애플리케이션에 인증된 사용자의 이메일 주소가 필요하며 이전에 이 목적으로 profile.emails.read를 사용한 경우 email을 대신 사용하세요.
승인된 인증 요청을 통해 profile.emails.read의 승인을 받습니다. 확인을 위해 어떻게 제출하나요?를 참고하세요.
삭제할 범위로 이전 사용자 토큰을 취소하거나 애플리케이션에 대한 액세스 권한을 완전히 삭제합니다. 예를 들어 profile.emails.read 액세스 권한이 있는 토큰은 취소해야 합니다. 사용자가 즉시 사용자 동의를 받을 수 있도록 사용자가 애플리케이션에 있는 동안 취소를 적용하는 것이 좋습니다.
사용자에게 profile.emails.read 없이 새 범위(예: email)에 다시 동의하라는 메시지를 표시합니다.
Google API OAuth 동의 화면 구성에서 지원 중단할 범위를 삭제합니다.
앱을 Google+ 로그인에서 Google 로그인으로 이전하려면 로그인 버튼, 요청된 범위, Google에서 프로필 정보를 가져오는 방법에 관한 안내를 업데이트해야 합니다. 자세한 안내는 Android용 Google 로그인 문서를 참고하세요.
로그인 버튼을 업데이트할 때는 G+를 언급하거나 빨간색을 사용하지 마세요.
업데이트된 브랜딩 가이드라인을 준수합니다.
대부분의 Google+ 로그인 애플리케이션에서 plus.login, plus.me, plus.profile.emails.read과 같은 범위 조합을 요청했습니다. GoogleSignInOptions.Builder를 DEFAULT_SIGN_IN 옵션과 함께 사용하면 사용자 이름과 프로필 사진을 제공하는 profile 범위를 자동으로 요청하게 됩니다. 사용자의 이메일 주소도 필요한 경우 Google 로그인 옵션을 구성할 때 .requestEmail()를 호출해야 합니다.
Google+ 로그인을 구현하는 많은 개발자가 코드 흐름을 사용했습니다. 즉, Android, iOS 또는 JavaScript 앱은 Google에서 OAuth 승인 코드를 가져오고 클라이언트는 교차 사이트 요청 위조 방지와 함께 해당 코드를 서버로 다시 전송합니다. 그런 다음 서버는 코드를 확인하고 새로고침 및 액세스 토큰을 가져와 people.get API에서 사용자 프로필 정보를 가져옵니다.
이제 ID 토큰을 요청하고 클라이언트에서 서버로 ID 토큰을 전송하는 것이 좋습니다. ID 토큰에는 교차 사이트 위조 방지 기능이 내장되어 있으며 서버에서 정적으로 확인할 수도 있으므로 Google 서버에서 사용자 프로필 정보를 가져오기 위한 추가 API 호출이 필요하지 않습니다. 안내에 따라 서버에서 ID 토큰의 유효성을 검사합니다.
그래도 코드 흐름을 사용하여 프로필 정보를 가져오려면 그렇게 할 수 있습니다. 서버에 액세스 토큰이 있으면 로그인 탐색 문서에 지정된 userinfo 엔드포인트에서 사용자 프로필 정보를 가져와야 합니다. API 응답의 형식은 Google+ 프로필 응답과 다르므로 파싱을 새 형식으로 업데이트해야 합니다.
GoogleAuthUtil.getToken 또는 Plus.API를 사용하는 경우 보안을 강화하고 사용자 환경을 개선하려면 최신 Sign-In API로 이전해야 합니다.
