rich-message | : moneybag : Turn a plain message into a rich HTML message | Chat library

If you use a payload for a given integration, the text of the response will be ignored. You'll need to add your message with the attribute text to the facebook payload for it to be surfaced in Facebook messenger. For example:

The answer you referenced had an update posted on October 25th indicating they had taken action to prevent you from entering in a google.com endpoint as your auth provider for Account Linking. It seems possible that they may have taken other actions to prevent using Google's auth servers in this way.

If you're using your own auth server, the error 500 would indicate an error on your oauth server, and you should check your oauth server for errors.

Update to answer some of your other questions.

But don't know how to implement an oauth endpoint

Google provides guidance (but not code) on what you need to do for a minimal OAuth service, either using the Implicit Flow or the Authorization Code Flow, and how to test it.

whether it should be a separate cloud function or it has to be included within the existing one

It should be separate - it is even arguable that it must be separate. In both the Implicit Flow and the Authorization Code Flow, you need to provide a URL endpoint where users will be redirected to log into your service. For the Authorization Code Flow, you'll also need an additional webhook that the Assistant will use to exchange tokens.

The function behind these needs to be very very different than what you're doing for the Dialogflow webhook. While someone could probably make a single function that handles all of the different tasks - there is no need to. You'll be providing the OAuth URLs separately.

However, your Dialogflow webhook does have some relationship with your OAuth server. In particular, the tokens that the OAuth server hands to the Assistant will be handed back to the Dialogflow webhook, so Dialogflow needs some way to get the user's information based on that token. There are many ways to do this, but to list just a few:

• The token could be a JWT and contain the user information as claims in the body. The Dialogflow webhook should use the public key to verify the token is valid and needs to know the format of the claims.

• The OAuth server and the Dialogflow webhook could use a shared account database, and the OAuth server store the token as a key to the user account and delete expired keys. The Dialogflow webhook could then use the token it gets as a key to look up the user.

• The OAuth server might have a(nother) webhook where Dialogflow could request user information, passing the key as an Authorization header and getting a reply. (This is what Google does, for example.)

The exact solutions depends on your needs and what resources you have available to you.

And also I am so confused with how oauth authorization code flow will actually work.. Let's assume we are on the Assistant app, once the user say "talk to foo app", does it automatically opens a web browser for oauth code exchange process?

Broadly speaking - yes. The details vary (and can change), but don't get too fixated on the details.

If you're using the Assistant on a speaker, you'll be prompted to open the Home app which should be showing a card saying what Action wants permission. Clicking on the card will open a browser or webview to the Actions website to begin the flow.

If you're using the Assistant on a mobile device, it prompts you directly and then opens a browser or webview to the Actions website to begin the flow.

The auth flow basically involves:

• Having the user authenticate themselves, if necessary.
• Having the user authorize the Assistant to access your resources on the user's behalf.
• It then redirects to Google's servers with a one-time code.
• Google's servers then take the code... and close the window. That's the extent of what the user's see.

Behind the scenes, Google takes this code and, since you're using the Authorization Code Flow, exchanges it for an auth token and a refresh token at the token exchange URL.

Then, whenever the user uses your Action, it will send an auth token along with the rest of the request to your server.

Plz suggest the necessary package for OAuth2 configuration

That I can't do. For starters - it completely depends on your other resources and requirements. (And this is why StackOverflow doesn't like people asking for suggestions like this.)

There are packages out there (you can search for them) that let you setup an OAuth2 server. I'm sure someone out there provides OAuth-as-a-service, although I don't know any offhand. Finally, as noted above, you can write a minimal OAuth2 server using the guidance from Google.

Trying to create a proxy for Google's OAuth is... probably possible... not as easy as it first seems... likely not as secure as anyone would be happy with... and possibly (but not necessarily, IANAL) a violation of Google's Terms of Service.

can't we store the user's email address by this approach?

Well, you can store whatever you want in the user's account. But this is the user's account for your Action.

You can, for example, access Google APIs on behalf of your user to get their email address or whatever else they have authorized you to do with Google. The user account that you have will likely store the OAuth tokens that you use to access Google's server. But you should logically think of that as separate from the code that the Assistant uses to access your server.

Using the Dialogflow integration, the response JSON your webhook should return for a rich response will look like:

Generally webhook responses can deliver any custom payload to most platforms that API.AI supports, so any feature supported by Facebook Messenger, Skype, Google Assistant, etc. can be utilized through API.AI. Unfortunately Facebook doesn't seem to support hyperlinked text. The closest analog I could find is a what Facebook calls a URL Button. Below is an example of how you could create a API.AI response that has a Facebook URL Button with Facebook's Button template: