Credentials

OAuth and Service Account

For Google, Azure, and AWS, FetchAccessToken exchanges a Google service account key or an OAuth client ID/secret (with WithScope) for an access token - opening a browser for one-time consent if no service account key or refresh token is supplied.

For Google, Azure, and AWS, FetchAccessToken exchanges a Google service account key or an OAuth client ID/secret (with WithScope) for an access token - opening a browser for one-time consent if no service account key or refresh token is supplied.

After WithService(Google/Azure/AWS).WithUsername(...).WithPassword(...), call WithServiceAccountKey(file) to authenticate as a Google service account (no browser interaction), or WithClientId/WithClientSecret plus WithScope(OAuthScope) to use the standard OAuth authorization-code flow. FetchAccessToken(out accessToken) performs the exchange: for a service account it signs a JWT directly; for OAuth it uses WithRefreshToken if supplied, otherwise it builds the provider's authorization URL and opens a browser for the user to grant consent, then exchanges the resulting code for an access token and refresh token.

TIP

The first OAuth FetchAccessToken call requires the user to grant consent in a browser. Save the resulting RefreshToken and pass it via WithRefreshToken on subsequent runs to skip the consent screen.

Examples

GPAL Fluent: High-level fluent C# API

//CredentialServiceType.Azure and .AWS follow the same shape using the Azure_* and AWS_* OAuthScope values. FetchAccessToken returns an empty string on failure and stores the result on the credentials object for reuse.

// Google service account - no browser interaction required GPAL.CredentialsFor(CredentialServiceType.Google) .WithUsername("you@example.com") .WithPassword("your-password") .WithServiceAccountKey(GPAL.FileFor("service-account.json")) .WithScope(OAuthScope.Google_Sheets) .FetchAccessToken(out string serviceAccountToken); // Google OAuth client id/secret - opens a browser for consent the first time GPAL.CredentialsFor(CredentialServiceType.Google) .WithUsername("you@example.com") .WithPassword("your-password") .WithClientId("client-id.apps.googleusercontent.com") .WithClientSecret("client-secret") .WithScope(OAuthScope.Google_Drive) .FetchAccessToken(out string oauthToken); // Reuse a saved refresh token to skip the consent screen GPAL.CredentialsFor(CredentialServiceType.Google) .WithUsername("you@example.com") .WithPassword("your-password") .WithClientId("client-id.apps.googleusercontent.com") .WithClientSecret("client-secret") .WithRefreshToken("refresh-token") .WithScope(OAuthScope.Google_Drive) .FetchAccessToken(out string refreshedToken);