[null,null,["最后更新时间 (UTC)：2025-07-29。"],[[["\u003cp\u003eThis guide helps troubleshoot common errors during the Google OAuth authorization process for the Smart Device Management (SDM) API.\u003c/p\u003e\n"],["\u003cp\u003eRefresh tokens might expire after 7 days if the client ID is not approved for production.\u003c/p\u003e\n"],["\u003cp\u003e"Access denied" errors can occur when using external user types if the Google account isn't listed as a test user.\u003c/p\u003e\n"],["\u003cp\u003eAn "unverified app" screen might appear if using restricted scopes without OAuth API verification, but this can be bypassed for personal use.\u003c/p\u003e\n"],["\u003cp\u003eSeveral errors, such as "Invalid client," "Invalid request," and "Redirect uri mismatch," can arise from incorrect OAuth 2.0 Client ID or Secret values.\u003c/p\u003e\n"]]],["Google OAuth errors include: expiring refresh tokens (resolve by client ID approval), \"Access denied\" (add account to test users), \"Google hasn't verified this app\" (bypass via \"Advanced\"), \"Invalid client\" (verify Client Secret), \"Invalid request\" (check scope), and \"Redirect URI mismatch\" (ensure URI consistency). Authorization requires directing users to PCM, obtaining an authorization code, using the code to get access/refresh tokens, making an initial API call and using refresh tokens to acquire new access tokens.\n"],null,["# Authorization Errors\n\nDuring the authorization process, Google OAuth may return an error. Use this\nguide to troubleshoot the most common errors during this process.\n\nTroubleshooting\n---------------\n\nTo learn more about Google OAuth, see [Using OAuth 2.0 to Access Google\nAPIs](https://developers.google.com/identity/protocols/oauth2).\n\n### Refresh token keeps expiring\n\nRefresh tokens can stop working after 7 days if the client ID is not approved is\none possible cause. The 7-day token expiration is not related to Commercial\nor Sandbox approvals. A service or user account needs to get their OAuth\n2.0 client ID approved and put into production to get longer token lifespans.\nSee [Refresh token expiration](/identity/protocols/oauth2#expiration) for more\ninformation.\n\n### Access denied\n\nIf you've set up your [OAuth consent screen](https://console.developers.google.com/apis/credentials/consent/edit) in Google Cloud and\nthe **User type** is **External** , you will get an \"Access denied\" error if you\nattempt to account link with a Google account that is not listed as a test user\nfor your app. Make sure to add the Google account to the **Test users** section\nin your [OAuth consent screen](https://console.developers.google.com/apis/credentials/consent/edit).\n\n### Partner Connections Manager (PCM) error\n\nFor help with any errors encountered when accessing\nPCM, see\n[Partner Connections Manager (PCM)\nError Reference](/nest/device-access/reference/errors/pcm).\n\n### Google hasn't verified this app\n\nThe SDM API uses a restricted scope, which means that any\napps that use this scope during authorization will be \"unverified\" unless\n[OAuth API Verification](https://developers.googleblog.com/2019/09/get-smart-about-preparing-your-app-for-OAuth-verfication.html) is completed. **When using Device Access for\npersonal use, OAuth API Verification is not required.**\n\nYou may see a \"Google hasn't verified this app\" screen during the authorization\nprocess, which appears if the `sdm.service` scope is not configured on\nyour [OAuth consent screen](https://console.developers.google.com/apis/credentials/consent/edit) in Google Cloud. This screen can be\nbypassed by clicking the **Advanced** option and then clicking **Go to *Project\nName* (unsafe)**.\n\nSee [Unverified app\nscreen](https://support.google.com/cloud/answer/7454865#unverified-app-screen)\nfor more information.\n\n### Invalid client\n\nWhen attempting to get an access or refresh token, you will get an \"Invalid\nclient\" error if you provide an incorrect OAuth 2.0 Client Secret. Make sure the\n`client_secret` value you're using in access and refresh token calls is the one\nfor the OAuth 2.0 Client ID being used, as found in your\n[Google Cloud\nCredentials](https://console.developers.google.com/apis/credentials)\npage.\n\n### Invalid request, missing required scope\n\nAfter granting permissions in PCM, you might run into a\n\"Invalid request\" error of \"Missing required parameter: scope\". Make sure the\n`scope` value you're using in authorization calls is the same as the one you set for the OAuth 2.0 Client,\nas found in your [Google Cloud\nCredentials](https://console.developers.google.com/apis/credentials)\npage.\n\n### Redirect uri mismatch\n\nWhen going through authorization, you might run into a \"Redirect uri mismatch\"\nerror. Make sure the `redirect_uri` value you're using in authorization calls is\nthe same as the one you set for the OAuth 2.0 Client, as found in your\n[Google Cloud\nCredentials](https://console.developers.google.com/apis/credentials)\npage.