Gmail API域名范围的授权 [英] Gmail API domain-wide delegation

问题描述

我正在使用Gmail API，并且正在尝试从公司下的所有用户提取电子邮件。但是，当我运行如下代码：

  function runAPI（auth）{
 var gmail = google.gmail（' V1' ）; 
 gmail.users.threads.list（{auth：auth，userId：'108800016305523828361'}，''，function（err，response）{
 if（err）{
 console.log （API返回错误：+ err）; 
 return; 
} 
 var threads = response.threads; 
 console.log（threads）; 
 }）
} 
  

我得到错误：

API返回了一个错误：Error：Delegation denied for [e-mail]

在管理控制台中，我做到了这一点：

作为我从 client_secret.json 文件中使用id的客户端名称。对于范围，我给了它所有权限。

如何正确设置Gmail API的域名范围授权？

解决方案

设置没问题，但是在你的代码中你做错了。

这段代码：

gmail.users.threads.list（{auth：auth，userId：'108800016305523828361'}，''，function（err，response）

特别是。

然而，在您需要调用Gmail API之前，userId应该是我 要在您的代码中使用服务帐户JWT流来为您要访问的Gmail用户检索oauth2凭据，如准备创建授权的API调用服务帐户域范围的授权文档。

具体来说，这将使用您的服务帐户的私钥要求为您想要的用户获取凭证e（在您的域中设置用户的电子邮件地址，您希望在请求中的 setServiceAccountUser（[e-mail]）函数中访问）。然后，您可以在致电Gmail API时使用 GoogleCredential 。

I am using Gmail API and I am trying to fetch emails from all users under company. But when I run code such as:

function runAPI(auth) {
  var gmail = google.gmail('v1');
  gmail.users.threads.list({auth: auth, userId: '108800016305523828361'},'',function(err, response){
    if (err) {
      console.log("The API returned an error: " + err);
      return;
    }
    var threads = response.threads;
    console.log(threads);
  })
}

I get error:

The API returned an error: Error: Delegation denied for [e-mail]

In admin console I did this:

As client name I used id from the client_secret.json file. And for scope, I gave it all permissions.

How do I properly setup domain wide delegation for Gmail API ?

解决方案

The setup is fine, however in your code you're doing it wrong.

This code:

gmail.users.threads.list({auth: auth, userId: '108800016305523828361'},'',function(err, response)

specifically.

userId should be "me" however before you can call the Gmail API you need to use the service account "JWT flow" in your code to retrieve an oauth2 credential for the Gmail user you want to access as described in the Preparing to make an authorized API call service account domain-wide delegation doc.

Specifically this uses your service account's private key to request to get a credential for the user you desire (set the user's email in your domain that you want to access in the setServiceAccountUser([e-mail]) function in the request). Then you can use that GoogleCredential in your call to the Gmail API.

这篇关于Gmail API域名范围的授权的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！