python，如何在不共享 secret 客户端凭据的情况下编写桌面应用程序？

Question

我正在按照这个例子用 python 编写一个开源应用程序: https://developers.google.com/gmail/api/quickstart/quickstart-python?hl=it

我正确生成了 client_secret.json 并成功运行了该示例。

现在..考虑到我开始编写我的代码并根据谷歌文档:

Warning: Keep your client secret private. If someone obtains your client secret, they could use it to consume your quota, incur charges against your Google APIs Console project, and request access to user data.

那么，我如何(在未来)共享我的应用代码并同时保密 client_secret.json？

Answer 1

好的，我在这里得到了答案:

https://developers.google.com/accounts/docs/OAuth2InstalledApp

This flow is similar to the one shown in the Using OAuth 2.0 for Web Server Applications, but with three differences:

• When creating a client ID, you specify that your application is an Installed application. This results in a different value for the redirect_uri parameter.
• The client ID and client secret obtained from the Developers Console are embedded in the source code of your application. In this context, the client secret is obviously not treated as a secret.
• The authorization code can be returned to your application in the title bar of the browser or to an http ://localhost port in the query string.

换句话说，如果您在 Google API 控制台中创建项目时将其指定为“已安装的应用程序”，则可以安全地将 secret 嵌入代码中