title: Simple, library-free, Javascript method for inserting a file into Google Drive
body: <p>I am using a web scripting service that generates files and can POST them to a URI. If I don't have or provide one, they are stored on an ftp server. What I want to do is upload these files to my Google Drive, and, eventually, other users' Drives as well.
  Because I'm using a 'private' host, and 'pure' javascript--no browser-- I can't add any framework or library. I have to do everything by hand.</p>
  
  <p>I've been through all the documentation, read many posts here, found some really good information, and have lost some hair.</p>
  
  <p>Here's where the project is at the moment:
  I'm using oauth2, web server flow. 
  I can request access, and get an auth code, like so:</p>
  
  <pre><code>https://accounts.google.com/o/oauth2/auth?
      response_type=code
     &amp;scope=https://www.googleapis.com/auth/drive
     &amp;redirect_uri=http://myserver.com/
     &amp;access_type=offline
     &amp;state=testing
     &amp;client_id={CLIENT_ID].apps.googleusercontent.com
  </code></pre>
  
  <p>This gets me an auth code. So far, so good.</p>
  
  <p>Then, I take that code and do:</p>
  
  <pre><code>POST /o/oauth/token HTTP/1.1
  Host:  https://accounts.google.com
  client_id=yada_yada
  &amp;client_secret=more_yada
  &amp;redirect_uri=http://myserver.com/
  &amp;code=[the code I just got]
  &amp;grant_type=authorization_code
  </code></pre>
  
  <p>Now, this step fails if I use XMLHttpRequest; I get an "Access-Control-Allow-Origin' violation. So, I slapped together an HTML page with a form and posted <strong>that</strong>. I get back a JSON object containing an access_token and a refresh_token. Yay.</p>
  
  <pre><code>{
    'access_token'  : [Access Yada-Yada],
    'expires_in'    : 3600,
    'token_type'    : 'Bearer',
    'refresh_token' : '[Refresh Yada-Yada]
  }
  </code></pre>
  
  <p>Now, I can get my script to work for one hour. Yippee.</p>
  
  <p>Now, after all that, how do I use the refresh_token to get a new access_token. I have tried everything. XMLHttpRequests give me the same cross-domain violation, and doing an HTML form gets me an 'invalid_request' response! I tried using curl, never having touched it before, and that did <strong>not</strong> go well.</p>
  
  <p>Please help.</p>
  
  <p><strong>Edit</strong></p>
  
  <p>The format for the refresh request goes like this:</p>
  
  <pre><code>var xhr = XMLHttpRequest();
  xhr.open('POST',"https://accounts.google.com/o/oauth/token?" +
      "client_id=[CLIENT_ID]"+
     "&amp;client_secret=[CLIENT_SECRET]"+
     "&amp;refresh_token=[REFRESH_TOKEN]"+
     "&amp;grant_type=refresh_token",
    true);
  xhr.setRequestHeader('Content-Type','x-www-form-urlencoded');
  xhr.send();
  </code></pre>
  
  <p>I copied the url parameters directly from the OAuth Playground, which I had given my project keys. I get the Access-Control-Allow-Origin violation when I do this.</p>
  
  <p>If I wrap it in a form, like so:</p>
  
  <pre><code>&lt;form method="GET" action="https://accounts.google.com/o/oauth2/token"&gt;
  &lt;div&gt;REFRESH TOKEN:&lt;/div&gt;
    &lt;input type="text" name="refresh_token" value="[REFRESH_TOKEN]"&gt;
  &lt;br&gt;&lt;div&gt;CLIENT ID:&lt;/div&gt;
    &lt;input type="text" name="client_id"     value="[CLIENT_ID]"&gt;
  &lt;br&gt;&lt;div&gt;CLIENT SECRET:&lt;/div&gt;
    &lt;input type="text" name="client_secret" value="[CLIENT_SECRET"&gt;
  &lt;br&gt;&lt;div&gt;GRANT TYPE:&lt;/div&gt;
    &lt;input type="text" name="grant_type"    value="refresh_token"&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>I can get a new access token. But, I can't get the same thing to work in JS using XMLHttpRequest. I keep getting XD errors.</p>
  
  <p>I just need a way to post a refresh request to google from javascript without using any libraries.</p>