Getting your own Google API credentials for R

API keys

This is the easiest way to get your own quota for a project that requires accessing a publicly available resource through R. To create an API key for your Google Cloud Project, go to “APIs & Services” > “Credentials” > “+ CREATE CREDENTIALS” > “API key”. You can copy the key when you create it, but you’ll always be able to go back to your Credentials page and re-copy the key later. I suggest storing the key in a password manager and/or your .Rprofile so it is easy to find later.

Once you have your key, you can use googlesheets4 in the following way:

google_cloud_api_key <- "YOUR API KEY"
gs4_auth_configure(api_key = google_cloud_api_key)

gs4_example("gapminder") %>% 
    read_sheet()

You may need to run the first two lines in your console (i.e. in an interactive setting) first to grant permissions, but then your document should be set either for knitting or for deploying.

OAuth 2.0 client IDs

These types of tokens allow you to make requests on behalf of yourself, the user. To create an OAuth 2.0 client ID, go to “APIs & Services” > “Credentials” > “+ CREATE CREDENTIALS” > “OAuth client ID”. Select “Desktop client”. As with the API key, you can copy the client ID and secret now, or find them later in the “Credentials” page.

There are two options for accessing the ID you create: (1) via the client ID and secret, and (2) via downloading a JSON file. In either case, you’ll want to protect this information, either by storing the ID and secret in a password manager or saving the JSON file in a protected folder, like .secrets.

If you use the ID and secret, your code will look something like this:

# Create an OAuth app with httr
google_app <- httr::oauth_app("google-api",
                              key = "YOUR GOOGLE CLOUD OAUTH KEY",
                              secret = "YOUR GOOGLE CLOUD SECRET")

gs4_auth_configure(app = google_app)

If you download the JSON instead, your code will look like this:

gs4_auth_configure(path = "/PATH/TO/THE/DOWNLOADED/OAUTH/JSON.json")

This is the solution that ended up working for my purposes for 2 reasons. First, it allowed me to access private resources on Google Drive (unlike an API key), and second, it allowed me to access those resources via my own Google account (unlike a service account).

Service account tokens

This is the final way to get credentials. I initially tried this method, since the gargle tutorial says that is “the most proper way to make authorized requests to an API in a non-interactive context.” For this to work, however, I would have then needed the ability to make my service account a member of my team’s Google Drive. Because of security, this wasn’t a possibility for me, but if that is something you can do, option #3 is the way to go! You would just need to give your service account (which will have a name something like my-service-account-name@my-google-project-name.iam.gserviceaccount.com) access to whatever Drive files or services you’d like to access.

To generate a service account token, go to “APIs & Services” > “Credentials” > “+ CREATE CREDENTIALS” > “Service account”. Give your new account a good name and description, provide account permissions if necessary, and potentially grant users access. After you click “Create key”, you’ll have the opportunity to download a JSON. Save this in a secure location, like your .secrets folder, for example. To use it in your document, add the following:

gs4_auth_configure(path = "/PATH/TO/THE/DOWNLOADED/SERVICE/ACCOUNT/JSON.json")

Note, there is a way to make your new service account token function as your account, although I have not tried this. If you want to carry out processes on behalf of yourself or some specific user, instead of as my-service-account-name@my-google-project-name.iam.gserviceaccount.com, there is a process known as “impersonation” that is discussed more here. If you don’t have the access level to do this (which was my situation), than an OAuth user token is the way to go.