使用Google Compute Engine上的应用程序默认凭据来访问Sheets API [英] Use Application Default Credentials on Google Compute Engine to access Sheets API

问题描述

ADC(应用程序默认凭据)工作流是否仅支持Google Cloud API(例如，支持Google Cloud Storage API，但不支持Google Sheet API)?

Does the ADC (Application Default Credentials) workflow only support Google Cloud APIs (for example, supports for Google Cloud Storage API, but not the Google Sheet API)?

我指的是 google.auth的默认方法-不必在代码中存储任何私钥是一个巨大的胜利，也是有效利用ADC(应用程序默认凭据)设置的主要好处.

I'm referring to google.auth's default method - not having to store any private keys with the code is a great win and the main benefit of making effective use of the ADC (Application Default Credentials) setup.

如果我将GOOGLE_APPLICATION_CREDENTIALS环境变量设置为私钥文件(例如key.json)，则以下代码有效.这与google.auth软件包的步骤1中的default方法一致:1. If the environment variable GOOGLE_APPLICATION_CREDENTIALS is set to the path of a valid service account JSON private key file, then it is loaded and returned.

The following code works if I set the GOOGLE_APPLICATION_CREDENTIALS environmental variable to the private key file, say key.json. This is inline with the default method as per step 1 of the google.auth package: 1. If the environment variable GOOGLE_APPLICATION_CREDENTIALS is set to the path of a valid service account JSON private key file, then it is loaded and returned.

import google.auth
from apiclient import discovery

credentials, project_id = google.auth.default(scopes=['https://www.googleapis.com/auth/spreadsheets'])

sheets = discovery.build('sheets', 'v4', credentials=credentials)

SPREADSHEETID = '....'

result = sheets.spreadsheets().values().get(spreadsheetId=SPREADSHEETID, range='Sheet1!A:B').execute()

print result.get('values', [])

现在，查看方法的第4步:4. If the application is running in Compute Engine or the App Engine flexible environment then the credentials and project ID are obtained from the Metadata Service.

Now, looking at step 4 of the method: 4. If the application is running in Compute Engine or the App Engine flexible environment then the credentials and project ID are obtained from the Metadata Service.

如果我在Google Compute实例上删除了GOOGLE_APPLICATION_CREDENTIALS环境变量，则会出现以下错误:

If i remove the GOOGLE_APPLICATION_CREDENTIALS environmental variable on a Google Compute instance, I get the following error:

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://sheets.googleapis.com/v4/spreadsheets/..../values/Sheet1%21A%3AB?alt=json returned "Request had insufficient authentication scopes.">

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://sheets.googleapis.com/v4/spreadsheets/..../values/Sheet1%21A%3AB?alt=json returned "Request had insufficient authentication scopes.">

根据Cloud Console，这与Google的向导不一致:

This is not consistent with Google's wizard as per the Cloud Console:

推荐答案

根据本文档，则您使用的范围要求 Oauth 2.0 授权.因此，需要用户登录并同意.

According to this documentation, the scope that you're using requires Oauth 2.0 authorization. Therefore, a user login and consent is required.

这篇关于使用Google Compute Engine上的应用程序默认凭据来访问Sheets API的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！