I am trying to understand Google API for the calendar and I don't know that I understand things properly. What I want to do is use a web form to take user input and forward that onto a Google Calendar for events. This calendar belongs to the company and should not prompt the user for any authenticating because we are not using the user's calendar at all. From what I have seen in examples, it only shows how to interact with a user's calendar and not a internal calendar. What is the proper way to authenticate the webserver and Google Calendar API so that the webserver can access and modify a calendar owned by the company?
2 Answers
Even if it is a company calendar, someone or something needs to act on it to create events. The common way is to have a user create an event on it, therefore, an authenticated user is required. Nonetheless, you can still create events programmatically without having an authenticated user, but you need to have an authenticated subject called a "service account". All you need to know about this authentication flow is in google´s documentation which I strongly recommend you to read.
You need to understand that to write to a google calendar requires permisison of the owner of the calendar.
If this calendar is part of a workspace account then you could use something called service account. Your WorkSpace admin can grant the service account permission to a user who has access to the account though something called domain wide delegation. This way the service account acts like the user who has permission to access the account.
If this is not a workspace account then things get more complicated. You would need to use Oauth2 to authorize a user with offline access this will get you a refresh token. You can then use the refresh token to access the calendar when ever you need to.
The first issue you will have is that you will need to have the project in production and not testing as the refresh token will expire in seven days if its not in testing.
You may or may not have to verify the application. write access to google calendar is one of the restricted scopes as far as i remember.
Related