title: Google API Authorization Using Scribe OAuth Java Library
body: <p>I am trying to make a Java class which would call upon Google's API to recreate an access token to a user's account with new permissions/larger scope. This class is to be instantiated by a Java servlet I had created. I want a function within that class to return a new access token. For this class to do that, I am using the <a href="https://github.com/fernandezpablo85/scribe-java" rel="nofollow">Scribe</a> library.</p>
  
  <p>In Scribe's <a href="https://github.com/fernandezpablo85/scribe-java/wiki/getting-started" rel="nofollow">quick guide</a>, there are two steps which concern me and have me stumped:</p>
  
  <blockquote>
    <p><strong>Step Three: Making the user validate your request token</strong></p>
    
    <p>Let’s help your users authorize your app to do the OAuth calls. For
    this you need to redirect them to the following URL:</p>
  </blockquote>
  
  <pre><code>String authUrl = service.getAuthorizationUrl(requestToken);
  </code></pre>
  
  <blockquote>
    <p>After this either the user will get a verifier code (if this is an OOB
    request) or you’ll receive a redirect from Twitter with the verifier
    and the requestToken on it (if you provided a callbackUrl)</p>
    
    <p><strong>Step Four: Get the access Token</strong></p>
    
    <p>Now that you have (somehow) the verifier, you need to exchange your
    requestToken and verifier for an accessToken which is the one used to
    sign requests.</p>
  </blockquote>
  
  <pre><code>Verifier v = new Verifier("verifier you got from the user");
  Token accessToken = service.getAccessToken(requestToken, v); // the requestToken you had from step 2
  </code></pre>
  
  <p>It does not seem to specify how to get that <code>verifier</code> from the user. How am I supposed to do that? How do I redirect my user to the <code>authURL</code>, and how do I get it to send its <code>verifier</code> back to this class of mine, which initiated the request to begin with?</p>
  
  <p>If this is unclear, let me structure the question differently, taking Scribe out of the equation: To get an authorization code from Google (which would be used to then get a refresh token and access token), I would execute the following URL connection from within the servlet (yes, I've tried to answer this problem without the Scribe library, and still can't figure it out):</p>
  
  <pre><code>URL authURL = new URL("https://accounts.google.com/o/oauth2/auth");
  HttpsURLConnection authCon = (HttpsURLConnection) authURL.openConnection();
  authCon.setRequestMethod("GET");
  authCon.setDoOutput(false);
  authCon.setConnectTimeout(100000);
  authCon.setRequestProperty("response_type", "code");
  authCon.setRequestProperty("client_id", CLIENT_ID);
  authCon.setRequestProperty("redirect_uri",
          "http://**************.com/parseAuth/");
  authCon.setRequestProperty("scope", convertToCommaDelimited(scopes));
  authCon.setRequestProperty("state", csrfSec);
  authCon.setRequestProperty("access_type", "offline");
  authCon.setRequestProperty("approval_prompt", "auto");
  authCon.setRequestProperty("include_granted_scopes", "true");
  </code></pre>
  
  <p>What has me stuck is what I should be putting for the <code>redirect URI</code>. After getting the user's approval for the new scope, this authorization URL would return an authorization code to the <code>redirect URI</code>, and seemingly nothing to whatever called it. (Am I correct in this?) So if I have another servlet as the <code>redirect URI</code> to parse/extract the authorization code from the response, <strong>how in the world do I get that authorization code back to my first, initial servlet?</strong> It seems to me that there is no way to have it give back the value to the servlet, in the same position of the code from which the URL was called. It looks like the function has to end there, and all new action must take place within that new servlet. But if that is the case, and I send that auth code to Google's API which would send back a refresh token and access token to ANOTHER servlet I would make to be its <code>redirect URI</code>, how do I possibly get that information back to what it is which called the initial servlet to begin with? That seems to be the same problem at its core, with the problem I am having with Scribe.</p>
  
  <p>I've been stuck on this for many hours, and can't seem to figure out what it is I am supposed to do. <strong>I feel like I am missing some key concept, element, or step.</strong> I need this clarified. If it is at all relevant, my servlet is hosted on a <code>Jboss</code> application server on <code>OpenShift</code>.</p>