能否无需重新授权获取已授权用户的OAuth2刷新令牌？

Absolutely feasible—but only if you stick to a few critical requirements to ensure your App Engine (GAE) app can leverage the existing OAuth2 grant from your Google Apps Script (GAS) add-on. Here's how it works:

Key Prerequisites #

• Shared Google Cloud Project (GCP): Both your GAS add-on and GAE app must be linked to the same GCP project. OAuth2 authorizations are tied to the GCP project, not individual client apps within it. So if your GAS add-on is already using a GCP project, just use that same project for your GAE deployment. If not, you can link your GAS add-on to a GCP project via the script editor's "Resources > Cloud Platform Project" menu.
• Identical OAuth Scopes: Your GAE app must request exactly the same scopes as your GAS add-on—no extra scopes, no missing ones. Since you mentioned no additional permissions are needed, this should be straightforward. Don't forget to include the offline.access scope (required to get a refresh token) just like you did in the GAS add-on.
• Matching Client ID Context: In your GCP project's Credentials page, create a new OAuth client ID for your GAE app (select "Web application" as the type) and configure the appropriate redirect URIs for your GAE service. Because this client belongs to the same GCP project as your GAS add-on, it can inherit existing user grants for matching scopes.

Step-by-Step Implementation #

1. Link GAS to GCP: If your GAS add-on isn't already linked to a GCP project, do this first. Open the GAS editor, go to "Resources > Cloud Platform Project", and connect it to the GCP project you'll use for GAE.
2. Create GAE OAuth Client: In the GCP Console, navigate to "APIs & Services > Credentials". Click "Create Credentials > OAuth client ID", select "Web application", name it, add your GAE app's redirect URI (e.g., https://your-app-id.appspot.com/oauth2callback), and save the client ID/secret.
3. Configure GAE OAuth Flow: In your GAE app's code, use the new client ID/secret to initiate the OAuth2 flow, requesting the exact same scopes as your GAS add-on (including offline.access).
4. Test the Flow: Log in with a user account that already authorized your GAS add-on. When they access your GAE app, Google should automatically recognize the existing grant for the same scopes and GCP project, skipping the authorization prompt and returning a refresh token directly.

Important Notes #

• If a user has revoked their authorization for the GAS add-on, they'll need to re-authorize when accessing the GAE app—there's no way around that.
• Double-check that offline.access is included in your scope list; without it, Google won't issue a refresh token, even if the user has an existing grant.
• Keep in mind that OAuth2 grants are user-specific—each user's existing authorization only applies to their own account, not other users.

内容的提问来源于stack exchange，提问作者beano