I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive account. But I was wondering what else could be done to my google drive account, using those OAuth Credentials, like could it also be used for deleting stuff over there.

And Could those credentials be used to gain access to other google services, like gmail, youtube, etc in any way?

And what is the longevity of these OAuth credentials, will they be of any use if password of my id has been changed?

  • Someone asked a similiar questions few weeks back. Here's a link to my answer regarding potential risks involved with Google's OAuth Short answer is : little to no risk. The power accorded is contained to each single API/website. – I'm a TI calculator Sep 29 '19 at 12:29
  • @I'maTIcalculator if you think the question can be answered with the same answer, you could also suggest that other question as a duplicate. – schroeder Sep 29 '19 at 12:38
  • @schroeder please forgive my noobness, new to this. Where do i find the button to mark as duplicate? And what are the scopes of what's considered "duplicate", if my answer helps for both questions but not all answers will be valid for both? – I'm a TI calculator Sep 29 '19 at 13:10
  • 1
    @I'maTIcalculator It's in the "close" reasons. Yes, there will of course be questions that might be answered the same way but are not duplicates, but in that case, you need to flesh out your answer in both. That way if something happens to the non-dupe, then the answer here survives. – schroeder Sep 29 '19 at 13:23


The credential that allows you to access Google Drive resources for your account is actually the access token you obtain after user-consent. See this documentation listing all the steps to set up OAuth, culminating with obtaining an access token to call APIs.

What can you do with an access token for Drive?

This depends on what OAuth scopes you requested. Your python scripts should have some OAuth scopes encoded in them that allows you to make the API call. You can further use the Google Discovery API to learn which methods can be called for a particular API. For example, file upload is a method.

Longevity of credentials

The access tokens are short lived and typically are valid for an hour. If you obtained a refresh token, you can read this documentation about expiration of long term credentials.

If you would like to keep track of events like password changes and expire your tokens and/or sessions, consider integration with Google's Cross Account Protection APIs to subscribe to account security events.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.