Deno Google Sheets using google service accounts JWT authentication

jwt.js

const jwt = require("jsonwebtoken");

const credentials = require('./credentials.json');

const privateKey = credentials["private_key"];
const iss = credentials["client_email"];
const scope = "https://www.googleapis.com/auth/drive.readonly";

const token = jwt.sign(
  {
    iss,
    scope: ,
    aud: "https://oauth2.googleapis.com/token",
    exp: 1594569178,
    iat: 1594567978,
  },
  privateKey,
  {
    algorithm: "RS256",
    header: { alg: "RS256", typ: "JWT" },
  }
);

console.log(token);

/*
curl -d 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=<generated-jwt>' https://oauth2.googleapis.com/token
*/

jwt.sh

PEM=$( cat pem.key )

NOW=$( date +%s )
IAT="${NOW}"
# expire 9 minutes in the future. 10 minutes is the max for github
EXP=$((${NOW} + 540))
HEADER_RAW='{"alg":"RS256","typ":"JWT"}'
echo $HEADER_RAW
HEADER=$( echo -n "${HEADER_RAW}" | openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n' )
PAYLOAD_RAW='{"iat":'"${IAT}"',"exp":'"${EXP}"',"iss":"","scope":"https://www.googleapis.com/auth/drive.readonly","aud":"https://oauth2.googleapis.com/token"}'
echo $PAYLOAD_RAW
PAYLOAD=$( echo -n "${PAYLOAD_RAW}" | openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n' )
HEADER_PAYLOAD="${HEADER}"."${PAYLOAD}"
SIGNATURE=$( openssl dgst -sha256 -sign <(echo -n "${PEM}") <(echo -n "${HEADER_PAYLOAD}") | openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n' )
JWT="${HEADER_PAYLOAD}"."${SIGNATURE}"
echo $JWT

sheets.ts

async function main() {
  const response = await fetch('https://sheets.googleapis.com/v4/spreadsheets/<sheet-id>/values/<sheet-name>!<sheet-range>', {
    headers: {
      'Authorization': 'Bearer <access-token>'
    }
  });
  const result = await response.json();
  console.log(result);
}

main();

Links

1. https://developers.google.com/identity/protocols/oauth2/service-account#httprest
2. https://developers.google.com/sheets/api/samples/reading
3. https://console.developers.google.com/ # go to service account, create one if not present and generate api credentials