IMPORTANT: OAuth1 endpoint being turned down

[Josh Livni]

Hi all,

Last August we updated the Latitude API documentation to exclude all
references to OAuth v1.0 endpoints for the Latitude API, and suggested
developers migrate to OAuth 2.0.

On April 20, we intend to turn off access to the OAuth1 endpoint. For
those developers who are still using the deprecated OAuth1 endpoint,
please see the documentation for using the OAuth 2.0, which is
available at http://code.google.com/apis/latitude/v1/using_rest.html#auth

If you have any questions about updating your application, please let
us know.

Cheers,

-Josh

[Josh Livni]

[Alexis]

Hi Josh, 

Is there any mechanism to migrate Oauth1 access token as part of this? Or does this require end-user to re-authorize third party applications? 

Thanks

Alexis

[Davy]

There is no way to migrate Oauth1 access tokens to Oauth2.

Also take into account the following :

• You'll need to use the new Oauth2 enpoints in the re-authorize process.
  
• Keep in mind that Google accounts who are not opted into Latitude will not be able to "activate" it in the new OAuth2 flow (in the old Oauth1 based flow there was a custom checkbox specifically for opting into Latitude during the authorization flow.
  
• Oauth2 uses both access tokens and refresh tokens. Unless you specify the offline access parameter in your Oauth2 flow, you'll only receive an access token that is valid for 1 hour. You'll not get a refresh token to automatically refresh the access token when it expires (can be done by specifying offline access).
  

Regards,

Davy

[Jonathan Duane]

Guys,

I dont know whre to start. I was wondering is it essential to use Oauth2?

And I am looking at this

GET https://www.googleapis.com/latitude/v1/currentLocation?key=INSERT-YOUR-KEY&granularity=best

how do i find my key?

Then in my HTML which is

<!-- Google Public Location Badge -->
<iframe src="http://www.google.com/latitude/apps/badge/api?user=-116452991543013806&type=iframe&maptype=roadmap"
width="580" height="400" frameborder="0"></iframe>
<!-- To disable location sharing, you *must* visit
https://www.google.com/latitude/apps/badge and disable the Google
Public Location badge. Removing this code snippet is not enough! -->
<?xml version="1.0" encoding="UTF-8"?>

Where do i put the REST comand?

> --
> You received this message because you are subscribed to the Google Groups
> "Google Latitude API" group.
> To view this discussion on the web visit
> https://groups.google.com/d/msg/google-latitude-api/-/8TAQQcoV-zsJ.
>
> To post to this group, send email to google-la...@googlegroups.com.
> To unsubscribe from this group, send email to
> google-latitude...@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/google-latitude-api?hl=en.

[Alexis Arquilliere]

Thank you Davy. One more question: Will you progressively phase out Oauth1 by first not allowing new Oauth1 access tokens to be created, then later on turning off API access for Oauth1 tokens, or will the entire Oauth1 API stop functionning this month?

Thanks

--

[Kenneth Leftin]

Hi Jonathan,

You only need to worry about migrating to OAuth2 if you're using the latitude API. The public badge is not included as part of the API, it's a separate Latitude app, so you're fine.

> To post to this group, send email to google-latitude-api@googlegroups.com.

> To unsubscribe from this group, send email to

> google-latitude-api+unsub...@googlegroups.com.

[Kenneth Leftin]

HI Alexis,

Unfortunately, turning down OAuth1 will cause the whole API will stop functioning including granting access to new users and using old tokens to request data for users. If you want your app to keep working, you'll need to migrate to OAuth2 ASAP.

Kenny

To post to this group, send email to google-latitude-api@googlegroups.com.
To unsubscribe from this group, send email to google-latitude-api+unsub...@googlegroups.com.

[Josh Livni]

Hi all,

We kept the existing OAuth1 endpoint around a little longer than expected, and it will be turned down on July 19.  

If you are still using OAuth1 after the turndown, you will get an "Invalid Credentials" response, with the error message stating that "OAuth1 is no longer supported. You must authorize your request with OAuth 2.0."

Cheers,

  -Josh