Why do good tokens go bad?
Sometimes it feels like auth was working and then suddenly it stops working. If you’ve cached a token and used it successfully, why would it stop working?
Too many tokens
An existing token can go bad if you’ve created too many Google tokens, causing your oldest tokens to “fall off the edge”.
A specific Google user (email) can only have a certain number of OAuth tokens at a time (something like 50 per OAuth client). So, whenever you get a new token (as opposed to refreshing an existing token), there is the potential for it to invalidate an older token. This is unlikely to be an issue for a casual user, but it can absolutely become noticeable for someone who is developing against a Google API or someone working from many different machines / caches.
Another reason that an existing token stops working is if it was obtained with an OAuth client that is in “testing” mode. Refresh tokens obtained that way only last for one week, whereas it’s more typical for refresh tokens to last almost indefinitely (or, at least, for several months).
Credential rolling
Many users of packages like googlesheets4 or googledrive tacitly rely on the default OAuth client used by those packages. Periodically the maintainer of such a package will need to roll the client, i.e. create a new OAuth client and disable the old one. This will make it impossible to refresh existing tokens, made with the old, disabled client Those tokens will stop working.
In gargle v1.0.0, in March 2021, we rolled the client used in googlesheets4, googledrive, and bigrquery. We reserve the right to disable the old client at any time. Anyone relying on the default client will have to upgrade.
The solution is to update the package in question, e.g. googlesheets4:
Restart R! Resume your work. Chances are you’ll be prompted to re-auth with the new client and you’ll be back in business.
What does this problem look like in the wild?
With gargle versions up to v1.0.0, you will probably see this:
Auto-refreshing stale OAuth token.
Error in get("refresh_oauth2.0", asNamespace("httr"))(self$endpoint, self$app, :
Unauthorized (HTTP 401).If you’re trying to create a token, instead of refreshing one, you might see this in the browser, while R is waiting to receive input:
Google Authorization Error
Error 401: deleted_client
The OAuth client was deleted.It might look something like this:
As of gargle version v1.1.0, we’re trying harder to recognize this specific problem and to provide a more detailed and actionable error message:
Auto-refreshing stale OAuth token.
Error: Client error: (401) UNAUTHENTICATED
* Request not authenticated due to missing, invalid, or expired OAuth token.
* Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
Run `rlang::last_error()` to see where the error occurred.
In addition: Warning message:
Unable to refresh token, because the associated OAuth app has been deleted
* You appear to be relying on the default app used by the googlesheets4 package
* Consider re-installing googlesheets4 and gargle, in case the default app has been updated