对 Meet REST API 请求进行身份验证和授权
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
身份验证和授权是分别用于验证身份和资源访问权限的机制。本文档概述了 Google Meet REST API 请求的身份验证和授权机制。
本指南介绍了如何使用 OAuth 2.0 和用户的 Google 凭据来访问 Meet REST API。通过用户凭据进行身份验证和授权后，Meet 应用可以访问用户数据并代表经过身份验证的用户执行操作。通过代表用户进行身份验证，应用将拥有与该用户相同的权限，并且可以执行操作，就好像这些操作是由该用户执行的一样。
重要术语
以下是与身份验证和授权相关的术语列表：
- Authentication
确保正文（可以是用户）
或代表用户行事的应用，是否是他们声称的身份。编写 Google Workspace 应用时，您应了解以下类型的身份验证：用户身份验证和应用身份验证。对于 Meet REST API，您只能使用用户身份验证进行身份验证。
- 授权
主账号访问资源所需的权限或“授权”
数据或执行操作。授权通过您在应用中编写的代码完成。此代码会告知用户应用希望代表其执行操作，如果用户允许，则会使用应用的唯一凭据从 Google 获取访问令牌，以访问数据或执行操作。
Meet REST API 范围
授权范围是指您请求用户授权您的应用访问会议内容的权限。当有人安装您的应用时，系统会要求用户验证这些范围。通常情况下，您应尽可能选择范围最窄的权限，并避免请求应用不需要的权限。用户更乐意向描述清晰的有限范围授予访问权限。
Meet REST API 支持以下 OAuth 2.0 范围：
| 范围代码 |
说明 |
用法 |
https://www.googleapis.com/auth/meetings.space.settings |
修改并查看所有 Google Meet 通话的设置。 |
非敏感 |
https://www.googleapis.com/auth/meetings.space.created |
允许应用创建、修改和读取有关应用创建的会议室的元数据。 |
敏感 |
https://www.googleapis.com/auth/meetings.space.readonly |
允许应用读取用户有权访问的任何会议室的相关元数据。 |
敏感 |
https://www.googleapis.com/auth/drive.readonly |
允许应用通过 Google Drive API 下载录制内容和转写文件。 |
受限 |
以下与 Meet 相关的 OAuth 2.0 范围位于
Google Drive API 范围列表中：
| 范围代码 |
说明 |
用法 |
https://www.googleapis.com/auth/drive.meet.readonly |
查看由 Google Meet 创建或修改的云端硬盘文件。 |
受限 |
下表中的“用途”列根据以下定义指明了每个范围的敏感程度：
非敏感：这些范围提供的授权访问权限范围最小，仅需要进行基本应用验证。如需了解详情，请参阅验证要求。
敏感：这些范围可让您的应用访问用户授权的特定 Google 用户数据。您需要完成额外的应用验证。如需了解详情，请参阅敏感范围和受限范围要求。
受限：这些范围可广泛访问 Google 用户数据，因此您需要完成受限范围验证流程。如需了解详情，请参阅 Google API 服务用户数据政策和特定 API 范围的其他要求。
如果您在服务器上存储（或传输）受限范围的数据，则必须接受安全性评估。
如果您的应用需要访问任何其他 Google API，您也可以添加这些范围。如需详细了解 Google API 范围，请参阅使用 OAuth 2.0 访问 Google API。
如需定义向用户和应用审核者显示哪些信息，请参阅配置 OAuth 权限请求页面并选择范围。
如需详细了解特定的 OAuth 2.0 范围，请参阅适用于 Google API 的 OAuth 2.0 范围。
使用全网域授权进行身份验证和授权
如果您是网域管理员，则可以授予全网域授权，以授权应用的某个服务账号访问您用户的数据，而无需每位用户都同意。配置全网域委托后，服务账号可以模拟用户账号。
虽然服务账号用于身份验证，但全网域授权会模拟用户，因此被视为用户身份验证。任何需要用户身份验证的功能都可以使用全网域授权。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-29。
[null,null,["最后更新时间 (UTC)：2025-08-29。"],[],[],null,["# Authenticate and authorize Meet REST API requests\n\nAuthentication and authorization are mechanisms used to verify identity and\naccess to resources, respectively. This document outlines how authentication and\nauthorization work for Google Meet REST API requests.\n\nThis guide explains how to use OAuth 2.0 with a user's Google credentials to\naccess the [Meet REST API](/workspace/meet/api/reference/rest/v2). Authenticating and\nauthorizing with user credentials lets Meet apps access user data\nand perform operations on the authenticated user's behalf. By authenticating on\na user's behalf, the app has the same permissions as that user and can perform\nactions as if they were performed by that user.\n\nImportant terminology\n---------------------\n\nThe following is a list of terms related to authentication and authorization:\n\n*Authentication*\n\n: The act of ensuring that a *principal*, which can be a user\n\n or an app acting on behalf of a user, is who they say they are. When writing\n Google Workspace apps, you should be aware of these types of\n authentication: user authentication and app authentication. For\n Meet REST API, you can only authenticate using user authentication.\n\n*Authorization*\n\n: The permissions or \"authority\" the principal has to access\n\n data or perform operations. The authorization is done through code you write\n in your app. This code informs the user that the app wishes to act on their\n behalf and, if allowed, uses your app's unique credentials to obtain an\n access token from Google to access data or perform operations.\n\nMeet REST API scopes\n--------------------\n\nAuthorization scopes are the permissions that you request users to authorize for\nyour app to access the meeting content. When someone installs your app, the user\nis asked to validate these scopes. Generally, you should choose the most\nnarrowly focused scope possible and avoid requesting scopes that your app\ndoesn't require. Users more readily grant access to limited, clearly described\nscopes.