com.google.api.client.auth.oauth2.Credential

[FW API]

Hello,

we have received mail that we use a deprecated  OAuth out-of-band (OOB) flow for oauth. We have migrated to the new google ads api for all calls, but still rely on old code for create a Credential object for use with getting access tokens to use in LOCATION feeds in google ads.

Namely:

    com.google.api.client.auth.oauth2.Credential credential = 

        new com.google.api.ads.common.lib.auth.OfflineCredentials.Builder()

          .forApi(OfflineCredentials.Api.ADWORDS)
          .withRefreshToken(adwordsRefreshToken)
          .withClientSecrets(adwordsClientId,adwordsClientSecret)
          .build()
          .generateCredential()

I suppose that code led to the mail. 

Is there a drop in replacement?

[Google Ads API Forum Advisor]

Hi there,

Thanks for reaching out to the Google Ads API Forum.

It appears that the received email is related to this guide. Note that OAuth out-of-band (OOB) is a legacy flow developed to support native clients which do not have a redirect URI like web apps to accept the credentials after a user approves an OAuth consent request. The OOB flow poses a remote phishing risk and clients must migrate to an alternative method to protect against this vulnerability. New clients will be unable to use this flow starting on Feb 28, 2022.

That being said, if your app is using the OOB flow, then you can migrate to an alternative flow such as Desktop clients: OAuth 2.0 for Desktop apps. You may refer more on OAuth2 desktop app or web app using Google Ads API.

Let us know if you have any further questions.

Regards,

Yasar Google Ads API Team

ref:_00D1U1174p._5004Q2aR4kS:ref

[FW API]

Hi Yasar,

1. Can you point out at what point this old flow might be used: create a refresh token, create an authentication token?

2. Is it the old java google ad words client library having that problem?

3. Does the new java google ads library has that one fixed already?

Thanks for your help, regards,

Martin

[Google Ads API Forum Advisor]

Hi Martin,

Thanks for getting back to us. You may see below responses to your queries:

1. Can you point out at what point this old flow might be used: create a refresh token, create an authentication token?

>> While creating a refresh token OOB had an issue.

2. Is it the old java google ad words client library having that problem?

>> Our docs have been updated with this guide in our documentation. 

3. Does the new java google ads library has that one fixed already?

>> Yes, you may check this guide for the Java client library to set up OAuth2 for API access using your own credentials and either the desktop flow or the web flow. 

Regards,