Search code examples
google-oauthactions-on-google

Difference between `GoogleUser.getId()` (oauth) vs `app.getUser().userId` (actions-on-google)

The id I get from app.getUser() from the actions-on-google-nodejs app looks entirely different from the id I get from Oauth.

app.getUser() in Google Assistant

{ userId: 'KMdEs***szG-ZRQl***cU',
  user_id: 'KMdEs***szG-ZRQl***cU',
  userName:
    {
[...]

The same id is returned with and without the app.SupportedPermissions.NAME permission.

googleUser.getBasicProfile().getId() in Google OAuth

11348***63489

Is there any way to match these users up? It's the same Google Project in the developer console, so I assume that even if Google would generate unique ID's per project it should be the same, however in this case it looks like I am getting entirely different types of id's.

Solution

  • They are different types of IDs.

    The ID returned from app.getUser() is meant as an anonymous project-unique identifier that can be used in some of the same ways a web cookie is used. It can not be identified against a specific account - but it will be consistent across all sessions (unless reset by the user). The profile information you can get with it (their name) is also considered non-identifying. Both are intended to be used to make a more friendly interface, rather than as a firm identifier. Users are able to reset their Google Home devices, for example, and this may reset this to a different ID.

    The ID returned through OAuth, however, is meant to link them to a Google Account, with all the implications that brings, including associating them with a specific identity. This Account Linking is done separately, and does not directly give you the ID - instead it gives you an OAuth Access Token (which you can get through app.getUser().accessToken) which you can use to get their Google ID and other information that you may be scoped to get.

    In theory, if you have Account Linking enabled, you could match the two up. In practicality, if you have Account Linking enabled, you wouldn't care about app.getUser().userId since you have the Access Token which will get you their Google ID. If you do not have Account Linking enabled - there is no way to match up the two and you should treat the userId as an anonymous (but consistent) user.