\n\nQuick reference\n---------------\n\nUse this reference to quickly implement the steps to authorize a\nuser and link their Google account\n.\n\nTo use this quick reference, edit each placeholder variable in the code samples\nwith the values for your specific integration, and copy and paste as needed: \n\n### 1 PCM\n\nDirect the user to the PCM link in your\napp, replacing:\n\n1. \u003cvar translate=\"no\"\u003eproject-id\u003c/var\u003e with your Device Access Project ID\n2. \u003cvar translate=\"no\"\u003eoauth2-client-id\u003c/var\u003e with the OAuth2 Client ID from your [Google Cloud\n Credentials](https://console.developers.google.com/apis/credentials)\n3. \u003cvar translate=\"no\"\u003eredirect-uri\u003c/var\u003e with a Redirect URI specified for the OAuth2 Client ID you are using\n4. \u003cvar translate=\"no\"\u003escope\u003c/var\u003e with one of your [available\n scopes](#oauth_20_scopes)\n\n```\nhttps://nestservices.google.com/partnerconnections/project-id/auth?redirect_uri=redirect-uri&access_type=offline&prompt=consent&client_id=oauth2-client-id&response_type=code&scope=https://www.googleapis.com/auth/scope\n```\n\n### 2 Auth Code\n\nAfter granting permissions through PCM for\nyour selected scope, the user should be redirected to your specified Redirect\nURI. The Authorization Code is returned as the `code` parameter in the URL,\nwhich should be in this format:\n\n```\nredirect-uri?code=authorization-code&scope=https://www.googleapis.com/auth/scope\n```\n\n### 3 Access Token\n\nUse the authorization code to retrieve an access token, that\nyou can use to call the SDM API on\nbehalf of the user.\n\nMake a POST call to Google's OAuth\nendpoint, replacing:\n\n1. \u003cvar translate=\"no\"\u003eoauth2-client-id\u003c/var\u003e and \u003cvar translate=\"no\"\u003eoauth2-client-secret\u003c/var\u003e with the OAuth2 Client ID and Client Secret from your [Google Cloud\n Credentials](https://console.developers.google.com/apis/credentials)\n2. \u003cvar translate=\"no\"\u003eauthorization-code\u003c/var\u003e with the code you received in the previous step\n3. \u003cvar translate=\"no\"\u003eredirect-uri\u003c/var\u003e with a Redirect URI specified for the OAuth2 Client ID you are using\n\nGoogle OAuth returns two tokens, an access token and a\nrefresh token. \n\n### Request\n\n curl -L -X POST 'https://www.googleapis.com/oauth2/v4/token?client_id=\u003cvar translate=\"no\"\u003eoauth2-client-id\u003c/var\u003e&client_secret=\u003cvar translate=\"no\"\u003eoauth2-client-secret\u003c/var\u003e&code=\u003cvar translate=\"no\"\u003eauthorization-code\u003c/var\u003e&grant_type=authorization_code&redirect_uri=\u003cvar translate=\"no\"\u003eredirect-uri\u003c/var\u003e'\n\n### Response\n\n {\n \"access_token\": \"access-token\",\n \"expires_in\": 3599,\n \"refresh_token\": \"refresh-token\",\n \"scope\": \"https://www.googleapis.com/auth/scope\",\n \"token_type\": \"Bearer\"\n }\n\n### 4 API Call\n\nAuthorization is not complete until you make\nan API call with the user's access token. This\ninitial call finishes the authorization process and enables events.\n| **This call is required as part of authorization.** Until this call is made: \n|\n| - The authorized project will not appear on PCM.\n| - Events will not be published.\n\nYou **must** use one of the\nAPI calls listed for the specified scope to complete authorization.\n\n### sdm.service\n\n### devices\n\nSee the\n[`devices.list`](/nest/device-access/reference/rest/v1/enterprises.devices/list)\nAPI reference for more information. \n\n curl -X GET 'https://smartdevicemanagement.googleapis.com/v1/enterprises/\u003cvar translate=\"no\"\u003eproject-id\u003c/var\u003e/devices' \\\n -H 'Content-Type: application/json' \\\n -H 'Authorization: Bearer \u003cvar translate=\"no\"\u003eaccess-token\u003c/var\u003e'\n\n### 5 Refresh Token\n\nAccess tokens for the SDM API are only\nvalid for 1 hour, as noted in the `expires_in` parameter returned by Google OAuth. If\nyour access token expires, use the refresh token to get a new one.\n\nMake a POST call to Google's OAuth\nendpoint, replacing:\n\n1. \u003cvar translate=\"no\"\u003eoauth2-client-id\u003c/var\u003e and \u003cvar translate=\"no\"\u003eoauth2-client-secret\u003c/var\u003e with the OAuth2 Client ID and Client Secret from your [Google Cloud\n Credentials](https://console.developers.google.com/apis/credentials)\n2. \u003cvar translate=\"no\"\u003erefresh-token\u003c/var\u003e with the code you received when initially getting the access token.\n\nGoogle OAuth returns a new access token. \n\n### Request\n\n curl -L -X POST 'https://www.googleapis.com/oauth2/v4/token?client_id=\u003cvar translate=\"no\"\u003eoauth2-client-id\u003c/var\u003e&client_secret=\u003cvar translate=\"no\"\u003eoauth2-client-secret\u003c/var\u003e&refresh_token=\u003cvar translate=\"no\"\u003erefresh-token\u003c/var\u003e&grant_type=refresh_token'\n\n### Response\n\n {\n \"access_token\": \"new-access-token\",\n \"expires_in\": 3599,\n \"scope\": \"https://www.googleapis.com/auth/scope\",\n \"token_type\": \"Bearer\"\n }"]]
