GCP 鉴权

1. 鉴权模式概览

调用 GCP 接口需先获取用户凭证 (Credentials)。根据使用场景，主要分为 客户端授权 (OAuth2.0) 和 服务端系统级授权 (Service Account)。

---

2. 客户端终端鉴权 (OAuth 2.0)

适用于需要代表具体用户操作其个人数据的场景。代码包含自动换取和持久化缓存机制：

import os
from google.oauth2.credentials import Credentials
from google_auth_oauthlib.flow import InstalledAppFlow
from google.auth.transport.requests import Request

def get_oauth_credentials(client_account_path, client_accountbat_path, scope):
    credentials = None
    # 1. 尝试从本地缓存加载已授权的 Token
    if os.path.exists(client_accountbat_path):
        credentials = Credentials.from_authorized_user_file(client_accountbat_path)

    # 2. 如果无凭证或凭证已失效
    if not credentials or not credentials.valid:
        if credentials and credentials.expired and credentials.refresh_token:
            # 刷新过期 Token
            credentials.refresh(Request())
        else:
            # 弹出浏览器走 Oauth2 登录授权流
            flow = InstalledAppFlow.from_client_secrets_file(client_account_path, scope)
            credentials = flow.run_local_server(port=0)

        # 3. 将新获取的有效 Token 写入本地缓存以备下次使用
        with open(client_accountbat_path, 'w') as token:
            token.write(credentials.to_json())

    return credentials

---

3. 服务端无头鉴权 (Service Account)

适用于后端系统直接拉取或推送数据，无需人工干预。

警告

Token 刷新注意 默认通过文件获取的凭证对象并无立即向 Google 请求底层 Token。在传递给某些旧版 SDK 前，可能需要手动执行 refresh。

from google.oauth2 import service_account
from google.auth.transport.requests import Request

def get_service_account_credentials(service_account_path, scopes):
    credentials = service_account.Credentials.from_service_account_file(
        service_account_path,
        scopes=scopes
    )
    # 手动触发刷新以获取实际请求用的 Token
    auth_request = Request()
    credentials.refresh(auth_request)
    return credentials

---

4. Google 各核心 API 客户端初始化速查

获取到 credentials 后，可注入并实例化各类服务的客户端对象。

4.1. A. 使用传统的 Discovery 客户端

适用于部分较旧的 API：

from googleapiclient.discovery import build

# Google Search Console
client_gsc = build("searchconsole", "v1", credentials=credentials)
# Google Analytics (UA - v3)
client_ua = build("analytics", "v3", credentials=credentials)
# Google Analytics Reporting (v4)
client_ga_rep = build("analyticsreporting", "v4", credentials=credentials)
# Google Slides & Drive
client_slides = build("slides", "v1", credentials=credentials)
client_drive = build("drive", "v3", credentials=credentials)

4.2. B. 使用现代 Cloud Client Libraries

适用于 GCP 的核心云服务：

# Google Analytics 4 (GA4) Admin API
from google.analytics.admin import AnalyticsAdminServiceClient
client_ga4_admin = AnalyticsAdminServiceClient(credentials=credentials)

# Google Analytics 4 (GA4) Data API
from google.analytics.data_v1beta import BetaAnalyticsDataClient
client_ga4_data = BetaAnalyticsDataClient(credentials=credentials)

# Google BigQuery
from google.cloud import bigquery
client_bq = bigquery.Client(credentials=credentials, project="your_project_id", location="US")

# Google Cloud Storage (GCS)
from google.cloud import storage
client_gcs = storage.Client(credentials=credentials, project="your_project_id")