I have a script which uploads/downloads from Google drive programmatically using a refresh token. For about 24 hours, that code appears to have stopped working, failing with an oauth error (details redacted):
go/bin/gdrive upload -p 1234abcd --refresh-token 1/XYZ123 foo.txt
Failed to get file: Get https://www.googleapis.com/drive/v3/files/12345678?alt=json&fields=appProperties: oauth2: cannot fetch token: 401 Unauthorized
Response: {
"error" : "unauthorized_client"
}
I generated a new refresh token just in case that was the issue, but that token did not work. However, when I used an access token generated from that refresh token with the --access-token option, that did work. So I presume something in the response from a request for an access token with a refresh token has changed on Google's end, and needs to be updated somewhere?
Turned out this was due to the ClientId and ClientSecret in handlers_drive.go not matching the client which owned the refresh token. They are hardcoded near the top of the file, and just swapping them for the correct values corresponding to the refresh token fixed the issue. This was being done on a machine which had manually installed gdrive from github; usually we do this via an automated build process that sets the correct ClientId and ClientSecret at build time. So, PEBKAC issue, basically.
It does lead to a small possible feature: since --refresh-token only works when the ClientId and ClientSecret match, make ClientId and ClientSecret command line options too so accounts other than the default can be used.
Most helpful comment
Turned out this was due to the ClientId and ClientSecret in handlers_drive.go not matching the client which owned the refresh token. They are hardcoded near the top of the file, and just swapping them for the correct values corresponding to the refresh token fixed the issue. This was being done on a machine which had manually installed gdrive from github; usually we do this via an automated build process that sets the correct ClientId and ClientSecret at build time. So, PEBKAC issue, basically.
It does lead to a small possible feature: since --refresh-token only works when the ClientId and ClientSecret match, make ClientId and ClientSecret command line options too so accounts other than the default can be used.