I’ve been trying to determine how to access Google’s APIs from a desktop application. Specifically I’ve been following the Authorization Code Flow described here: https://developers.google.com/identity/protocols/oauth2/native-app

As the page itself says: Installed apps are distributed to individual devices, and it is assumed that these apps cannot keep secrets.

This being said, Step 4: “Step 4: Handle the OAuth 2.0 server response” describes providing the client secret in order to retrieve the access token. There are several StackOverflow posts that describe that this is a required parameter.

So how does authentication over a native application work? Is it expected that the client secret is provided in the native app itself? This would defeat the purpose of it being a secret, right?

Thanks

I’ve researched different code-flows for accessing user data from a native application with Google. I have also attempted to use the Authorization Code Flow using Google’s SDK for .NET, and receive an error back saying I need to provide a client secret.