The Google APIs Client Library for Python uses the
client_secrets.json file format for storing the
client_id, client_secret, and other OAuth 2.0 parameters.
The client_secrets.json file format is a JSON formatted file containing the client ID, client secret, and other OAuth 2.0 parameters. Here is an example client_secrets.json file for a web application:
{ "web": { "client_id": "asdfjasdljfasdkjf", "client_secret": "1912308409123890", "redirect_uris": ["https://www.example.com/oauth2callback"], "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://accounts.google.com/o/oauth2/token" } }
Here is an example client_secrets.json file for an installed application:
{ "installed": { "client_id": "837647042410-75ifg...usercontent.com", "client_secret":"asdlkfjaskd", "redirect_uris": ["http://localhost", "urn:ietf:wg:oauth:2.0:oob"], "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://accounts.google.com/o/oauth2/token" } }
The format defines one of two client ID types:
web: Web application.installed: Installed application.
The web and installed sub-objects have the following mandatory members:
-
client_id(string): The client ID. -
client_secret(string): The client secret. -
redirect_uris(list of strings): A list of valid redirection endpoint URIs. This list should match the list entered for the client ID on the API Access pane of the Google APIs Console. -
auth_uri(string): The authorization server endpoint URI. -
token_uri(string): The token server endpoint URI.
All of the above members are mandatory. The following optional parameters may appear:
-
client_email(string) The service account email associated with the client. -
auth_provider_x509_cert_url(string) The URL of the public x509 certificate, used to verify the signature on JWTs, such as ID tokens, signed by the authentication provider. -
client_x509_cert_url(string) The URL of the public x509 certificate, used to verify JWTs signed by the client.
The following examples show how use a client_secrets.json file
to create a Flow object in either an installed application
or a web application:
<pre class="prettyprint"><div class="devsite-code-button-wrapper"><div class="devsite-code-button gc-analytics-event material-icons devsite-dark-code-button" data-category="Site-Wide Custom Events" data-label="Dark Code Toggle" track-type="exampleCode" track-name="darkCodeToggle" tabindex="0" role="button" data-tooltip-align="b,c" data-tooltip="Dark code theme" aria-label="Dark code theme" data-title="Dark code theme"></div><div class="devsite-code-button gc-analytics-event material-icons devsite-click-to-copy-button" data-category="Site-Wide Custom Events" data-label="Click To Copy" track-type="exampleCode" track-name="clickToCopy" tabindex="0" role="button" data-tooltip-align="b,c" data-tooltip="Click to copy" aria-label="Click to copy" data-title="Click to copy"></div></div><span class="kwd">from</span><span class="pln"> google_auth_oauthlib</span><span class="pun">.</span><span class="pln">flow </span><span class="kwd">import</span><span class="pln"> </span><span class="typ">InstalledAppFlow</span><span class="pln"><br></span><span class="pun">...</span><span class="pln"><br>flow </span><span class="pun">=</span><span class="pln"> </span><span class="typ">InstalledAppFlow</span><span class="pun">.</span><span class="pln">from_client_secrets_file</span><span class="pun">(</span><span class="pln"><br> </span><span class="str">'</span><em><span class="str">path_to_directory</span></em><span class="str">/client_secret.json'</span><span class="pun">,</span><span class="pln"><br> scopes</span><span class="pun">=[</span><span class="str">'https://www.googleapis.com/auth/calendar'</span><span class="pun">])</span></pre>
</article><article>
<pre class="prettyprint"><div class="devsite-code-button-wrapper"><div class="devsite-code-button gc-analytics-event material-icons devsite-dark-code-button" data-category="Site-Wide Custom Events" data-label="Dark Code Toggle" track-type="exampleCode" track-name="darkCodeToggle" tabindex="0" role="button" data-tooltip-align="b,c" data-tooltip="Dark code theme" aria-label="Dark code theme" data-title="Dark code theme"></div><div class="devsite-code-button gc-analytics-event material-icons devsite-click-to-copy-button" data-category="Site-Wide Custom Events" data-label="Click To Copy" track-type="exampleCode" track-name="clickToCopy" tabindex="0" role="button" data-tooltip-align="b,c" data-tooltip="Click to copy" aria-label="Click to copy" data-title="Click to copy"></div></div><span class="kwd">import</span><span class="pln"> google</span><span class="pun">.</span><span class="pln">oauth2</span><span class="pun">.</span><span class="pln">credentials<br></span><span class="kwd">import</span><span class="pln"> google_auth_oauthlib</span><span class="pun">.</span><span class="pln">flow<br><br>flow </span><span class="pun">=</span><span class="pln"> google_auth_oauthlib</span><span class="pun">.</span><span class="pln">flow</span><span class="pun">.</span><span class="typ">Flow</span><span class="pun">.</span><span class="pln">from_client_secrets_file</span><span class="pun">(</span><span class="pln"><br> </span><span class="str">'</span><em><span class="str">path_to_directory</span></em><span class="str">/client_secret.json'</span><span class="pun">,</span><span class="pln"><br> scopes</span><span class="pun">=[</span><span class="str">'https://www.googleapis.com/auth/calendar'</span><span class="pun">])</span><span class="pln"><br><br>flow</span><span class="pun">.</span><span class="pln">redirect_uri </span><span class="pun">=</span><span class="pln"> </span><span class="str">'https://www.example.com/oauth2callback'</span></pre>
</article></section>
Motivation
Traditionally providers of OAuth endpoints have relied upon cut-and-paste as the way users of their service move the client id and secret from a registration page into working code. That can be error prone, along with it being an incomplete picture of all the information that is needed to get OAuth 2.0 working, which requires knowing all the endpoints and configuring a Redirect Endpoint. If service providers start providing a downloadable client_secrets.json file for client information and client libraries start consuming client_secrets.json then a large amount of friction in implementing OAuth 2.0 can be reduced.
Activity
docs: Adds docs folder. Fixes googleapis#669 Fixes googleapis#670 Fixes
grant commentedon Jun 26, 2019
The docs are now added to the
docs/folder.Fixed with #706.
davidsansome commentedon Aug 13, 2020
The docstrings in
flow.pyandhelpers.pystill link to https://developers.google.com/api-client-library/python/auth/aaa_client_secrets and need to be updated to point to docs/client-secrets.md