[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-05 UTC。"],[],[],null,["# Cloud Storage OAuth 2.0 scopes\n\nMost of the operations you perform in Cloud Storage must be\nauthenticated. The only exceptions are operations on resources that allow\nanonymous access. A resource has anonymous access if the `allUsers` group is\nincluded in the ACL for the resource or if the `allUsers` group is included in\nan IAM policy that applies to the resource. The `allUsers` group\nincludes anyone on the Internet.\n\nAuthorization is the process of determining what permissions an authenticated\nidentity has on a set of specified resources. OAuth 2.0 uses *scopes* to\ndetermine if an authenticated identity is authorized. Applications use a\ncredential (obtained from a user-centric or server-centric authentication flow)\ntogether with one or more scopes to request an access token from a Google\nauthorization server to access protected resources. For example, application A\nwith an access token with `read-only` scope can only read, while application B\nwith an access token with `read-write` scope can read and modify data. Neither\napplication can read or modify access control lists on objects and buckets;\nonly an application with `full-control` scope can do so."]]
