gs.oauth() authorized_user.json token expires every week

[Blazingi]

Describe the bug
gs.oauth() authorized_user.json token expires every week, I have to manualy delete authorized_user.json to regain authentication

To Reproduce
Steps to reproduce the behavior:

1. Authorize in browser after calling gs.oauth()
2. Wait 1 week
3. Token expired, client is unable to continue:
   RefreshError: ('invalid_grant: Token has been expired or revoked.', {'error': 'invalid_grant', 'error_description': 'Token has been expired or revoked.'})

Expected behavior
Gs should be able to refresh the token, have the option to request token for a longer than a week, or at least run browser authentication again

Environment info:

• Arch Linux
• Python version: 3.9.7-1
• Gspread version: 3.7.0

Exception

`RefreshError: ('invalid_grant: Token has been expired or revoked.', {'error': 'invalid_grant', 'error_description': 'Token has been expired or revoked.'}) --------------------------------------------------------------------------- RefreshError Traceback (most recent call last) /tmp/ipykernel_25388/854339441.py in ----> 1 scans_sheet.batch_get(['C:C', 'L:L', 'V:V'], major_dimension='COLUMNS')

~/.local/lib/python3.9/site-packages/gspread/utils.py in wrapper(*args, **kwargs)
590 kwargs.setdefault(k, v)
591
--> 592 return f(*args, **kwargs)
593
594 return wrapper

~/.local/lib/python3.9/site-packages/gspread/models.py in batch_get(self, ranges, **kwargs)
1025 )
1026
-> 1027 response = self.spreadsheet.values_batch_get(
1028 ranges=ranges, params=params
1029 )

~/.local/lib/python3.9/site-packages/gspread/models.py in values_batch_get(self, ranges, params)
207
208 url = SPREADSHEET_VALUES_BATCH_URL % (self.id)
--> 209 r = self.client.request("get", url, params=params)
210 return r.json()
211

~/.local/lib/python3.9/site-packages/gspread/client.py in request(self, method, endpoint, params, data, json, files, headers)
62 headers=None,
63 ):
---> 64 response = getattr(self.session, method)(
65 endpoint,
66 json=json,

/usr/lib/python3.9/site-packages/requests/sessions.py in get(self, url, **kwargs)
553
554 kwargs.setdefault('allow_redirects', True)
--> 555 return self.request('GET', url, **kwargs)
556
557 def options(self, url, **kwargs):

~/.local/lib/python3.9/site-packages/google/auth/transport/requests.py in request(self, method, url, data, headers, max_allowed_time, timeout, **kwargs)
472
473 with TimeoutGuard(remaining_time) as guard:
--> 474 self.credentials.before_request(auth_request, method, url, request_headers)
475 remaining_time = guard.remaining_timeout
476

~/.local/lib/python3.9/site-packages/google/auth/credentials.py in before_request(self, request, method, url, headers)
131 # the http request.)
132 if not self.valid:
--> 133 self.refresh(request)
134 self.apply(headers)
135

~/.local/lib/python3.9/site-packages/google/oauth2/credentials.py in refresh(self, request)
226 grant_response,
227 rapt_token,
--> 228 ) = reauth.refresh_grant(
229 request,
230 self._token_uri,

~/.local/lib/python3.9/site-packages/google/oauth2/reauth.py in refresh_grant(request, token_uri, refresh_token, client_id, client_secret, scopes, rapt_token)
336
337 if not response_status_ok:
--> 338 _client._handle_error_response(response_data)
339 return _client._handle_refresh_grant_response(response_data, refresh_token) + (
340 rapt_token,

~/.local/lib/python3.9/site-packages/google/oauth2/_client.py in _handle_error_response(response_data)
58 error_details = json.dumps(response_data)
59
---> 60 raise exceptions.RefreshError(error_details, response_data)
61
62

RefreshError: ('invalid_grant: Token has been expired or revoked.', {'error': 'invalid_grant', 'error_description': 'Token has been expired or revoked.'})`

[Blazingi]

I found its possible to grant offline access to token:
https://stackoverflow.com/a/10857806
https://developers.google.com/identity/protocols/oauth2/web-server#python_7
Is it possible to to grant offline access through gspread?
Edit: Gspread already grants offline access

[lukedoomer]

my token expired as well

[lavigne958]

Hi @BlazingPL have you tried running the method client.login() before the token expires ?
I am currently running the test, just started an oauth request, will wait juste before 7 days and will call the method client.login().

