Google OAuth and Authorization Code

Question

I have a two part question but I will break it up into two separate posts. Hopefully the first question will answer the second...The first ask is: I am working through the Google OAuth flow and would like if someone could confirm if my understanding of it is correct.

What I understand it to be is:

1. We Authorize with this URL: https://accounts.google.com/o/oauth2/auth?client_id=123456789&response_type=code&scope=https://www.googleapis.com/auth/theappweareusing&redirect_uri=/apex/testHTMLPage&access_type=offline
2. This URL redirects us when we are done to testHTMLPage and includes a code parameter with the authorization code. It looks something like this: https://nf--c.na99.visual.force.com/apex/testHTMLPage?code=7/aksdjfio900293842;kajs33222`
3. We take the authorization code from the page URL and use it to exchange for the authorization token and refresh token
4. Once I have both of these tokens, I call the https://accounts.google.com/o/oauth2/token and pass it the token, the key, the secret, and the redirect uri
5. I should get back a response status code of 200 and can move on from there

Does this sound correct? I am having difficulty breaking the authorization down around step 2 and want to make sure I am understanding correctly.

Thank you!

Answer 1

Your understanding is correct.

3. We take the authorization code from the page URL and use it to exchange for the authorization token and refresh token

This exchange of the code for tokens is "webserver to webserver" from Salesforce to Google via Apex HTTPRequest callout. This is how you secure your client secret from prying eyes.

4. Once I have both of these tokens, I call the https://accounts.google.com/o/oauth2/token and pass it the token, the key, the secret, and the redirect uri

This is correct, you'll provide the refresh token to the token endpoint and you'll receive back a session id / token which you can then use to access Google resources as this user.

You are likely going to be storing the Google refresh token in a hierarchy custom setting so you can persist the token securely per-user. This probably takes place in the controller of your testHTMLPage after exchanging the code for tokens.