Introduction

You can use a custom OAuth app to authenticate a service account or a user account. You can always create a custom OAuth application, but note that desktop and headless connections support embedded OAuth, which simplifies the process of authentication.

When To Create a Custom OAuth Application

CData embeds OAuth Application Credentials with CData branding that can be used when connecting via either a Desktop Application or from a Headless Machine.

You may choose to use your own OAuth Application Credentials when you want to

• control branding of the Authentication Dialog
• control the redirect URI that the application redirects the user to after the user authenticates
• customize the permissions that you are requesting from the user

Enable the Google Analytics API

Follow these steps to enable the Google Analytics API:

1. Navigate to the Google Cloud Console.
2. Select Library from the left-hand navigation menu. This opens the Library page.
3. In the search field, enter "Google Analytics API" and select Google Analytics API from the search results.
4. On the Google Analytics API page, click ENABLE.

Create an OAuth Application for User Accounts (OAuth)

When using AuthScheme=OAuth, and you're using a web application, you must create an OAuth Client ID Application. For desktop and headless flows, creating a custom OAuth application is optional.

Follow these steps to create a custom OAuth application:

1. Navigate to the Google Cloud Console.
2. Create a new project or select an existing project.
3. Select Credentials from the left-hand navigation menu.
4. Create a consent screen if one is not already configured for your selected project by clicking CONFIGURE CONSENT SCREEN. If you are not using a Google Workspace account, you are restricted to creating an External-type Consent Screen, which requires specifying a support email and developer contact email. Additional info is optional.
5. On the Credentials page, select Create Credentials > OAuth Client ID.
6. In the Application Type menu, select Web application.
7. Specify a name for your OAuth custom web application.
8. Under Authorized redirect URIs, click ADD URI and enter a redirect URI. Press Enter.
9. Click CREATE, which returns you to the Credentials page.
10. A window opens that displays your client Id and client secret. Although the client secret is accessible from from the Google Cloud Console, we recommend you write down the client secret. You need both the client secret and client Id to specify the OAuthClientId and OAuthClientSecret connection properties.

Create an OAuth Application for Service Accounts (OAuthJWT)

You can use a service account in this OAuth flow to access Google APIs on behalf of users in a domain. A domain administrator can delegate domain-wide access to the service account.

To complete the service account flow, generate a private key in the Google Cloud Console. In the service account flow, the driver exchanges a JSON Web token (JWT) for the OAuthAccessToken. The private key is required to sign the JWT. The driver will have the same permissions granted to the service account. When using AuthScheme=OAuthJWT, you must create a Service account. Follow these steps:

1. Navigate to the Google Cloud Console.
2. Create a new project or select an existing project.
3. Select Credentials from the left-hand navigation menu.
4. Select Create Credentials > Service account.
5. On the Create service account page, enter the Service account name, the Service account ID, and, optionally, a description.
6. Click DONE. This returns you to the Credentials page.
7. Select the newly created Service account under the Service Accounts section.
8. Click the KEYS tab > ADD KEY > Create new key.
9. Select any supported Key type (see OAuthJWTCert and OAuthJWTCertType).
10. Click CREATE. The key will be automatically downloaded to your device, and any additional information specific to the key will be displayed.