Create from "Authentication Information" in the navigation on the left → Enter the setting value in Quickstart → Created (this pop-up is closed by clicking "OK")

3. After creating, download the authentication information to the development terminal --Move your credentials to your working directory and rename it to client_secrets.json

2. Operation check

Refer to Quickstart and run the following code.

quickstart.py

from pydrive2.auth import GoogleAuth  #Read pydrive as pydrive2 from Quickstart

gauth = GoogleAuth()
gauth.LocalWebserverAuth()

File placement

.
├── client_secrets.json
└── quickstart.py

Running quickstart.py will launch your browser.

$ python quickstart.py
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?client_id=...

When you select a Google account and log in,

The command line also shows that the authentication was successful!

$ python quickstart.py
Your browser has been opened to visit:

  :

Authentication successful.

I want to prevent the browser from starting every time

Go to the PyDrive documentation OAuth made easy.

With just two lines of code, I've been authenticated to use the Drive API. It's pretty easy, but you have to log in from your browser every time you run this script. This is not suitable for scripted automation. Therefore, we will set PyDrive2 to save the information used for authentication and update it automatically after that. Once you log in, the saved credentials will be updated and used, eliminating the need to log in from your browser.

To achieve the above, write settings.yaml. The settings for saving the authentication information to a file are as follows.

settings.yaml

# OAuth 2.0 Specify (rename) client authentication information
client_config_file: my_client_secrets.json

#Settings to save credentials to a file
save_credentials: True
save_credentials_backend: file
save_credentials_file: saved_credentials.json

#Authentication information(credentials)Setting to update automatically (browser does not start)
get_refresh_token: True

File placement

.
├── my_client_secrets.json
├── quickstart.py
└── settings.yaml

Running python quickstart.py on the command line requires you to log in from your browser the first time.

A warning page will be displayed depending on the scope of operation using the Drive API (scope * described later). "Show details" to move.

• When accessing for the first time. A pop-up appears asking if you want to allow "View, edit, create, delete all files in Google Drive". After allowing it in the pop-up, the following screen will be displayed.

If you allow it, your browser will display "The authentication flow has completed".

Authentication using a browser is only the first time. Since get_refresh_token is enabled [^ 1], the browser will not start because the authentication information is automatically updated and authenticated from the second time onward [^ 2].

File placement

.
├── my_client_secrets.json
├── quickstart.py
├── saved_credentials.json  #Created. After that, it will be updated automatically
└── settings.yaml

[^ 1]: Every time I change the value of get_refresh_token, it seems that I need to log in with a browser for the first time. It is recommended to delete the saved credentials and re-execute (I enabled get_refresh_token with saved_credentials.json in the past, but it was not reflected and I was addicted to it. I wonder if the items of the returned data are different. "

[^ 2]: It seems that the authentication information may not be updated automatically after a period of time. When I touched it for the first time in a while, an error occurred. I deleted the saved credentials (saved_credentials.json) and re-executed to resolve it.

Supplementary information

Drive API scope

There is an item called ʻoauth_scope in settings.yaml[^ 3]. Since it is not specified this time, the default value is[‘https://www.googleapis.com/auth/drive’]. According to the Drive API Scope List (https://developers.google.com/drive/api/v2/about-auth#OAuth2Authorizing), this is a Restricted` scope. Apps that require a restricted scope and have not passed Google's verification process will be labeled as "Unverified app" and the previous "This app has not been verified" page will be displayed. [^ 4].

According to https://support.google.com/cloud/answer/7454865, you need to add https://www.googleapis.com/auth/drive to the" OAuth consent screen ". There is. However, simply adding it wasn't enough, and I had to apply for Google's verification.

What you want to achieve by working with Google Drive in Python is, at this stage, personal automation. Since we are not developing an app for use by a third party, we will not proceed to the approval process and will continue to develop it as it is [^ 5].

[^ 4]: From https://support.google.com/cloud/answer/7454865. "An unverified app is an app or Apps Script that requests a sensitive or restricted OAuth scope, but hasn't gone through the Google verification process"

[^ 5]: "Apps in development: if your app is experimental or a test build, you don't need to go through verification unless you decide to launch it to the public." Https://support.google.com/ From cloud / answer / 7454865

LocalWebserverAuth and CommandLineAuth

I changed LocalWebserverAuth to CommandLineAuth to prevent the browser from launching the first time I logged in, but it didn't work.

From the "authorization error" displayed on the browser, the OAuth client ID is * created as a web application *, so it seems that it does not support CommandLineAuth.

Therefore, I think it is essential to log in with the browser for the first time [^ 6].

[^ 6]: In the execution environment where the browser cannot be started, the saved authentication information is duplicated and placed (the browser does not start, so it can be executed without problems).

settings.yaml and client_secrets.json

If settings.yaml and client_secrets.json are in the same directory as quickstart.py, it seems that settings.yaml will be loaded. I was curious, so I took a look at the [Implementation] of GoogleAuth in ʻauth.py` (https://github.com/iterative/PyDrive2/blob/d2065b42a4c6cc39fb6666a278b361d2c59ab8c2/pydrive2/auth.py#L142). ..

--The call GoogleAuth () means that " settings.yaml " (default value) was specified. --If you rename settings.yaml, you should pass it to the argument of GoogleAuth. --Settings.yaml is loaded while executing GoogleAuth () --The client_config_file specified in settings.yaml is used --If not specified in settings.yaml, " client_secrets.json " is used as the default value.

In this article

--client_secrets.json is used before creating settings.yaml --After creating settings.yaml, the client_config_file specified there will be used.

There are.