Google OAuth and UI - is is possible to pass back the authorization code not in the URL?

Question

Is it possible to use Google OAuth and have no UI ever?

My thought is: save the account credentials and refresh token into a custom setting and keep calling that every time. So the flow would look something like:

1. We Authorize with this URL: https://accounts.google.com/o/oauth2/auth?client_id=123456789&response_type=code&scope=https://www.googleapis.com/auth/theappweareusing&redirect_uri=/apex/testHTMLPage&access_type=offline
2. Rather then redirecting us when we are done to testHTMLPage and getting back the code parameter with the authorization code in the URL, is is possible to pass back the authorization code in another way? I do not want to have to display any pages in order to get the code.
3. Save the authorization code into a custom setting
4. We take the authorization code from the custom setting and use it to exchange for the authorization token and refresh token
5. Save the refresh token in a custom setting
6. Once I have both of these tokens, I call the https://accounts.google.com/o/oauth2/token and pass it the token, the key, and the secret (no need for the redirect uri)
7. I should get back a response status code of 200 and can move on from there

My end goal is to have a Trigger callout to a google api without any user interaction. I would like everything to seamlessly run in the background.

Answer 1

That approach should work - I've made this work with the refresh token to retrieve Google Analytics data each night. I store the refresh token in a setting, and when I need to access GA, I get a new token as you described.

You'll need to put in place error handling for when the access token expires so you can get a new token, and I found Google's oAuth to be flaky, so worth putting in a second attempt to get the token if the first one fails.

One tip I also saw here was to use the Platform Cache feature to store the access token since that is available in batches etc...so store the token, and then check for expiration before you use it and only get a new one when you need it.

I have also been looking at implementing the Auth.JWT method with a certificate based on some other posts on StackEx. That seems to work fine in testing so that's another option, and then doesn't require storing refresh tokens e.g.

    String AUTH_ENDPOINT = 'https://www.googleapis.com/oauth2/v4/token';
    //Using a Custom Setting for values like scope, ISS & Certificate Name
    String SCOPE = gaSettings.JWT_Scope_Value__c;

            Auth.JWT jwt = new Auth.JWT();
            jwt.setAud(AUTH_ENDPOINT);
            jwt.setIss(gaSettings.ISS_Value__c);
            jwt.setAdditionalClaims(new Map<String, Object>{
                    'scope' => SCOPE
            });

            // Create the object that signs the JWT bearer token with the 
            certificate from Certificate Management
            Auth.JWS jws = new Auth.JWS(jwt, gaSettings.Certificate_Name__c);

            // Get the access token
            Auth.JWTBearerTokenExchange bearer;
            try {
               bearer = new Auth.JWTBearerTokenExchange(AUTH_ENDPOINT, jws);
                String token;
                if (test.IsRunningTest() == FALSE) {
                    token = bearer.getAccessToken();
                }
                else {
                    token = 'X123456';
                }
                sAccessToken = token;
                cacheAccessToken(sAccessToken);
            } catch (Exception Ex) {
                sAccessToken = 'Token Creation Error';
            }
            return sAccessToken;
            }