Argthtjtr

Question: What is the difference between the following OAuth 2.0 authorization URLs:

In various documents example I see reference to this authorization URL:

https://accounts.google.com/o/oauth2/auth

In other documents example I see reference to this authorization URL:

https://accounts.google.com/o/oauth2/v2/auth

These URLs are used for code like this (Python):

authorization_base_url is one of the above URLs.

authorization_url, state = gcp.authorization_url(

                            authorization_base_url,

                            access_type="offline",

                            prompt="select_account",

                            include_granted_scopes='true')

I am in the process of debugging another Google OAuth 2.0 Refresh Token problem and I am trying to clarify the exact solution link. I am seeing behaviour that does not match documentation.

There's no documentation of the differences but in general they are different versions of the same endpoint.

A newer version may introduce improved or changed behavior though protocol-wise and interoperability-wise there should be no difference to the consumer. They're all OAuth 2.0/OIDC compliant but within the spec there are different optional behaviours that may be implemented.

As an example of that: when an error occurs on the Google side, Google may decide to stop the flow and show this error to the user, or alternatively return an error to the Client as OAuth 2.0 allows you to do. Both are valid behaviors and different versions of the Authorization endpoint may implement a different flavor.