[Blazingi]

@lavigne958 I got my client instance only trough gspread.oauth() as per https://docs.gspread.org/en/latest/oauth2.html#for-end-users-using-oauth-client-id.
I didn't call client.login().

[lavigne958]

I understand, but once you get you gspread.client instance from gspread.oauth() you can take that client and call the method login().

Like this:

client = gspread.oauth()
.. do stuffs ..
client.login()

[lavigne958]

Hi @Blazingi

I searched around about your issue and ran a test.

I confirm that after about a week the token expires.

This is not an issue, when you request an oauth authentication you should not never expect and unlimited access token.

In order to provide unlimited access with no restriction use a service account.

I will look into what oauth offers as solution, we might be able to use the refresh_token if it is provided. but it might be you responsibility to reissue it (will most probably be using the client.login() method).

as for now this is not an issue as expected by the oauth protocol, closing this issue.

[tmtong]

A service account is a special type of Google account intended to represent a non-human user that needs to authenticate and be authorized to access data in Google APIs [sic].

Since it’s a separate account, by default it does not have access to any spreadsheet until you share it with this account. Just like any other Google account.

Here’s how to get one:

Enable API Access for a Project if you haven’t done it yet.
Go to “APIs & Services > Credentials” and choose “Create credentials > Service account key”.
Fill out the form
Click “Create” and “Done”.
Press “Manage service accounts” above Service Accounts.
Press on ⋮ near recently created service account and select “Manage keys” and then click on “ADD KEY > Create new key”.
Select JSON key type and press “Create”.
You will automatically download a JSON file with credentials. It may look like this:

{
"type": "service_account",
"project_id": "api-project-XXX",
"private_key_id": "2cd … ba4",
"private_key": "-----BEGIN PRIVATE KEY-----\nNrDyLw … jINQh/9\n-----END PRIVATE KEY-----\n",
"client_email": "473000000000-yoursisdifferent@developer.gserviceaccount.com",
"client_id": "473 … hd.apps.googleusercontent.com",
...
}
Remember the path to the downloaded credentials file. Also, in the next step you’ll need the value of client_email from this file.

Very important! Go to your spreadsheet and share it with a client_email from the step above. Just like you do with any other Google account. If you don’t do this, you’ll get a gspread.exceptions.SpreadsheetNotFound exception when trying to access this spreadsheet from your application or a script.
Move the downloaded file to ~/.config/gspread/service_account.json. Windows users should put this file to %APPDATA%\gspread\service_account.json.
Create a new Python file with this code:
import gspread

gc = gspread.service_account()

sh = gc.open("Example spreadsheet")

print(sh.sheet1.get('A1'))
Ta-da!

Note

If you want to store the credentials file somewhere else, specify the path to service_account.json in service_account():

gc = gspread.service_account(filename='path/to/the/downloaded/file.json')
Make sure you store the credentials file in a safe place.

[brianjmurrell]

I'm not understanding why/how this is closed as I just hit this issue.

What is the solution that caused it to be closed? Is it a "service account"? But what if I want my API edits to be attributed to my own account? It doesn't sound like I want a "service account".

Maybe this has something to do with it?

I understand, but once you get you gspread.client instance from gspread.oauth() you can take that client and call the method login().

Like this:

client = gspread.oauth()
.. do stuffs ..
client.login()

What does the client.login() do additionally over and above gspread.oauth() since that is all I have seem to need to do to get a client that can work with my spreadsheet. Well until today when the token expired.

But moreover, client.login() doesn't seem to exist:

import gspread

gwc = gspread.oauth()
gwc.login()

Traceback (most recent call last):
  File "<python-input-0>", line 4, in <module>
    gwc.login()
    ^^^^^^^^^
AttributeError: 'Client' object has no attribute 'login'

[alifeee]

hi @brianjmurrell, thanks for the questions

does this new documentation by @hraftery in #1546 help? (it will be live on https://docs.gspread.org/ with the next release)

[tino]

I just ran into this. And no, the docs don't help.

I had to manually remove the files (but then ran into #1554)