ユーザーがログインして（まだログインしていない場合）、Google に API を使用して自分のデータにアクセスする権限を付与します（まだ権限を付与していない場合）。
サービスが認可コードを作成し、リクエストに付加された認可コードとともにユーザーのブラウザを Google にリダイレクトして Google に認可コードを返します。
Google が認可コードをトークン交換エンドポイントに送信します。このエンドポイントはコードの真正性を検証し、アクセス トークンと更新トークンを返します。アクセス トークンは有効期間の短いトークンで、サービスが API にアクセスするための認証情報として受け入れられます。更新トークンは長期間有効なトークンです。Google では、このトークンを保存して、有効期限が切れたときに新しいアクセス トークンを取得するために使用できます。
ユーザーがログインして（まだログインしていない場合）、Google に API を使用して自分のデータにアクセスする権限を付与します（まだ権限を付与していない場合）。
サービスが認可コードを作成し、リクエストに付加された一時的な認可コードをユーザーのブラウザを Google にリダイレクトして Google に返します。
Google が認可コードをトークン交換エンドポイントに送信します。このエンドポイントはコードの真正性を検証し、アクセス トークンと更新トークンを返します。アクセス トークンは有効期間の短いトークンで、サービスが API にアクセスするための認証情報として受け入れられます。更新トークンは長期間有効なトークンです。Google では、このトークンを保存して、有効期限が切れたときに新しいアクセス トークンを取得するために使用できます。
ユーザーがログインして認証情報を確認すると、有効期間が長いアクセス トークンが作成され、Google に返されます。この時点で、アクション内のユーザーの ID はログインに使用したアカウントにリンクされ、Google がサービスの API に対して行う各 API 呼び出しにアクセス トークンが追加されます。
この認可コードはトークン交換エンドポイントに送信され、トークン交換エンドポイントからアクセス トークンと更新トークンの両方が返されます。この時点で、アクション内のユーザー ID はログインに使用したアカウントにリンクされ、アシスタントからフルフィルメントに送信されるすべての後続のリクエストにアクセス トークンが含まれます。
[null,null,["最終更新日 2025-07-26 UTC。"],[[["\u003cp\u003eOAuth account linking, utilizing OAuth 2.0 implicit or authorization code flows, securely connects users' Google accounts with your service.\u003c/p\u003e\n"],["\u003cp\u003eIn the implicit flow, a long-lived access token is returned directly upon successful login; whereas, the authorization code flow involves an intermediary code exchange for enhanced security.\u003c/p\u003e\n"],["\u003cp\u003eOAuth is recommended if you already use OAuth 2.0 and cannot adapt your token exchange endpoint for Google's automatic linking protocols.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Assistant guides users through an account linking process, prompting for consent and redirecting to your authorization endpoint for sign-in and data access permission.\u003c/p\u003e\n"],["\u003cp\u003eAccess tokens, attached to subsequent requests, grant your service authorized access to user data, with refresh tokens ensuring continued access.\u003c/p\u003e\n"]]],[],null,["# OAuth concept guide (Dialogflow)\n\nThe OAuth account linking type supports two industry-standard OAuth 2.0 flows:\nthe *implicit* and *authorization code* flows. In the implicit code flow, Google\nopens your authorization endpoint in the user's browser. After successful sign-in,\nyou return a long-lived access token to Google. This access token is then included\nin every request sent from the Assistant to your Action.\n\nOAuth is the recommended account linking solution if the following applies:\n\n- You have an existing implementation of an OAuth 2.0 server, and you cannot extend your token exchange endpoint to add support for Google's protocols for automatic linking and account creation from an ID token (i.e., add the `intent=get` and `intent=create` parameters in requests to this endpoint).\n\nTo verify that OAuth is the right solution for you, see the\n[Choose your account linking type](/assistant/df-asdk/identity/choose-type) page.\n\nKey terms\n---------\n\nBefore you read about how OAuth works, familiarize yourself with the following terms:\n\n- **Account sign-in helper intent:** A helper intent that you call to request an account linking flow from the Assistant. For more information, see [Account Sign-in](/assistant/df-asdk/helpers#account_sign-in).\n - **Context string:** A customized string that you add to the account sign-in helper intent that tells the user why you need them to link their account.\n- **Authorization code flow:** During this OAuth 2.0 flow, Google opens your\n authorization endpoint in the user's browser. If sign-in is successful,\n your service creates an *authorization code* and returns it to Google.\n Google sends this authorization code to your token exchange endpoint, which\n verifies the authenticity of the code and returns an access token and refresh token.\n\n This flow requires two endpoints:\n - **Authorization endpoint:** The endpoint that is responsible for finding or obtaining consent from users for data access. This endpoint does the following:\n 1. Presents the sign-in UI to your users that aren't already signed in.\n 2. Records consent to the requested access in the form of a short-lived authorization code.\n - **Token exchange endpoint:** This endpoint is used to obtain encrypted strings called *tokens* that authorize the Action user to access your service. This endpoint is responsible for two types of exchanges:\n 1. Exchanges an authorization code for a long-lived refresh token and a short-lived access token. This exchange happens when the user goes through the account linking flow.\n 2. Exchanges a long-lived refresh token for a short-lived access token. This exchange happens when Google needs a new access token because the one it had expired.\n- **Implicit code flow:** During this OAuth 2.0 flow, Google opens your authorization\n endpoint in the user's browser. If sign-in is successful, you return a\n long-lived access token to Google. This access token is then included in\n every request sent from the Assistant to your Action. This flow requires\n only an authorization endpoint.\n\n- **Access token:** A token that authorizes your service to access parts of\n a user's data. Access tokens are associated with each individual user\n and should be unguessable.\n\n- **Refresh token:** A token that is exchanged for a new access token once a\n short-lived access token has expired.\n\nHow it works\n------------\n\nThis section describes the general flow for the OAuth authorization code and\nimplicit flows. The following section, [OAuth flows](#oauth_flows),\ndescribes the various flows that can occur with OAuth.\n\nThe authorization code flow can be summarized as follows:\n\n1. Your Action asks the user if they want to link their account with your service.