What is the usage of the client_secrets.json file?

Question

I am working on writing a program using the Google Tasks API in Python. I have downloaded and run the sample application from Google, and it comes with a file called client_secrets.json. I understand that the file is used for OAuth authentication, but my question is should I distribute this file to users? Should I push it to my public source repo? Or is it supposed to be kept secret? If I shouldn't share it, how would other users do the authentication?

Thanks for reading.

Answer 1

The Google API Client Library OAuth2 docs states,

Keep your client secret private. If someone obtains your client secret, they could use it to consume your quota, incur charges against your Developers Console project, and request access to user data.

So don't commit or otherwise distribute the file.

If you want to publicly share your application source code, instruct others to use their own Google Developer account to register their own Google Developer project and generate their own app OAuth credentials (client_secrets.json file) for use with their "installation" of the app.

If you were making the application commercially available, you would seemingly need to share the app credentials with them in a trusted, legally protected, or secure manner.