Browse the docs

Sign in to Google APIs

Save a named Google (OAuth 2) sign-in once, then let any http step call a Google API as that account, with the token renewed for you.

An account is a named OAuth 2 sign-in. Make it once in Library ▸ Sign-ins; any Send HTTP request step then uses it with oauth. The access token is renewed when it is about to expire, and it never appears in a macro or a trace. Keep as many accounts side by side as you have Google logins: TH, TH2, BS.

Make a Google client #

Google needs to know the app asking. In the Google Cloud console, create an OAuth client ID of type iOS with bundle ID com.payablesdesk.switchboard, and turn on the APIs you want (Tag Manager, Analytics Admin, Search Console). Copy the client ID: it ends in .apps.googleusercontent.com. An iOS client has no secret; Switchboard signs in with PKCE.

Add the account #

  1. Library ▸ Sign-ins ▸ Add Google Account… (or switchboard oauth add google <name> --client-id <id>).

  2. Give it a name, paste the client ID, optionally the email of the Google login to use, and tick what it may do: Tag Manager (read), Analytics (read, manage users, edit) and Search Console.

  3. Sign in. Google's page opens in a system window. Press Sign In Again any time a token stops working.

Use it #

Tag Manager accounts, as TH3 (sends a request)
Do
  1. Send GET to tagmanager.googleapis.com/tagmanager/v2/accounts
  2. Show “{{res.status}}”
Open in Switchboard to try it

If the step names an account that doesn't exist it fails with no OAuth account named "X"; one that isn't signed in, or whose sign-in Google rejected, fails with sign in to "X" again. A reply of 401 or 403 is an answer, not a failure: check res.status.

Gotchas #

  • Testing apps. While the OAuth consent screen is in Testing, Google expires the refresh token after 7 days. Publish it (In production) for a sign-in that lasts.

  • Scopes. A call outside the account's scopes gets a 403. Add the scope and sign in again.

  • Where tokens live. In your Keychain (switchboard.oauth.<name>); the account file holds only names, client IDs and scopes.