\n\nThe Meet REST API supports the following OAuth 2.0 scopes:\n\n| Scope code | Description | Usage |\n|-----------------------------------------------------------|-------------------------------------------------------------------------------------------|---------------|\n| `https://www.googleapis.com/auth/meetings.space.settings` | Edit and see the settings for all of your Google Meet calls. | Non-sensitive |\n| `https://www.googleapis.com/auth/meetings.space.created` | Allow apps to create, modify, and read metadata about meeting spaces created by your app. | Sensitive |\n| `https://www.googleapis.com/auth/meetings.space.readonly` | Allow apps to read metadata about any meeting space the user has access to. | Sensitive |\n| `https://www.googleapis.com/auth/drive.readonly` | Allow apps to download recording and transcript files from Google Drive API. | Restricted |\n\nThe following Meet-adjacent OAuth 2.0 scope resides in the [Google Drive API scopes list](/workspace/drive/api/guides/api-specific-auth#drive-scopes):\n\n| Scope code | Description | Usage |\n|-------------------------------------------------------|----------------------------------------------------|------------|\n| `https://www.googleapis.com/auth/drive.meet.readonly` | View Drive files created or edited by Google Meet. | Restricted |\n\nThe Usage column in the table indicates the sensitivity of each scope, according\nto the following definitions:\n\n- **Non-sensitive** : These scopes provide the smallest scope of authorization\n access and only require basic app verification. To learn more, see\n [Verification\n requirements](https://support.google.com/cloud/answer/13464321).\n\n- **Sensitive** : These scopes provide access to specific Google user data\n that's authorized by the user for your app. It requires you to go through\n additional app verification. To learn more, see [Sensitive and Restricted\n Scope\n Requirements](https://support.google.com/cloud/answer/13464321#ss-rs-requirements).\n\n- **Restricted** : These scopes provide wide access to Google user data and\n require you to go through a restricted scope verification process. To learn\n more, see [Google API Services User Data\n Policy](/terms/api-services-user-data-policy) and [Additional Requirements\n for Specific API\n Scopes](/terms/api-services-user-data-policy#additional_requirements_for_specific_api_scopes).\n If you store restricted scope data on servers (or transmit), then you must\n go through a security assessment.\n\nIf your app requires access to any other Google APIs, you can add those scopes\nas well. For more information about Google API scopes, see [Using OAuth 2.0 to\nAccess Google APIs](/accounts/docs/OAuth2).\n\nTo define what information is displayed to users and app reviewers, see\n[Configure the OAuth consent screen and choose\nscopes](/workspace/guides/configure-oauth-consent).\n\nFor more information about specific OAuth 2.0 scopes, see [OAuth 2.0 Scopes for\nGoogle APIs](/identity/protocols/oauth2/scopes).\n\nAuthenticate and authorize using domain-wide delegation\n-------------------------------------------------------\n\nIf you're a domain administrator, you can grant [domain-wide delegation of\nauthority](https://support.google.com/a/answer/162106) to authorize an\napplication's service account to access your users' data without requiring each\nuser to give consent. After you configure domain-wide delegation, the [service\naccount can impersonate a user\naccount](https://developers.google.com/identity/protocols/oauth2/service-account#authorizingrequests).\nAlthough a service account is used for authentication, domain-wide delegation\nimpersonates a user and is therefore considered *user authentication*. Any\ncapability that requires user authentication can use domain-wide delegation.\n\nRelated topics\n--------------\n\n- For an overview of authentication and authorization in Google Workspace,\n see [Learn about authentication and\n authorization](/workspace/guides/auth-overview).\n\n- For an overview of authentication and authorization in Google Cloud, see\n [Authentication methods at\n Google](https://cloud.google.com/docs/authentication)."]]
