對話動作已於 2023 年 6 月 13 日淘汰。詳情請參閱「
對話動作已淘汰」。
隱私權與安全性的最佳做法
透過集合功能整理內容 你可以依據偏好儲存及分類內容。
以下是開發人員在專案中使用 Google Assistant API 時應遵守的安全性和隱私權規範。
API 和應用程式授權
凡是使用 Google 助理 API 的應用程式，都必須具備可讓 Google 的驗證伺服器識別該應用程式的授權憑證。一般來說，這些憑證會儲存在下載的 client_secret_<client-id>.json 檔案中。請務必將這個檔案儲存在只有應用程式可存取的位置。
您的應用程式可能會提示使用者授予 Google 帳戶存取權。如果授予權限，應用程式就能為該使用者要求存取權杖。這些權杖會過期，但可以重新整理。
裝置上未受保護的更新權杖會帶來重大的安全性風險。請確保應用程式符合以下條件：
- 將更新權杖儲存在安全的地方。
- 可讓您輕鬆從裝置中清除權杖。例如，提供可清除權杖 (如果應用程式有 UI 的話) 或指令列指令碼的「登出」按鈕，讓使用者可以執行的指令列指令碼。
- 告知使用者，他們可以取消授予 Google 帳戶的存取權。這麼做會撤銷更新權杖；如要再次使用應用程式，使用者必須重新授權存取權。
永久使用裝置後，建議您清除裝置上的所有權杖。
如要瞭解詳情，請參閱使用 OAuth 2.0 存取 Google API。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-26 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-26 (世界標準時間)。"],[[["\u003cp\u003eApplications using the Google Assistant API require authorization credentials, typically stored in a \u003ccode\u003eclient_secret_<client-id>.json\u003c/code\u003e file, which should be kept secure.\u003c/p\u003e\n"],["\u003cp\u003eUser granted access allows applications to request access tokens that expire but can be refreshed; however, unprotected refresh tokens pose a security risk and should be stored securely with options for users to clear them.\u003c/p\u003e\n"],["\u003cp\u003eDevelopers should inform users about the ability to deauthorize access to their Google account through Google's permissions page, which revokes the refresh token and requires re-authorization for further application use.\u003c/p\u003e\n"]]],["Applications using the Google Assistant API require authorization credentials, typically stored in a `client_secret` file, which should be securely stored. Applications may obtain user-specific access tokens, which can be refreshed. Refresh tokens must be securely stored, and applications should allow users to clear them, such as through a \"Sign out\" feature or a command line. Users should be informed that they can deauthorize application access, and all tokens should be cleared when a device is no longer used.\n"],null,["Here are some security and privacy guidelines for developers using the Google\nAssistant API in their projects.\n\nAPI and application authorization\n\nAny application that uses the Google Assistant API must have authorization\ncredentials that identify the application to Google's authentication server.\nTypically, these credentials are stored in a downloaded `client_secret_\u003cclient-id\u003e.json`\nfile. Make sure to store this file in a location that only your application\ncan access.\n\nYour application may prompt the user to grant it access to their Google account.\nIf granted, your application can request an access token for that user. These\ntokens expire, but can be refreshed.\n\nUnprotected refresh tokens on a device pose a significant security risk. Make\nsure your application:\n\n- Stores the refresh tokens in a secure place.\n- Provides an easy way to clear tokens from the device. For example, provide a \"Sign out\" button that clears a token (if the application has a UI) or a command line script that the user can execute.\n- Informs users that they can [deauthorize access](https://myaccount.google.com/permissions) to their Google account. This revokes the refresh token; to use the application again, the user would need to re-authorize access.\n\nWhen you are done using the device permanently, you should clear all of the\ntokens from it.\n\nFor more information, see [Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/OAuth2)."]]
