Search code examples
google-app-engineoauthgoogle-cloud-storagegoogle-api-python-client

Can a GAE app access Cloud Storage RESTful API without the OAuth dance?


We are using the GAE Cloud Storage API to create and access files. We used gsutil to add our gae app service account to the default ACL for the bucket.

The next step is to do things like listing bucket contents. For this the RESTful API with OAuth access seems like a viable option. However, to access Cloud Storage from the taskqueue, we want to avoid the 'user consent' step in the OAuth dance. The API Console allows adding a client id for a service account for this purpose but we cant find any documentation or samples of using a service account to access the API.

So far we have looked at the Au-to-do app (requires OAuth dance) and the google-api-python-client samples. Neither of those shows access with the default service account.

Are there any examples of using an app engine service account to authorize requests to cloud storage RESTful API?


Solution

  • You can access Google Cloud Storage using interoperable access, with interoperable access you use the access key and a secret key to access your buckets.
    The process is described in great details, and you can see sample code that implements the process in the boto package (look for HmacAuthV1Handler in auth.py)