\n2. After the user agrees to link accounts, Google opens your authorization endpoint in the user's browser. If the flow started on a voice-only device for an Action, Google would transfer the execution to a phone.\n3. The user signs in (if not signed in already) and grants Google permission to access their data with your API (if they haven't already granted permission).\n4. Your service creates an *authorization code* and returns it to Google by redirecting the user's browser back to Google with the authorization code attached to the request.\n5. Google sends the authorization code to your token exchange endpoint, which verifies the authenticity of the code and returns an *access token* and a *refresh token*. The access token is a short-lived token that your service accepts as credentials to access APIs. The refresh token is a long-lived token that Google can store and use to acquire new access tokens when they expire.\n6. After the user has completed the account linking flow, every subsequent request sent from the Assistant to your fulfillment webhook contains an access token.\n\nThe implicit code flow can be summarized as follows:\n\n1. Your Action asks the user if they want to link their account with your service.\n2. After the user agrees to link accounts, Google opens your authorization endpoint in the user's browser.\n3. The user signs in (if not signed in already) and grants Google permission to access their data with your API (if they haven't already granted permission).\n4. Your service creates an access token and returns it to Google by redirecting the user's browser back to Google with the access token attached to the request.\n5. After the user has completed the account linking flow, Google calls your service's APIs and attaches the access token with each request. Your service verifies that the access token grants Google authorization to access the API and then completes the API call.\n\nThe fundamental authorization code flow is as follows:\n\n1. Your Action asks the user if they want to link their account with your service.\n2. After the user agrees to link accounts, Google opens your authorization endpoint in the user's browser. If the flow started on a voice-only device for an Action, Google would transfer the execution to a phone.\n3. The user signs in (if not signed in already) and grants Google permission to access their data with your API (if they haven't already granted permission).\n4. Your service creates an *authorization code* and returns it to Google by redirecting the user's browser back to Google with the short-lived authorization code attached to the request.\n5. Google sends the authorization code to your token exchange endpoint, which verifies the authenticity of the code and returns an *access token* and a *refresh token*. The access token is a short-lived token that your service accepts as credentials to access APIs. The refresh token is a long-lived token that Google can store and use to acquire new access tokens when they expire.\n6. After the user has completed the account linking flow, every subsequent request sent from the Assistant to your fulfillment webhook contains an access token.\n\nOAuth flows\n-----------\n\nThis section goes over the various flows that can occur with OAuth.\n| **Note:** The following flows assume the user agrees to link their account with your service and grant Google permission to access their data with your API. If a user doesn't give consent, provide them a way to continue in your Action with an alternate, limited flow. For more information, see [Best practices](/assistant/df-asdk/identity/best-practices).\n\nEach flow contains these common steps after the user invokes your Action:\n\n| **Note:** A line from *Webhook* to *User* represents a [simple response](/assistant/df-asdk/simple-responses) that you create and customize. Lines drawn from *Assistant* to *User* represent prompts that are owned by the Assistant and have limited options for customization (requests that require permission are always owned by the Assistant). From the user's perspective, both kinds of responses are delivered from the Assistant.\n\nIn the flow above, you call the `actions.intent.SIGN_IN` helper intent to start\nthe account linking flow. The Assistant asks the user if they want to link\ntheir account with your service and shows them a screen with the requested\npermissions. When the user consents, Google then redirects the user to your\nservice's authorization endpoint in the browser. The user signs in (or,\ndepending on your configuration, creates a new account) and grants your Action\npermission to access their data.\n\nThe flows after this point differ based on whether or not you implemented\nthe implicit flow or authorization code flow. These flows are described in\nthe following sections.\n\n### Flow 1: User signs in with implicit flow\n\n| **Note:** This diagram builds off of the **Common steps** diagram above.\n\nAfter the user logs in and their credentials are verified, your service creates\na long-lived access token and returns it to Google. At this point, the user's\nidentity in your Action is linked to the account they signed in with, and the\naccess token is attached to each API call Google makes to your service's APIs.\n\n### Flow 2: User signs in with authorization code flow\n\n| **Note:** This diagram builds off of the **Common steps** diagram above.\n\nAfter the user logs in and their credentials are verified, your service creates\nan authorization code and returns it to Google.\n\nThis authorization code is sent to your token exchange endpoint, which returns\nboth an access token and a refresh token. At this point, the user's identity\nin your Action is linked to whatever account they signed in with, and every\nsubsequent request sent from the Assistant to your fulfillment contains an\naccess token."]]
