This really should be a new topic....

I do it using two functions that I shamelessly appropriated from somewhere (Edit: here, actually). The first runs when the spreadsheett is opened, and it handles all of the security stuff:

function onOpen() {


  // Read OAuth consumer key / secret of this client app from script properties, 
  // which can be issued from Salesforce's remote access setting in advance.
  
  // Keys need to be set once, then can be commented out.
  //ScriptProperties.setProperty('sfConsumerKey','<your key>');
  //ScriptProperties.setProperty('sfConsumerSecret','<your secret>');
  

  var sfConsumerKey = ScriptProperties.getProperty("sfConsumerKey");
  var sfConsumerSecret = ScriptProperties.getProperty("sfConsumerSecret");

 
  if (!sfConsumerKey || !sfConsumerSecret) {
    Browser.msgBox("Register Salesforce OAuth Consumer Key and Secret in Script Properties");
    return;
  }

  // Register new OAuth service, named "salesforce"
  // For OAuth endpoint information, see help doc in Salesforce.
  // https://na7.salesforce.com/help/doc/en/remoteaccess_oauth_1_flows.htm
  var oauth = UrlFetchApp.addOAuthService("salesforce");
  oauth.setAccessTokenUrl("https://login.salesforce.com/_nc_external/system/security/oauth/AccessTokenHandler");
  oauth.setRequestTokenUrl("https://login.salesforce.com/_nc_external/system/security/oauth/RequestTokenHandler");
  oauth.setAuthorizationUrl("https://login.salesforce.com/setup/secur/RemoteAccessAuthorizationPage.apexp?oauth_consumer_key="+encodeURIComponent(sfConsumerKey));
  oauth.setConsumerKey(sfConsumerKey);
  oauth.setConsumerSecret(sfConsumerSecret);

  // Convert OAuth1 access token to Salesforce sessionId (mostly equivalent to OAuth2 access token)
  var sessionLoginUrl = "https://login.salesforce.com/services/OAuth/u/21.0";
  var options = {
    method : "POST", 
    oAuthServiceName : "salesforce", 
    oAuthUseToken : "always" 
  };
  var result = UrlFetchApp.fetch(sessionLoginUrl, options);
  var txt = result.getContentText();
  var accessToken = txt.match(/<sessionId>([^<]+)/)[1];
  var serverUrl = txt.match(/<serverUrl>([^<]+)/)[1];
  var instanceUrl = serverUrl.match(/^https?:\/\/[^\/]+/)[0];
  ScriptProperties.setProperty('accessToken',accessToken);
  ScriptProperties.setProperty('serverUrl',serverUrl);
  ScriptProperties.setProperty('instanceUrl',instanceUrl);
    
};

 The second function is invoked by the user and in this case reads some SalesForce data and populates the spreadsheet with it:

function GetProjectData() {
  var accessToken = ScriptProperties.getProperty("accessToken");
  var serverUrl = ScriptProperties.getProperty("serverUrl");
  var instanceUrl = ScriptProperties.getProperty("instanceUrl");

  if (!accessToken || !serverUrl || !instanceUrl) {
    Browser.msgBox("Reload spreadsheet to refresh authorization");
    return;
  }
  
  // Get open projects.
  var fields = "Id,Name,Opportunity__r.Id,Opportunity__r.Name,Opportunity__r.Account.Name,Opportunity__r.MEPOL_Task_Number__c"; 
  var soql = "SELECT "+fields+" FROM Line_Item__c where Opportunity__r.stagename='Project Open' order by Opportunity__r.Account.Name,Opportunity__r.Name,Name";
  var queryUrl = instanceUrl + "/services/data/v21.0/query?q="+encodeURIComponent(soql);
  var options = {
    method : "GET",
    headers : { "Authorization" : "OAuth "+accessToken }
  };
  var response = UrlFetchApp.fetch(queryUrl, options);
  var queryResult = Utilities.jsonParse(response.getContentText());

  // Clear and set up destination page
  var sheet = SpreadsheetApp.getActiveSpreadsheet().getSheetByName("OpenProjects");
  sheet.clear();
  sheet.setFrozenRows(1);
  var cell = sheet.getRange('a1');

  // Populate project data
  queryResult.records.forEach(function(record, i) {
    cell.offset(i+1, 0).setValue(record["Opportunity__r"].Account.Name + ": " + record["Opportunity__r"].Name);
    cell.offset(i+1, 1).setValue("  --" + record["Opportunity__r"].MEPOL_Task_Number__c + " " +record["Name"]);
    cell.offset(i+1, 2).setValue(record["Id"]);
    cell.offset(i+1, 3).setValue(record["Opportunity__r"].Id);
    cell.offset(i+1, 4).setValue(record["Opportunity__r"].Account.Name + ": " + record["Opportunity__r"].Name);
  });

  // Get users
  var fields = "Id,Name,IsActive";
  var soql = "SELECT "+fields+" FROM User order by Name";
  var queryUrl = instanceUrl + "/services/data/v21.0/query?q="+encodeURIComponent(soql);
  var options = {
    method : "GET",
    headers : { "Authorization" : "OAuth "+accessToken }
  };
  var response = UrlFetchApp.fetch(queryUrl, options);
  var queryResult = Utilities.jsonParse(response.getContentText());

  // Populate user data
  queryResult.records.forEach(function(record, i) {
    cell.offset(i+1, 7).setValue(record["Name"]);
    cell.offset(i+1, 8).setValue(record["Id"]);
  });

}

 If you're like me, you'll spend a fair amount of time dealing with missing or incoherent error messages before you get it to work. I actually test my SOQL queries in a PHP script first - I think there's also a script explorer tool out there somewhere for that purpose.