I've almost completed a Blender Add-on that allows a user to upload a video to Youtube. It has just come to my attention that embedding your app's credentials from the
client_secrets.json file into an open source application violates the Google TOS
Asking developers to make reasonable efforts to keep their private keys private and not embed them in open source projects.
The reason behind this according to an inside source is to prevent impersonating a trusted app by using its credentials.
You are, however, allowing them to “impersonate” you in Google’s eyes. [...] Moreover, you’ve been granted whitelisted access to APIs that are not available to the general public (and, in all likelihood required agreeing to a separate Terms of Service) and are sharing access to anyone who wants it. There is no doubt that is a violation of those terms.
I feel that "APIs that are not available to the general public" isn't quite true since I could make a new account just for this in 3 minutes.
There is an existing python program
youtube-upload that is included in pip and it ships with a
client_secrets.json. This makes me question how seriously this is enforced.
Looking at some larger OSS projects LibreOffice and OpenShot both ask the user for a username and password to authenticate. While that works for them, no one including myself would trust a small-time application with their login info.
The "official" answer seems to be to require the end user to create a
client_secrets.json file themselves. While I think the average Blender user would be capable/tolerant of handling that, how would less technically oriented applications do it?
I'm leaning towards initially prompting for a username and password with the option of using OAuth if they want to create and download a
I have continued to research this and was looking into logging in a user with a username and password. That functionality was called ClientLogin and was removed from the Youtube API in 2012. OpenShot's Youtube upload does not work for me when I tried it as it used ClientLogin.
So is there a way to ship an open source application that uses the Youtube API without the need for a user to generate an API key? That seems like an unreasonable step for an average user.