[Python] How can I securly add Client_secret to my code when authenticating a serverless...

I'm trying to make a desktop app (without a server) with python that allows the user to do some automation in google sheets.

I'm having trouble in managing the Client_secret file provided by google's Oauth, I have tried using "InstalledAppFlow" and "PKCE" and both of them required the secret file.

From my understanding this file is not supposed to be distributed to other users for security, but after reading:

https://developers.google.com/identity/protocols/oauth2

"The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)"

And:

https://github.com/googlesamples/oauth-apps-for-windows/tree/master/OAuthDesktopApp

I am not sure how to handle the file, is it safe to distribute the secret file? and if so, should I:

1. 
   Use the client secret text like:
   
   clientSecret = "3f6NggMbPtrmIBpgx-MK2xXK"
   
   "Like the one from github"
   
   
2. 
   or should I use the file and if so where to store it if it matters
   
   
3. 
   also can I use InstalledAppFlow instead of PKCE, I think it is easier to code
   

Ps: I also tried using a service account but after some research I learned that it is not suitable for use with external users since all of them would be interacting with the sheet using my sevice email which is not safe nor practical.

I'll be very thankful if someone can help me understand this better!

Continue reading...