GAE+Picasa, trying to upgrade token

[Jaroslav Záruba]

Hello

I'm failing again and again trying to upgrade one-time token to session token for my app to access my Picasa album.

The docs days if the upgrade goes well response contains new token in the header. I get no such header but I don't have clue where I'm making the mistake, the service does not give any more hints. (I'm creating the token with session=1.)

I'm not sure how important this is but all the examples show tokens like "QA6G5....6G54AG", while my token looks like this "1/DWOMa6L2XzNNZkQ8ieM ... 9ErC48uTVUwPZ9AT2yA".

I assume my token is valid because when I pass it without leading "1/" I get 403 in response.

Is my understanding correct that I have to register my app only when I demand secure tokens? Or do I have to register also for these upgraded/session tokens?

BTW the docs suggests this URL for upgrading the token:

https://www.google.com/accounts/accounts/AuthSubSessionToken

That looks suspicious but there does not seem to be any difference in the response when I use:

https://www.google.com/accounts/AuthSubSessionToken

Any clues please? Like some common pitfalls...?

Regards

  J. Záruba 

- code -

URLFetchService urlFetchService = URLFetchServiceFactory.getURLFetchService();

HTTPRequest httpRequest = new HTTPRequest(new URL("https://www.google.com/accounts/AuthSubSessionToken"), HTTPMethod.GET);

httpRequest.setHeader(new HTTPHeader("Authorization", "AuthSub token=\"" + token +"\""));

HTTPResponse httpResponse = urlFetchService.fetch(httpRequest);

- /code -

[Jaroslav Záruba]

nevermind, fighting OAuth now :)

On Aug 14, 12:47 pm, Jaroslav Záruba <jaroslav.zar...@gmail.com>
wrote:

> Hello
>
> I'm failing again and again trying to upgrade one-time token to session
> token for my app to access my Picasa album.
>
> The docs days if the upgrade goes well response contains new token in the
> header. I get no such header but I don't have clue where I'm making the
> mistake, the service does not give any more hints. (I'm creating the token
> with session=1.)
>
> I'm not sure how important this is but all the examples show tokens like

> "QA6G5....6G54AG", while my token looks like this "*1/*DWOMa6L2XzNNZkQ8ieM

> ... 9ErC48uTVUwPZ9AT2yA".
> I assume my token is valid because when I pass it without leading "1/" I get
> 403 in response.
>
> Is my understanding correct that I have to register my app only when I

> demand *secure* tokens? Or do I have to register also for these