appfactory/analytics
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

token variant

Browse Source
This commit is contained in:
JiriUhlir
2026-06-22 05:26:20 +02:00
parent 125b112967
commit 28b29b8331
5 changed files with 77 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/google-ads.md
+1
View File
@@ -15,6 +15,7 @@ Google Ads needs more than a Bearer token:
| --- | --- | --- |
| `X-GAds-Developer-Token` | **yes** | Developer token from a Google Ads manager account → `developer-token`. |
| `X-GAds-Access-Token` | one of these | Ready OAuth2 access token (Bearer). |
| `Authorization` | one of these | Standard `Authorization: Bearer <token>` header — equivalent alternative to `X-GAds-Access-Token` (the X- header wins if both are sent). The developer token is still required separately. |
| `X-GAds-Credentials` | one of these | Base64 service-account JSON (scope `adwords`); needs domain-wide delegation. |
| `X-GAds-Login-Customer-Id` | no | Manager (MCC) id → `login-customer-id`. Digits only. |
| `X-GAds-Quota-Project` | no | GCP project id → `x-goog-user-project`. |
documentation/google-analytics.md
+6 -2
View File
@@ -10,11 +10,15 @@ Token has precedence over the service account:
| Header | Meaning |
| --- | --- |
| `X-GA-Access-Token` | Ready OAuth2 access token, used directly as `Authorization: Bearer`. |
| `Authorization` | Standard `Authorization: Bearer <token>` header — equivalent alternative to `X-GA-Access-Token`. |
| `X-GA-Credentials` | **Base64** of a Google service-account JSON key. The proxy mints a short-lived token (scope `https://www.googleapis.com/auth/analytics.readonly`) via `google-auth` and caches it in memory until ~60 s before expiry. |
| `X-GA-Quota-Project` | Optional GCP project id → upstream `x-goog-user-project`. |
At least one of `X-GA-Access-Token` / `X-GA-Credentials` is required (otherwise
`401 missing_credentials`).
A ready access token can be supplied either in `X-GA-Access-Token` or in the
standard `Authorization: Bearer <token>` header. At least one credential source
(token header, `Authorization: Bearer`, or `X-GA-Credentials`) is required,
otherwise `401 missing_credentials`. Priority when several are present:
`X-GA-Access-Token` → `Authorization: Bearer` → `X-GA-Credentials`.
The service account (or token) must have access to the GA4 property — add its
`client_email` as a viewer in GA Admin → Property Access Management.
documentation/google-search-console.md
+1
View File
@@ -11,6 +11,7 @@ Same Google OAuth model as Analytics, token wins over service account:
| Header | Meaning |
| --- | --- |
| `X-GSC-Access-Token` | Ready OAuth2 access token (Bearer). |
| `Authorization` | Standard `Authorization: Bearer <token>` header — equivalent alternative to `X-GSC-Access-Token` (the X- header wins if both are sent). |
| `X-GSC-Credentials` | Base64 service-account JSON; token minted with scope `https://www.googleapis.com/auth/webmasters.readonly`. |
| `X-GSC-Quota-Project` | Optional GCP project id → `x-goog-user-project`. |