GV password question

[azrobert]

I changed my GV password 20 hours ago and my OBi200 GV trunk is still working after 2 reboots. I know it's been 20 hours because I tried to sign into my GV account with the old PW and it told me. I then signed in with my new password, so I know it was correctly changed. I also called my landline to check the callerid and the OBi200 is configured with the correct GV account.

Why is the OBi200 still working without any changes? Will GV eventually fail?

Thanks

[drgeoff]

My understanding is that since the change made in 2014, GV and your OBi no longer use your GV password for authentication. There is a separate token which you normally don't see or need to see. Changing your account password does not change that token so no reason for GV on your OBi to stop working.

See eg http://nerdvittles.com/?p=19169, scroll down to the section "Obtaining Your Google Voice OAuth 2 Credentials for XiVO".

[azrobert]

Changing your account password does not change that token so no reason for GV on your OBi to stop working.

I knew about the OAuth2 token, but assumed the token would change with a PW change. This proves I shouldn't assume anything. Thanks for the answer.

[SteveInWA]

Here's some background on the difference between the old and new authentication methods:

All Googly things are considered separate services, associated with a Google account.  So, there is no "Google Voice password", per se, but a Google account password that allows the authorized user to access everything on that account, such as Gmail, Calendar, Maps, Google Voice, Hangouts, buying stuff on the Play Store, etc.

Originally, you gave the OBi full sign-on access to your entire Google account -- not a great idea.

Now, you log into your Google account, and give specific, limited permission to access one or more services available on your account.  So, in the case of OBiTALK, it asks you for permission to access the Google Voice/Hangouts service.  The OAUTH 2.0 token that is generated and exchanged grants just that limited access.  It can't access, for example, read your email, view your calendar or buy a video.

If you have an OBi IP phone, and you want to import your Google Contacts, then a separate OAUTH 2.0 token is exchanged, giving access to your contacts.

See the two screenshots below.  It's a good idea to periodically review the apps and devices that have permission to access your account.  You can view and delete those permissions on this page:

https://myaccount.google.com/security#connectedapps