Google AppEngine to Fusion Tables with Service Accounts

Question

Late to the game on migrating to the /v1 Fusion Table API but no holding off any longer.

I'm using Python on AppEngine and trying to connect to Google Fusion Tables with Google Service Accounts (the more complicated cousin of OAuth2 for server side apps that uses JSON Web Tokens)

I found another question that pointed me to some documentation for using Service Accounts with Google Prediction API. Fusion Table and Google Service Accounts

So far I've got

import httplib2
from oauth2client.appengine import AppAssertionCredentials
from apiclient.discovery import build

credentials = AppAssertionCredentials(scope='https://www.googleapis.com/auth/fusiontables')
http = credentials.authorize(httplib2.Http(memcache)) #Http(memcache)
service = build("fusiontables", "v1", http=http)

# list the tables
tables = service.table().list().execute() # <-- ERROR 401 invalid credentials here

Does anyone have an example of connecting to Fusion Tables on AppEngine using Service Accounts they might be able to share? Or something nice online?

Thanks

Answer 1

This actually does work. The important parts are you have to give the app engine service account access to your fusion table. If you are writing then the account needs write access. For help see: https://developers.google.com/api-client-library/python/start/installation (look for Getting started: Quickstart)

Your app engine service account will be something like your-app-id@appspot.gserviceaccount.com

You must also make the app engine service account a team member in the api console and give it "can edit" privilege.

SCOPE='https://www.googleapis.com/auth/fusiontables'
PROJECT_NUMBER = 'XXXXXXXX' # REPLACE WITH YOUR Project ID

# Create a new API service for interacting with Fusion Tables
credentials = AppAssertionCredentials(scope=SCOPE)
http = credentials.authorize(httplib2.Http())
logging.info('QQQ: accountname: %s' % app_identity.get_service_account_name())
service = build('fusiontables', 'v1', http=http, developerKey='YOUR KEY HERE FROM API CONSOLE')

def log(value1,value2=None):
    tableid='YOUR TABLE ID FROM FUSION TABLES'
    now = strftime("%Y-%m-%d %H:%M:%S", gmtime())
    service.query().sql(sql="INSERT INTO %s (Temperature,Date) values(%s,'%s')" % (tableid,value1,now)).execute()

Answer 2

to clarify Ralph Yozzo's answer: you need to add the value of 'client_email' from the json file you downloaded when you created your service_account credentials (the same file you load when using ServiceAccountCredentials.from_json_keyfile_name('service_acct.json') with the new oauth2client library), to your table's sharing dialog screen (click 1 then enter the email address in 2)

Answer 3

Since Fusion Tables' tables are owned by individual Gmail accounts rather than the service account associated with an API console project, the AppAssertionCredentials probably won't work. It would make for an interesting feature request, though:

http://code.google.com/p/fusion-tables/issues/list

Answer 4

The best online resource I have found for help connecting Python AppEngine to Fusion Tables API with Oauth2 is Google APIs Client Library for Python

The slide presentation is helpful to understanding the online samples, why decorators are used.

Also useful for understanding whether to use the app's Service Acount or User Accounts to authenticate is: Using OAuth 2.0 to Access Google APIs

Consider installing the Google APIs Client Library for Python

Apart from the scope, the Oauth2 is more or less common to all Google APIs not just fusion tables.

Once oauth2 is working, see the Google Fusion Tables API

Answer 5

In case you want it to work from another host than Google App Engine or Google Compute Engine (e.g. from localhost for testing) then you should use ServiceAccountCredentials created from a json key file that you can generate and download from your service account page.

scopes = ['https://www.googleapis.com/auth/fusiontables']
keyfile = 'PATH TO YOUR SERVICE ACCOUNT KEY FILE'
FTID = 'FUSION TABLE ID'

credentials = ServiceAccountCredentials.from_json_keyfile_name(keyfile, scopes)
http_auth = credentials.authorize(Http(memcache))
service = build('fusiontables', 'v2', http=http_auth)

def insert(title, description):
    sqlInsert = "INSERT INTO {0} (Title,Description) values('{1}','{2}')".format(FTID, title, description)
    service.query().sql(sql=sqlInsert).execute()

Refer to Google's page on service accounts for explanations.