I'm trying to import some data from a SHP to GFT (Google Fusion Table). I get a 401 error. I'm using an Ubuntu 14.04 LTS Linux 64 bits with GDAL 1.11.0, released 2014/04/16. GFT is available (tested with ogrinfo --formats |grep GFT)

The steps at the moment are :

  • Go to https://console.developers.google.com/project
  • Create a project
  • Activate Google Fusion as one of the available API
  • Create credentials with OAUTH for Installed applications with Other to get a client ID and a client secret
  • Export variables in system with

    export GOA2_CLIENT_ID=client ID>
    export GOA2_CLIENT_SECRET=<client secret>

    Both override GDAL_CLIENT_ID and GDAL_CLIENT_SECRET default parameters

  • Run python /usr/bin/gdal_auth.py to open a browser to accept connexion where you get an authorization token (from the browser after connexion). In the console, you will get this message below

    Please login and authorize access in web browser...
    Enter authorization token:

    and will need to paste the token. It will generate a refresh token with message in the console like below:

    Consider setting a configuration option like:
    GFT_REFRESH_TOKEN=<refresh token>
  • export with export GFT_REFRESH_TOKEN=<refresh token>

  • Try ogr2ogr -f GFT "GFT:access=<authorization token>" ~/countries.shp
  • Get an error like followed

    ERROR 1: HTTP error code : 401
    ERROR 1: HTML error page returned by server
    GFT driver failed to create GFT:access=<authorization token>

I also tried with GFT_REFRESH_TOKEN=<refresh token> ogr2ogr -f GFT "GFT:access=<authorization token>" ~/countries.shp but go the same error

According to some researches, 401 errors in GFT are related to authorisation or scope but I should miss the point here.

So, any clue is welcome!


To solve my issue, I had to use the debug option in the command ogr2ogr --config CPL_DEBUG ON -f GFT "GFT:access=<authorization token>" ~/countries.shp

The returned output was

Shape: DBF Codepage = LDID/87 for countries.shp
Shape: Treating as encoding 'ISO-8859-1'.
OGR: OGROpen(france.shp/<persistent_session_code>) succeeded as ESRI Shapefile.
HTTP: Fetch(https://accounts.google.com/o/oauth2/token)
HTTP: These POSTFIELDS were sent:refresh_token=<refresh_token>&client_id=<client_id>&client_secret=<client_secret>&grant_type=refresh_token
HTTP: These HTTP headers were set: Content-Type: application/x-www-form-urlencoded
GOA2: Refresh Token Response:
  "access_token" : "<access token>",
  "token_type" : "Bearer",
  "expires_in" : 3600
GOA2: Access Token : '<access token>'
HTTP: Establish persistent session named 'GFT:<persistent_session_code>'.
HTTP: Fetch(https://www.googleapis.com/fusiontables/v1/query)
HTTP: These POSTFIELDS were sent:sql=SHOW TABLES&key=AIzaSyA_2h1_wXMOLHNSVeo-jf1ACME-M1XMgP0&alt=csv
HTTP: These HTTP headers were set: Authorization: Bearer <access token>
ERROR 1: HTTP error code : 401
GFT: RunSQL HTML Response:Invalid Credentials
ERROR 1: HTML error page returned by server
HTTP: Ended persistent session named 'GFT:<persistent_session_code>'.
GFT driver failed to create GFT:refresh=<refresh_token>
GDAL: In GDALDestroy - unloading GDAL shared library.

As you see, there is an "unknown" code AIzaSyA_2h1_wXMOLHNSVeo-jf1ACME-M1XMgP0 in line HTTP: These POSTFIELDS were sent:sql=SHOW TABLES&key=AIzaSyA_2h1_wXMOLHNSVeo-jf1ACME-M1XMgP0&alt=csv

A quick search with this token redirected to https://fossies.org/dox/gdal-2.0.0/ogrgftdatasource_8cpp.html

I discovered that a default GDAL_API_KEY "AIzaSyA_2h1_wXMOLHNSVeo-jf1ACME-M1XMgP0" parameter has been set. As the ownership (to GDAL account) for this key was different from my account, I had to change it.

Doing a simple export GFT_APIKEY="" solve the issue.


Looking at GDAL autotests, I see only the refresh token is defined. As far as I understand the code, the access token will be automatically got from the refresh token (since the access token is apparently renewed from the refresh token, so it is not practical setting its value directly). So try to undefine the access token ("GFT:" as connection string), and define only he refresh token. This OAuth2 mechanism is horrible.

  • Thanks for your answer. It was a clue to look at autotests to see the way you manage the API. – ThomasG77 Aug 3 '15 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.