AdWords API & OAuth 2.0, Advanced

Google Inc - All Rights Reserved

AdWords API - Using OAuth 2.0Advanced usage

Ray Tsang, Google, Inc.Danial Klimkin, Google, Inc.

Agenda

● Hopefully you are already using OAuth 2.0!

● Issue with unoptimized OAuth 2.0 requests

● Solutions

● Resources

Google Inc. - All Rights Reserved

RefresherOAuth 2.0????

Google Inc. - All Rights Reserved

ClientLogin is going away

You must migrate to OAuth 2.0 ASAP

ClientLogin is Going Away!

Google Inc. - All Rights Reserved

Secure○ Users enter their username/password in secure Google login page○ Third-party application won’t receive nor store the password○ Reduced impact if OAuth 2.0 access is compromised

More Control○ Restrict access via “scopes”○ User can revoke access at will

Standards driven○ RFC 6749○ Used by many large service providers, including Google

Why OAuth 2.0?

Google Inc. - All Rights Reserved

Already using OAuth 2.0?Great to hear! Watch out for some common issues

Google Inc. - All Rights Reserved

Access Token Expiration

Anticipate the possibility that a granted token might no longer work

○ The access token has expired (expires_in value)○ The user has revoked access○ The account has exceeded a certain number of active token

for the same application

Google Inc. - All Rights Reserved

The refresh token expired if unused for six months.

25 refresh token limit per user per application○ When exceeded, oldest refresh token is quietly invalidated ○ no user-visible warning - your application need to handle this

You should only need one refresh token per user

Refresh Token Expiration

Google Inc. - All Rights Reserved

When an access token has expired or revoked:

AuthenticationError.OAUTH_TOKEN_INVALID

Cause: access token expiredResolution: get a new access token with the refresh token

AuthenticationError.INVALID_GRANT_ERRORCause: access revokedResolution: re-authorize via the authorization URL (the consent screen)

Common Errors

Google Inc. - All Rights Reserved

Revoking Access

Google Inc. - All Rights Reserved

Rate Limits

There is a rate limit for obtaining the access token

QPS may change over time based on different conditions

Beware in multi-threaded and/or multi-server environment

Be ready for it in Production!

Google Inc. - All Rights Reserved

Multithreaded Environment

Client Application

Thread 1

Thread 2

Thread N

.

.

.

I have a refresh token, I need an access token!

I have a refresh token, I need an access token!

I have a refresh token, I need an access token!

Google Inc. - All Rights Reserved

Multi-Server / Multi-Process Environment

Client Application

.

.

.

I have a refresh token, I need an access token!

I have a refresh token, I need an access token!

I have a refresh token, I need an access token!

Client Application

Client Application

Google Inc. - All Rights Reserved

Client ApplicationClient Application

Put Them Together

Client Application

Thread 1

Thread 2

Thread N

.

.

.

Google Inc. - All Rights Reserved

What’s Your Platform Like?

.Net

Google Inc. - All Rights Reserved

Sharing the access tokenSharing is caring

Google Inc. - All Rights Reserved

Share the token and the expiration time

Access token

Calculated expiration time

12

6

39

T1

expires_in

Te

Google Inc. - All Rights Reserved

Multithreaded platforms can share data among threads

Must be thread-safe

Use the singleton pattern

Use a Singleton

Credential object in Java can be shared

Google Inc. - All Rights Reserved

Minimize Access Token Requests

Client Application

Thread 1

Thread 2

Thread N

.

.

.

I have a refresh token, I need an access token!

I’ll re-use the Credential

I’ll re-use the Credential

Google Inc. - All Rights Reserved

Minimize the number of initial access token requests is half the problem

When access token expires - minimize refresh requests!

Handling Expiration

Credential object in Java handles expiration

Google Inc. - All Rights Reserved

Use a shared storage○ In-memory: Memcached, Infinispan, Ehcache, ...○ Persistent: RDBMS, MongoDB, …

Store securely!

Don’t forget to check for expirations

Use Shared storage

Google Inc. - All Rights Reserved

Using a Shared Storage

Client Application

.

.

.

Client Application

Shared Storage

1. Check if unexpired access token is already in the shared storage

Client Application 2. If expired, use the refresh token

to get an access token

3. Write the credential back to the shared storage

4. Check if unexpired access token

is already in the shared storage

Google Inc. - All Rights Reserved

Worst case scenario: All processes simultaneously read expired access token from the shared storage

● Avoid race conditions● Eagerly refresh stored credentials before it expires

○ e.g., If access token expires in 1 hr, refresh in 45 minutes

Proactive Refresh

Make sure server clocks are in sync (use NTP)

Google Inc. - All Rights Reserved

Proactive Refresh

Client ApplicationShared Storage

Check if unexpired access token is already in the shared storage

Periodic Refresher1. Use the refresh token to get a new access token

2. Write the credential back to

the shared storage

Google Inc. - All Rights Reserved

Centralize OAuth 2.0 access token management○ Retrieval○ Refresh○ Storage

Service-oriented approach

OAuth 2.0 Token Management Server

Example - OAuth 2.0 Key Cache

Google Inc. - All Rights Reserved

Using a Token Management Server

Client Application Token Mgmt Server1. I need the access token

2. Here you go!

Oops!

Expire

d, let

me f

etch

anoth

er on

e.

Google Inc. - All Rights Reserved

Refresh token and access token = Credentials

Store them securely!

Last Note - Security!

Google Inc. - All Rights Reserved

Resources

Download links

AdWords API OAuth 2.0 GuideOptimizing OAuth 2.0 Requests for AdWords APIGoogle OAuth 2.0 Documentation

Google Inc. - All Rights Reserved

Questions?

Google Inc. - All Rights Reserved