randogoth/CalCalist
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document publishing the Google consent screen to production

Browse source 
The console's OAuth consent screen has moved to Google Auth Platform, so the
setup steps named pages that no longer exist. The seven-day refresh token
expiry note said only "publish to production", which is the hard part: that
needs an authorized domain you own and public homepage and privacy policy URLs
on it, and a token issued under Testing keeps its old expiry until you log in
again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
randogoth 2026-09-14 17:32:15 +03:00
parent 22d6a1dc3f
commit d8166b053b
1 changed files with 21 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

26
README.md
View file

@ -162,15 +162,15 @@ sources = ["gcal", "holidays"]
default_sink = "gcal"
```
# Authorising Google
## Authorising Google
Google requires an OAuth client of your own. This is the fiddliest part of the setup, so in full:
Google requires an OAuth client of your own. This is the fiddliest part of the setup, so in full. Google has also renamed this corner of the console: what older guides call the **OAuth consent screen** is now **Google Auth Platform**, and the old menu entry redirects there.
1. At [console.cloud.google.com](https://console.cloud.google.com), create a
project — any name.
2. **APIs & Services → Library**, find **Google Calendar API**, enable it.
3. **OAuth consent screen**: choose **External**. Fill in the required fields. Under **Test users**, add your own Google address.
4. **Credentials → Create credentials → OAuth client ID**, and for **Application type** choose **Desktop app**.
3. **APIs & Services → OAuth consent screen** and choose **External**. On **Branding**, fill in **App name**, **User support email**, and **Email addresses** under **Developer contact information** — the last sits below the fold and is the one usually left blank. On **Audience**, add your own Google address under **Test users**.
4. **Clients → Create client**, and for **Application type** choose **Desktop app**.
5. Copy the client ID into `client_id`, and put the client secret somewhere `client_secret_command` can read it:
```sh
@ -187,8 +187,24 @@ Google requires an OAuth client of your own. This is the fiddliest part of the s
**One login covers every endpoint on that account.** The authorisation is filed under the account it was granted for, not the endpoint that asked, so a second Google calendar on the same account needs no login of its own. Set `account` on an endpoint only when CalCalist is logged in to more than one account.
## Ending the seven-day expiry
**While the consent screen is in Testing, Google expires refresh tokens after seven days.** An installation that worked last week then stops with nothing
having changed locally. Publish the consent screen to production to end this; `calcalist doctor` reports it either way.
having changed locally; `calcalist doctor` names the endpoint when it happens. Moving the app to production ends it — Testing is the only status the rule
applies to, and verification is not needed.
Production asks for more than Testing did, which is why the **Publish app** button starts out greyed:
1. On **Branding**, **Authorized domains → Add domain** with a domain you own. Add it before the URLs below, which are validated against it.
2. **Application home page** and **Application privacy policy link**, both URLs on that domain. Google fetches them, so they must be public. [PRIVACY.md](PRIVACY.md) is CalCalist's own, accurate for any installation, and a reasonable starting point for yours.
3. **Audience → Publish app**. Reload the page first if the button is still greyed; it caches.
A banner then says the app requires verification. It can be ignored. Verification removes the unverified-app warning and the 100-user cap, neither of which
matters for a client only you use — and it wants a domain review and a demo video in exchange. At the next login the browser shows **"Google hasn't verified
this app"**: click **Advanced**, then **Go to … (unsafe)**.
**Log in again after publishing.** A refresh token issued while the app was in Testing keeps its seven-day life; publishing does not extend one already
granted.
## Getting events to the right calendar