AdWords API & OAuth 2.0, Advanced

AdWords API - Using OAuth 2.0
Advanced usage
Ray Tsang, Google, Inc.
Danial Klimkin, Google, Inc.

Agenda
● Hopefully you are already using OAuth 2.0!
● Issue with unoptimized OAuth 2.0 requests
● Solutions
● Resources

Google Inc. - All Rights Reserved
Refresher
OAuth 2.0????

ClientLogin is going away
You must migrate to OAuth 2.0
ASAP
ClientLogin is Going Away!

Secure
○ Users enter their username/password in secure Google login page
○ Third-party application won’t receive nor store the password
○ Reduced impact if OAuth 2.0 access is compromised
More Control
○ Restrict access via “scopes”
○ User can revoke access at will
Standards driven
○ RFC 6749
○ Used by many large service providers, including Google
Why OAuth 2.0?

Already using OAuth 2.0?
Great to hear! Watch out for some common issues

Access Token Expiration
Anticipate the possibility that a granted token might no
longer work
○ The access token has expired (expires_in value)
○ The user has revoked access
○ The account has exceeded a certain number of active token
for the same application

The refresh token expired if unused for six months.
25 refresh token limit per user per application
○ When exceeded, oldest refresh token is quietly invalidated
○ no user-visible warning - your application need to handle this
You should only need one refresh token per user
Refresh Token Expiration

When an access token has expired or revoked:
AuthenticationError.OAUTH_TOKEN_INVALID
Cause: access token expired
Resolution: get a new access token with the refresh token
AuthenticationError.INVALID_GRANT_ERROR
Cause: access revoked
Resolution: re-authorize via the authorization URL (the consent screen)
Common Errors

Revoking Access

Rate Limits
There is a rate limit for obtaining the access token
QPS may change over time based on different conditions
Beware in multi-threaded and/or multi-server environment
Be ready for it in Production!

Multithreaded Environment
Client Application
Thread 1
Thread 2
Thread N
.
.
.
I have a refresh token, I
need an access token!

Multi-Server / Multi-Process Environment
Client Application
.
.
.
Client Application
Client Application

Client ApplicationClient Application
Put Them Together
Client Application
Thread 1
Thread 2
Thread N
.
.
.

What’s Your Platform Like?
.Net

Sharing the access token
Sharing is caring

Share the token and the expiration time
Access token
Calculated expiration time
12
6
39
T1
expires_in
Te

Multithreaded platforms can share data among threads
Must be thread-safe
Use the singleton pattern
Use a Singleton
Credential object in Java can be shared

Minimize Access Token Requests
Client Application
Thread 1
Thread 2
Thread N
.
.
.
I’ll re-use the Credential
I’ll re-use the Credential

Minimize the number of initial access token requests is half
the problem
When access token expires - minimize refresh requests!
Handling Expiration
Credential object in Java handles expiration

Use a shared storage
○ In-memory: Memcached, Infinispan, Ehcache, ...
○ Persistent: RDBMS, MongoDB, …
Store securely!
Don’t forget to check for expirations
Use Shared storage

Using a Shared Storage
Client Application
.
.
.
Client Application
Shared
Storage
1. Check if unexpired access token
is already in the shared storage
Client Application 2. If expired, use the refresh token
to get an access token
3. Write the credential back
to the shared storage
4. Check if unexpired access token
is already in the shared storage

Worst case scenario: All processes simultaneously read
expired access token from the shared storage
● Avoid race conditions
● Eagerly refresh stored credentials before it expires
○ e.g., If access token expires in 1 hr, refresh in 45 minutes
Proactive Refresh
Make sure server clocks are in sync (use NTP)

Proactive Refresh
Client Application
Shared
Storage
Check if unexpired access token is
already in the shared storage
Periodic Refresher
1. Use the refresh token to get a
new access token
2. Write the credential back to
the shared storage

Centralize OAuth 2.0 access token management
○ Retrieval
○ Refresh
○ Storage
Service-oriented approach
OAuth 2.0 Token Management Server
Example - OAuth 2.0 Key Cache

Using a Token Management Server
Client Application Token Mgmt Server
1. I need the access token
2. Here you go!
O
ops!
Expired, let m
e
fetch
another one.

Refresh token and access token = Credentials
Store them securely!
Last Note - Security!

Resources
Download links
AdWords API OAuth 2.0 Guide
Optimizing OAuth 2.0 Requests for AdWords API
Google OAuth 2.0 Documentation

Questions?

AdWords API & OAuth 2.0, Advanced

More Related Content

Similar to AdWords API & OAuth 2.0, Advanced

More from marcwan

Recently uploaded

AdWords API & OAuth 2.0, Advanced