Google & Oauthlib - Scope has changed

Question

I am using OAuthlib for conducting OAuth flow of Google. It was working well for 4 to 5 months. Suddenly I started getting below error:

File "/home/whitesnow-2/Gaurav/Axonator/AxVirtualEnv/local/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/parameters.py", 
line 409, in validate_token_parameters raise w Warning: Scope has changed from 
"https://www.googleapis.com/auth/calendar 
https://www.googleapis.com/auth/docs 
https://www.googleapis.com/auth/spreadsheets 
https://www.googleapis.com/auth/drive.file
https://www.googleapis.com/auth/userinfo.email 
https://www.googleapis.com/auth/userinfo.profile" to 
"https://www.googleapis.com/auth/calendar 
https://www.googleapis.com/auth/docs 
https://www.googleapis.com/auth/spreadsheets 
https://www.googleapis.com/auth/drive.file 
https://www.googleapis.com/auth/userinfo.email 
https://www.googleapis.com/auth/userinfo.profile".

Below is the code for generating OAuth authorization URL:

flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file(
    settings.GOOGLE_OAUTH2_CLIENT_SECRETS_JSON,
    scopes=['https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/docs https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile'],
    redirect_uri=REDIRECT_URI
)
authorization_url, state = flow.authorization_url(
    access_type='offline',
    include_granted_scopes='true',
    prompt='consent'
)

Below is the code for Google OAuth callback:

auth_code = request.GET.get("code")
objectid = request.GET.get("state")
error = request.GET.get("error")
if error == "access_denied":
    return "Access Denied"
else:
    flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file(
        settings.GOOGLE_OAUTH2_CLIENT_SECRETS_JSON,
        scopes=['https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/docs https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile'],
        redirect_uri=REDIRECT_URI
    )
    flow.fetch_token(code=auth_code)

Answer 1

Even I also had the same issue. I have fixed this by removing include_granted_scopes='true', in the flow.authorization_url

Answer 2

I added the scope https://www.googleapis.com/auth/plus.me to where I create my Flow objects:

Flow.from_client_config(
    secrets_json_string,
    scopes=[
        (…),
        'https://www.googleapis.com/auth/plus.me',
    ],
    redirect_uri=redirect_url
)

Answer 3

You can disable this warning by setting the OAUTHLIB_RELAX_TOKEN_SCOPE environment variable; this should work for cases where you do not control the code that's calling the oauth library.

Here's where that's implemented in the oauthlib library.

Answer 4

I was able to bypass the problem by setting the scopes to None in the callback function.

flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file(
        settings.GOOGLE_OAUTH2_CLIENT_SECRETS_JSON,
        scopes=None,
        redirect_uri=REDIRECT_URI
    )
flow.fetch_token(code=auth_code)

Answer 5

I don't know it that's the error, but scopes should be maybe list scopes instead of one string - change this:

flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file(
            settings.GOOGLE_OAUTH2_CLIENT_SECRETS_JSON,
            scopes=['https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/docs https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile'],
            redirect_uri=REDIRECT_URI
        )

To this:

flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file(
            settings.GOOGLE_OAUTH2_CLIENT_SECRETS_JSON,
            scopes=[
                'https://www.googleapis.com/auth/calendar', 
                'https://www.googleapis.com/auth/docs', 
                'https://www.googleapis.com/auth/spreadsheets', 
                'https://www.googleapis.com/auth/drive.file', 
                'https://www.googleapis.com/auth/userinfo.email', 
                'https://www.googleapis.com/auth/userinfo.profile'],
            redirect_uri=REDIRECT_URI
        )

Answer 6

All the previous answers didn't worked for me. I solved it by adding this line :

os.environ['OAUTHLIB_RELAX_TOKEN_SCOPE'] = '1'

Answer 7

Because you set include_granted_scopes='true' so scopes will be append when you run again.

Let's set include_granted_scopes='false'