OAuth 2.0 for iOS & Desktop Apps

Page Summary

outlined_flag

• This document explains how installed applications use Google's OAuth 2.0 endpoints to authorize access to Google APIs, allowing users to share data without exposing sensitive information.

• Prerequisites for using Google's OAuth 2.0 with installed apps include enabling necessary APIs in the API Console and creating authorization credentials.

• The process for obtaining OAuth 2.0 access tokens involves generating a code verifier and challenge, sending a request to Google's authorization server, handling the user consent prompt, and exchanging the authorization code for access and refresh tokens.

• After obtaining an access token, you can call Google APIs by including the token in the request header or as a query parameter, and access tokens can be refreshed without user interaction if offline access was requested.

• To enhance security and prevent app impersonation, it is recommended to implement features like App Check for iOS clients and verify app ownership for Chrome applications.

This document explains how applications installed on devices like phones, tablets, and computers use Google's OAuth 2.0 endpoints to authorize access to Google APIs.

OAuth 2.0 allows users to share specific data with an application while keeping their usernames, passwords, and other information private. For example, an application can use OAuth 2.0 to obtain permission from users to store files in their Google Drives.

Installed apps are distributed to individual devices, and it is assumed that these apps cannot keep secrets. They can access Google APIs while the user is present at the app or when the app is running in the background.

This authorization flow is similar to the one used for web server applications. The main difference is that installed apps must open the system browser and supply a local redirect URI to handle responses from Google's authorization server.

Libraries and samples

For iOS apps we recommend using the latest version of the Sign In With Google iOS SDK. The SDK handles user authorization and is simpler to implement than the lower-level protocol described in this guide.

For apps running on devices that don't support a system browser or that have limited input capabilities, such as TVs, game consoles, cameras, or printers, see OAuth 2.0 for TVs & Devices or Sign-In on TVs and Limited Input Devices.

Prerequisites

Enable APIs for your project

Any application that calls Google APIs needs to enable those APIs in the API Console.

To enable an API for your project:

1. Open the API Library in the Google API Console.
2. If prompted, select a project, or create a new one.
3. The API Library lists all available APIs, grouped by product family and popularity. If the API you want to enable isn't visible in the list, use search to find it, or click View All in the product family it belongs to.
4. Select the API you want to enable, then click the Enable button.
5. If prompted, enable billing.
6. If prompted, read and accept the API's Terms of Service.

Create authorization credentials

Any application that uses OAuth 2.0 to access Google APIs must have authorization credentials that identify the application to Google's OAuth 2.0 server. The following steps explain how to create credentials for your project. Your applications can then use the credentials to access APIs that you have enabled for that project.

1. Go to the Clients page.
2. Click Create client.
3. The following sections describe the client types that Google's authorization server supports. Choose the client type that is recommended for your application, name your OAuth client, and set the other fields in the form as appropriate.