democode stops - please help

[E2CRE8]

using your code to create a new speadsheet - every time the code stops at this line:
bool success = GSheet.create(&response /* returned response /, &spreadsheet / spreadsheet object /, USER_EMAIL / your email that this spreadsheet shared to */);

this mis my serial monitor output:

I followed all steps in your Github to activate the API stuff in my google account

in the google sheets API I can see traffic response code of 200 every time I run the program- so this seems to be ok - but no new spreadsheet is created.

(I use an Arduino nano 33 iot)

Any help is welcome - I am a teacher and it would be so great to get this working for my students.
regards
Bart

[mobizt]

I guess that your device memory may be limited and stack overflow or out of free heap can be occurred.

I recommend devices like ESP32, ESP8266 and Raspberry Pi Pico W.

[E2CRE8]

Hello, thank you for your fast answer.
The Nano 33 iot has a 32bit SAMD processor on it. I've used it in a variety of other (much heavier) REST API applications - without any problem.
I'll test it on other devices in the next couple of days and let you know.

[mobizt]

Your usage is really basic thing that you can used any samd or avr device for that basic application.

In this library, it is not just about REST client via https unless it involved the crypto tasks required for OAuth2.0 authentication to create signed JWT token using service account.

This is the only secure way to authenticate with Google Cloud services for non-sdk client.

The token signing process was done by BearSSL (SSL engine library) that included in this library under internal SSL Client and it takes more stack memory for the whole process.

The last process is about exchanging the signed JWT token with access token to use as authentication bearer in the REST request.

All of this complexity works are hidden under the execution of gSheet.ready().

That is all information you have to know why I told you like that.

Most new Arduino boards come with cryptographic chips (hardware) that are designed for crypto tasks instead of using software SSL engines that require more time and resources.

Even in ESP8266, the default stack memory (4k) is not sufficient for BearSSL signing process to work, but fortunately that the ESP8266 core sdk provides the assembly macro that allows us to use heap as stack.

For SSL data transfer via https that involved crypto tasks and can work in samd board because of this crypto task was done by built-in WiFi module (mostly are ESP32) instead under the control of WiFi library (driver) e.g. WiFiNINA, WiFi101 and WiFi2.

We cannot control the WiFi module on SAMD board to do some cryptographic works unless we make a custom built WiFiNiNA or WiFi101 firmware.

[E2CRE8]

WHoow - thanks for this very extensive answer. Now the problem is clearer to me - this makes sense.
I hope to receive some ESP32 platforms in the next couple of days to test if they work better.

I saw on the Arduino Website that your library also works with the nano 33 iot - https://www.arduino.cc/reference/en/libraries/esp-google-sheet-client/ - but they are clearly mistaken.

As the nano 33 iot is used quite a lot (by students) in Belgium - I was searching if the creation of the JWT token is also possible with the hardware encryption IC of the nano 33 iot (ATECC608A) and I came to this website: https://www.digikey.no/no/articles/an-easier-solution-for-securely-connecting-iot-devices-to-the-cloud

after first reading this info: https://developers.google.com/identity/protocols/oauth2#:~:text=You%20use%20the%20client%20ID,to%20access%20a%20Google%20API.

I hope that you will still have the time to inform me if a link between the nano 33 iot and google spreadsheet is possible (in the future?). I would be happy to send you a nano 33 iot to have a go with it....

looking forward to your answer (and thx again for your time)
Bart

[mobizt]

There are many methods that can generate JWT token using hardware and software crypto which work for Google IoT Core without using much CPU and memory even using software crypto library, but that kind of JWT cannot be used with service account (non-human or non-user account that can access the google services or application account)

From the google doc

Service accounts rely on the RSA SHA-256 algorithm and the JWT token format. As a result, the JSON representation of the header is as follows:

Unfortunately, the chip library supports only ES256 signed algorithm.
https://github.com/MicrochipTech/cryptoauthlib/blob/9a5b711582b3df0ed97fa6147c899eb856c52d34/lib/jwt/atca_jwt.c#L42

[mobizt]

Why we have to use service account?

It is because.

1. We need the auth flows that have the sufficient scopes for Google API Service.
2. It should be suitable for using with just code, no SDK, and no user consent required (no UI needed).

As the Google doc as you referred, only two flows that we can choose.

For limited input devices, such as TV or embedded devices, use the "TVs and Limited Input devices" client type.
For server-to-server interactions, use service accounts.

But the first choice, using device code has very limited scopes and does not support most Google Cloud API and it is not convenient to use as it required user consent by input the code on user mobile device.

Only service account is possible in this case.

The RSA algorithm and the RSA private key from service account required for token signing. Then we need cryptographic that supports this algorithm, which mostly available from SSL library e.g. openssl, BearSSL, WolfSSL, axTLS.

I chose BearSSL SSL engine library as it is ESP8266 built-in SSL library, and it is portable and can be used on other devices that have enough stack memory due to the PKCS#1 encryption calculation process required stack approx. 2k

In addition, there is no RSA256 supports in crypto chip ATECC608A it supports these algorithms e.g.ECC P256 (ECDH and ECDSA), SHA256, AES-GCM

Then Arduino Nano 33 IoT cannot work and use this library unless I modify the library to accept the access token and refresh token from Admin SDK or sdk app for authen and re-authentication.

Note that, the token authentication code used in this library was taken from my other Firebase library project which supports external token authentication which I remove the access token and refresh token authentication feature from this library to reduce the usage complexity.