Logpresso Store

3-2. User Account OAuth

The app connects with a refresh token issued through OAuth consent by the dedicated integration account. A service account key and domain-wide delegation are not needed.

Item	Details
Alert Center	Not available. The Alert Center scope is blocked on the consent screen with `Error 400: invalid_scope`
When the token expires	Password change of the consenting account, revocation of app access in the Google Account, 6 months of inactivity, or 7 days when the user type is External and the publishing status is Testing
Consenting account	The dedicated integration account is recommended over a staff member's personal account (not affected by staff changes or departures)
Spreadsheets	Must be shared with the consenting account (view access for reading, edit access for writing). Sharing across domains may be restricted by the Drive external sharing policy
Google Cloud project	A dedicated project for this integration is recommended. The OAuth consent screen is shared by all clients in the project, so reusing a project used by other apps mixes the app name, user type, and publishing status. You can share the project created for the service account method
App version	1.9.2610.0 or later is recommended. Earlier versions can collect logs, but require dummy values for Customer ID and Delegated User and do not show permission error guidance

Step 1: OAuth Consent Screen

In the Google Cloud console, go to Google Auth Platform. The first time, Overview shows "Google Auth Platform not configured yet". Click Get started.
In App Information, enter an app name (e.g., Logpresso Sonar) and a user support email. The user support email is the contact shown on the consent screen and does not affect permissions.
In Audience, select Internal. For accounts outside your organization or personal accounts, select External, and then switch to production with Publish app so that the token does not expire after 7 days.
Enter Contact Information and click Create. With the Internal user type, you do not need to register scopes in Data Access.

Step 2: OAuth Client

In Google Auth Platform > Clients > Create client, enter the following and click Create.

Item Value

Application type Web application

Name A name to identify the client in the console

Authorized redirect URIs https://developers.google.com/oauthplayground
Copy the Client ID and Client secret from the dialog that appears and keep them. Once the dialog is closed, the client secret cannot be viewed again.

Item	Value
Application type	Web application
Name	A name to identify the client in the console
Authorized redirect URIs	`https://developers.google.com/oauthplayground`

Step 3: Issue a Refresh Token

Open OAuth 2.0 Playground in an incognito window, click the gear icon at the top right, and configure as follows.

Setting Value

OAuth flow Server-side

Access type Offline

Force prompt Consent Screen

Use your own OAuth credentials Checked

OAuth Client ID / secret The client ID and client secret created in Step 2

Setting	Value
OAuth flow	Server-side
Access type	Offline
Force prompt	Consent Screen
Use your own OAuth credentials	Checked
OAuth Client ID / secret	The client ID and client secret created in Step 2

In the Step 1 input box on the left (Input your own scopes), enter the scopes for the features you will use, separated by spaces, and click Authorize APIs. Check the scopes for each feature in the "OAuth scopes" column of 1. Required Permissions.

To use all features except Alert Center, paste the following string as-is.

https://www.googleapis.com/auth/admin.reports.audit.readonly https://www.googleapis.com/auth/admin.directory.domain.readonly https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/drive.apps.readonly https://www.googleapis.com/auth/spreadsheets.readonly https://www.googleapis.com/auth/spreadsheets

On the account selection screen, sign in with the dedicated integration account, review the requested permissions, and click Allow.

Click Exchange authorization code for tokens in Step 2 and check the response.

Response value	What to check
`refresh_token`	Starts with `1//`. Used in the connect profile
`scope`	Make sure all the scopes you entered are present. If any are missing, some were unchecked on the consent screen; issue the token again
`access_token`	Expires in 1 hour. Not used

Caution

Including the Alert Center scope (https://www.googleapis.com/auth/apps.alerts) is blocked on the consent screen. Remove it from the scopes and try again.