Google Contacts API in Javascript and PHP

Question

I am making an ajax controlled website, in which I use the Javascript SDK for Google to authenticate my users, and gain access to their google contacts. What I intend to do, is the following:

1. Authenticate the user in the browser, withour redirecting and ask for access to their Contact list, and access to manage their Contacts.
2. Store the user id in my database if he/she granted me the access, together with a refresh token, which if I am not mistaking, I can only get via server side.
3. Sometime later, if the user wants to see their google contacts via my website, send an ajax request to my server, which ASKS for an access_token from the user, retrieves the data and shows it to the user, or stores it in my own database if the user asks to.

I've managed to complete the first step from these three, I can authenticate a user, and get access to a single access token which is valid for 3600 hours, but I can't figure out how to authenticate a user server side, without redirecting him anywhere. I tried using the Google PHP SDK too, but can't seem to figure out how to do this. I am certain that this is possible somehow, because it is stated in the Google PHP SDK guide:

If we have authenticated on an Android or Javascript web client, we may have aquired a code via a different means. In this case, we just need to exchange it. If it was retrieved via the gapi Javascript client, we need to set the redirect URI postmessage.

  $client->setRedirectUri($redirect_uri);

The only problem is I don't understand how to do this. What is $redirect_uri? I don't have a redirect url, becase when I implemented the Javascript SDK, there it said, that I don't have to use a redirect uri, because Javascript authentification is done in the same window, without redirects(just as I want it).

How could I proceed to solve the second and the third step mentioned above? Where could I find a non-hacky or not-very-much-hacky tutorial, to achieve my desired result?

EDIT:

What I basically want to achieve is the following things:

• ask for permission to access Google Contacts from the user, WITHOUT redirecting him from my site(via a popup window)

Achieved this with the Javascript SDK

• get an access token for this permission, and a refresh token, and STORE these in a database

Javascript SDK only grants an access token, and I don't want to pass this via an ajax call, because I feel this is unsecure

• with the refresh token, generate access tokens server side for the user, and process data, and send the data back.

Here is how my PHP file looks at the moment:

$client = new Google_Client();
$client->setClientId($client_id);
$client->setClientSecret($client_secret);
$client->setScopes('https://www.googleapis.com/auth/plus.me');
$client->setRedirectUri($PHP_SELF);
$client->setState('offline');

$authUrl = $client->createAuthUrl();

if (isset($_GET['code'])) {
    $client->authenticate($_GET['code']);
    $_SESSION['access_token'] = $client->getAccessToken();
    $result=$client->getAccessToken();
} else {
    header("Location: ".$authUrl);
    exit;
}

To achieve what I want, I should get the $_GET['code'] parameter somehow through the Javascript SDK, but I don't know how:|

Answer 1

After a few days of headache I figured this one out too... thanks Google for nothing, your documentation SUCKS.

 $client->setRedirectUri($redirect_uri);

The $redirect_uri parameter should be a string: "postmessage", and when authenticating via javascript, you should ask for a CODE instead of a TOKEN, which you then send to your server side script, to authenticate and exchange for a token.

  gapi.auth.authorize({client_id: googleApi.clientId, scope: googleApi.scopes, response_type: 'code', immediate: true}, g_handleAuthResult);