GetOpenIdConnect returns Invalid Credentials

1
votes

Context

We are successfully using https://accounts.google.com/o/oauth2/auth to acquire an authentication_code with the following app permissions.

  • Know who you are on Google
  • View your email address
  • View your basic profile info

We are also successfully using https://accounts.google.com/o/oauth2/token to exchange that authentication code for an access_token and id_token.

Problem

With that access_token, we are using https://www.googleapis.com/plus/v1/people/me/openIdConnect to acquire profile information. This is a GET request with the following header.

Authorization: Bearer access_token

The response from Google is invariably this error: 

 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "authError",
    "message": "Invalid Credentials",
    "locationType": "header",
    "location": "Authorization"
   }
  ],
  "code": 401,
  "message": "Invalid Credentials"
 }

This Google documentation makes two suggestions:

  • Refresh the access token using the long-lived refresh token.
  • If this fails, direct the user through the OAuth flow, as described in Authorizing Your App with Google Drive.

We have tried both of those approaches and receive the same error.

1
oauth-2.0google-apigoogle-plusopenid-connectgoogle-oauth

1 Answers

1
votes

We were accidentally using the id_token in the Authorization header. We needed to make sure to use the access_token instead.