title: Google Java API for AuthorizationCodeInstalledApp for web application
body: <p>I'm having some confusion with the API documentation and my use case, and how to handle the authorization token for my web application. I have a web service where users are signed into my application (not a Google app) and I need them to provide my service (Java with Spring Boot) authorization to upload for Youtube.  Later, I need to be able to use that authorization "offline" to upload videos to their channel, without them being logged into my service (an "auto publishing" type feature).  I've tried numerous methodologies, and generally have this working, but run into some bumps for clean implementation:</p>
  
  <pre><code>        GoogleAuthorizationCodeFlow flow =
                  new GoogleAuthorizationCodeFlow.Builder(
                          httpTransport, JSON_FACTORY, clientSecrets, scopes)
                          .setDataStoreFactory(dataStoreFactory)
                          .setAccessType("offline")
                          .build();
  
          credential = new AuthorizationCodeInstalledApp(
                  flow, new LocalServerReceiver()).authorize("user");
  </code></pre>
  
  <p>Produces a console message with the url to provide the user to open in their browser.  I would have hoped the user would have be actually redirected.  I don't want this to be a manual process where I have to be at the console and then provide the user the url returned from this process for them to open in their own browser. The LocalServerReceiver, as I understand it, is for handling the actual access token response once authorization is given by the user.  I've explored this at length, and couldn't find any document solution or anything in the examples where this didn't produce a console message to the affect "paste the following url into your browser...." with the authorization url.</p>
  
  <p>I tried using GoogleAuthorizationCodeFlow with:</p>
  
  <pre><code>        GoogleAuthorizationCodeFlow flow = (new GoogleAuthorizationCodeFlow.Builder(httpTransport, JSON_FACTORY, clientSecrets, scopes))
                  .setDataStoreFactory(dataStoreFactory)
                  .setAccessType("offline")
                  .build();
  
          return flow.newAuthorizationUrl()
                  .setScopes(scopes)
                  .setAccessType("offline")
                  .setClientId(clientSecrets.getDetails().getClientId())
                  .setRedirectUri(redirectionUrl)
                  .toString();
  </code></pre>
  
  <p>I put "/oauth2-callback" for my redirectionUrl, and this works (somewhat). I get the user to the Google authorization page, they authorize it and I get a token to my "callback" end point ("/oauth2-callback"), but that token doesn't appear to be fully authorized.  I store it in my data store ok, and see it there, but when I try to use it offline, I get an authorization error.  Going through more of the docs, I came upon this remaining code for handling the token sent back to my callback:</p>
  
  <pre><code>        GoogleTokenResponse response = flow.newTokenRequest(token)
                  .setRedirectUri(redirectUrl).execute();
  
          Credential credential = flow.createAndStoreCredential(response, "user");
  </code></pre>
  
  <p>The problem with this is that I'm already in my callback endpoint, and this wants another redirectURL.  The token from the authorization doesn't work in offline mode until I do this "newTokenRequest", which requires another redirect URL.  It appears to require the original redirectURL that was in the flow.newAuthorizationUrl() call, but when the newTokenRequest is executed, it produces another call back into that URL, and I end up getting a "token already redeemed" error.  </p>
  
  <p>In either of my scenarios above, with AuthorizationCodeInstalledApp, or using flow.newAuthorizationUrl() with a callback url that I handle with the token with flow.newTokenRequest and flow.createAndStoreCredential, I do get a credential I can use offline later.  But I'm having problem getting a smooth user experience in either one.  </p>
  
  <p>What am I missing in my scenario?</p>