[null,null,["최종 업데이트: 2024-11-09(UTC)"],[[["\u003cp\u003eGoogle Sign-In for Android is outdated; migrate to Credential Manager for enhanced security and user experience, except for Wear OS 3, 4, and 5.0, which should continue using Google Sign-In for Android until Credential Manager support is available.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eprofile.emails.read\u003c/code\u003e scope is now sensitive; replace it with the \u003ccode\u003eemail\u003c/code\u003e scope and follow provided steps to avoid user disruption and security warnings.\u003c/p\u003e\n"],["\u003cp\u003eGoogle+ Sign-In is fully deprecated; migrate to Google Sign-In and update sign-in elements according to the new branding guidelines.\u003c/p\u003e\n"],["\u003cp\u003eFor server-side authentication, Google recommends using ID tokens instead of the code flow for better security and efficiency.\u003c/p\u003e\n"]]],[],null,["# Migrate from Google+ sign-in\n\n| **Warning:** Google Sign-In for Android is outdated and no longer supported. To ensure the continued security and usability of your app, [migrate\n| to Credential Manager](https://developer.android.com/training/sign-in/credential-manager/) today. Credential Manager supports passkey, password, and federated identity authentication (such as Sign-in with Google), stronger security, and a more consistent user experience. For Wear developers: Credential Manager will be supported in Wear OS 5.1 and later on selected watches. Developers actively supporting Wear OS 3, 4 and 5.0 devices with Sign in with Google should continue using Google Sign-in for Android for your Wear applications. Sign in with Google support will be available on Credential Manager APIs for these versions of WearOS at a later date.\n| **Important:** The scope\n| `profile.emails.read` is now classified as a\n| [sensitive scope](https://support.google.com/cloud/answer/9110914#sensitive-scope-verification).\n| You can achieve the same functionality with the OpenID Connect (OIDC) scope\n| of `email`. To minimize impact on your users, complete the\n| [steps](#steps) in this guide.\n|\n| If you don't complete these steps, any user with an active token that still\n| has access to the scope that we have phased out might be shown an\n| [unverified app screen or \"Sign-in disabled\" message](https://support.google.com/cloud/answer/9110914#verified-but-app-disabled)\n| and receive a Security Center warning to\n| [remove risky access](https://support.google.com/accounts/answer/3466521)\n| to their data. This occurs because the user has an active token where the\n| API scope is no longer verified. If your application doesn't revoke the\n| token as described in the prescribed [steps](#steps), the user\n| might continue to receive a warning.\n\nSteps to minimize the impact of scope changes on users\n------------------------------------------------------\n\n1. If your application requires the email address of an authenticated user, and you've previously used `profile.emails.read` for that purpose, use `email` instead.\n2. Obtain approval for `profile.emails.read` with an approved verification request. Refer to [How do I submit for verification?](https://support.google.com/cloud/answer/9110914#submit-howto)\n3. [Revoke](/identity/protocols/oauth2/native-app#tokenrevoke) the prior user token to the scope that's to be removed or remove access to the application entirely. For example, a token with `profile.emails.read` access should be revoked. We recommend you apply the revocation while your users are in your application so that you can get user consent immediately.\n4. Prompt your users to re-consent with the new scope, such as `email`, without `profile.emails.read`.\n5. Remove the scope that's to be phased out of your Google APIs OAuth consent screen configuration.\n\n| The Google+ Sign-in feature has been fully deprecated as of March 7, 2019.\n|\n| Developers should migrate to the more comprehensive\n| [Google Sign-in](/identity/sign-in/android) authentication system.\n|\n| Migration tips are also available for\n| [Web](/identity/sign-in/web/quick-migration-guide).\n\nTo migrate your app from Google+ Sign-In to Google Sign-In, you need to\nupdate your sign-in button, requested scopes, and instructions on how to\nretrieve profile information from Google. Follow our\n[Google Sign In for Android documentation](/identity/sign-in/android/legacy-sign-in)\nfor full instructions.\n\nWhen you update your sign-in button, do not refer to G+ or use the color red.\nConform to our updated [branding guidelines](/identity/branding-guidelines).\n\nMost Google+ Sign-In applications requested some combination of the scopes:\n`plus.login`, `plus.me` and `plus.profile.emails.read`. By using\n`GoogleSignInOptions.Builder` with the `DEFAULT_SIGN_IN` option, you will\nautomatically request the `profile` scope which provides the user's name and\nprofile picture. If you also want the user's email address, you should call\n`.requestEmail()` when constructing Google sign-in options.\n\nMany implementers of Google+ Sign-In used the\n[code flow](/identity/protocols/oauth2/native-app#handlingresponse). This means\nthat the Android, iOS or JavaScript apps obtain an OAuth authorization code from\nGoogle, and the client sends that code back to the server, along with cross-site\nrequest forgery protection. The server then validates the code and obtains\nrefresh and access tokens to pull user profile information from the `people.get`\nAPI.\n\nGoogle now recommends that you request an ID token and send the ID token from\nyour client to your server. ID tokens have cross-site forgery protections\nbuilt-in and also can be statically verified on your server, which avoids an\nextra API call to get user profile information from Google's servers. Follow the\ninstructions to\n[validate ID tokens on your server](/identity/sign-in/android/backend-auth#verify-the-integrity-of-the-id-token).\n\nIf you still prefer to use the code flow to obtain profile information,\nyou may do so. Once your server has an access token, you need to\n[obtain user profile information](/identity/protocols/oauth2/openid-connect#obtaininguserprofileinformation)\nfrom the `userinfo` endpoints specified in our Sign-In\n[Discovery document](/identity/protocols/oauth2/openid-connect#discovery). The\nAPI response is formatted differently than the Google+ profile response, so you\nneed to update your parsing to the new format.\n\nIf you are using `GoogleAuthUtil.getToken` or `Plus.API`, you should\n[migrate](/identity/sign-in/android/migration-guide)\nto the newest Sign-In API for greater security and a better user experience."]]
