Accessing Shoeboxed API with Google Apps Script (OAuth v2)

Question

I'm trying to initiate a session with the Shoeboxed API via Google Apps Script. I hoped I could use Apps Script internal library to access it but I'm having issues. Here is my attempt:

function testAPI() {
var consumerKey = '';
var consumerSecret = '';

var oauthConfig = UrlFetchApp.addOAuthService('shoeboxed');
oauthConfig.setAccessTokenUrl(
'https://id.shoeboxed.com/oauth/token');
oauthConfig.setRequestTokenUrl(
'https://id.shoeboxed.com/oauth/token');
oauthConfig.setAuthorizationUrl(
'https://id.shoeboxed.com/oauth/authorize');
oauthConfig.setConsumerKey(consumerKey);
oauthConfig.setConsumerSecret(consumerSecret);

var options = {
  'oAuthServiceName' : 'shoeboxed',
  'oAuthUseToken' : 'always'
};

var url = 'https://api.shoeboxed.com/v2/user';
var response = UrlFetchApp.fetch(url, options);
Logger.log("Response: " + response.getContentText());
}

It's failing at the point where it attempts to fetch user data via the API url with an authorization failed message. I'm not sure what I'm doing wrong. Information about the API and OAuth can be found here: https://github.com/Shoeboxed/api/blob/master/sections/authentication.md

Steve Lieberman Steve Lieberman · Accepted Answer · 2014-08-23T19:03:42

New method:

It looks like that API requires OAuth2, but the UrlFetchApp.addOAuthService method only works with the older version of OAuth.

There's a new method ScriptApp.newStateToken() which can be used in combination with OAuth2, but it requires more manual/explicit control over the OAuth2 steps. It generates a state token.

A minor detail on that method:

Note that when you construct URLs, the state token should passed as a URL parameter on the .../authorize URL, not embedded as a URL parameter within the .../usercallback URL.

For example:

You would want to redirect the user to:

https://id.shoeboxed.com/oauth/authorize?client_id=<your client id>&response_type=code&scope=all&redirect_uri=<your site>&state=<CSRF token>

where redirect_uri is:

https://script.google.com/macros/d/1234567890abcdefghijklmonpqrstuvwxyz/usercallback

When the user clicked authorize, Shoeboxed should redirect them to:

https://script.google.com/macros/d/1234567890abcdefghijklmonpqrstuvwxyz/usercallback?state=<CSRF token>

Accessing Shoeboxed API with Google Apps Script (OAuth v2)

2 Answers

New method:

A minor detail on that method: