为什么我从App Engine获得的Google API调用的授权无效？

Question

我正在尝试从appengine访问Google预测API，并遵循这里的说明-- https://developers.google.com/appengine/articles/prediction_service_accounts

当部署在appengine上时，这非常有用。但是，相同的代码在本地devserver上失败，并出现以下错误。在

credentials = AppAssertionCredentials(
              scope='https://www.googleapis.com/auth/prediction')
http = credentials.authorize(httplib2.Http(memcache))
service = build("prediction", "v1.5", http=http, developerKey=api_key)

ERROR    2012-12-28 03:48:53,084 client.py:461] Failed to retrieve access token: {
  "error" : "invalid_grant"
}
ERROR    2012-12-28 03:48:53,115 cgi.py:121] Traceback (most recent call last):
  File "/Users/gkedia/git/thirdgaze/main.py", line 83, in <module>
    service = build('prediction', 'v1.5', http=http, developerKey=api_key)
  File "/Users/gkedia/git/thirdgaze/apiclient/discovery.py", line 175, in build
    resp, content = http.request(requested_url)
  File "/Users/gkedia/git/thirdgaze/oauth2client/client.py", line 503, in new_request
    self._refresh(request_orig)
  File "/Users/gkedia/git/thirdgaze/oauth2client/client.py", line 412, in _refresh
    self._do_refresh_request(http_request)
  File "/Users/gkedia/git/thirdgaze/oauth2client/client.py", line 472, in _do_refresh_request
    raise AccessTokenRefreshError(error_msg)
AccessTokenRefreshError: invalid_grant

我注意到的一点是，对于完全相同的参数，key_name, signature = app_identity.sign_blob(base_str)在生产和本地计算机上返回不同的签名。在

我的电脑时间同步正确，离线访问参数似乎还没有涉及。在

Answer 1

app_identity和更一般的服务帐户在dev_appserver上不起作用。为了在本地测试时获得与常规Google帐户相关联的访问令牌，您必须回退常规的oauth2 webserver flow。在

比如：

flow = OAuth2WebServerFlow(client_id='your_client_id',
                           client_secret='your_client_secret',
                           scope='https://www.googleapis.com/auth/prediction',
                           redirect_uri='http://localhost:8080/oauth2callback')
self.redirect(flow.step1_get_authorize_url())

然后在/oauth2callback处理程序中：

^{pr2}$

您可以很容易地检测到您是在dev_appserver上运行还是在生产中使用SERVER_SOFTWAREenvironment variable。在