0

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive account. But I was wondering what else could be done to my google drive account, using those OAuth Credentials, like could it also be used for deleting stuff over there.

And Could those credentials be used to gain access to other google services, like gmail, youtube, etc in any way?

And what is the longevity of these OAuth credentials, will they be of any use if password of my id has been changed?

0

Credentials

The credential that allows you to access Google Drive resources for your account is actually the access token you obtain after user-consent. See this documentation listing all the steps to set up OAuth, culminating with obtaining an access token to call APIs.

What can you do with an access token for Drive?

This depends on what OAuth scopes you requested. Your python scripts should have some OAuth scopes encoded in them that allows you to make the API call. You can further use the Google Discovery API to learn which methods can be called for a particular API. For example, file upload is a method.

Longevity of credentials

The access tokens are short lived and typically are valid for an hour. If you obtained a refresh token, you can read this documentation about expiration of long term credentials.

If you would like to keep track of events like password changes and expire your tokens and/or sessions, consider integration with Google's Cross Account Protection APIs to subscribe to account security events.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.