3 ms·
I’m not sure about how this is happening. Transmit is a desktop app - or does it have a cloud hosted component? If it’s a desktop app, it should be possible to
by alanfranz 2y ago
I’m not sure about how this is happening. Transmit is a desktop app - or does it have a cloud hosted component?
If it’s a desktop app, it should be possible to generate an api key and pass it to the desktop app, that’s it. Google doesn’t know or care about who’s using it at that point.
The security flow being discussed should impact cloud-hosted applications.
What am I missing?
- StewardMcOy 2y agoYou're not missing anything, it's just that > Google doesn’t know or care about who’s using it at that point is incorrect. Google Drive uses OAuth. Users don't register API keys, apps do, and then users just log in with their Google account. Google now requires apps to go through manual approval to actually use their OAuth keys, if those apps request certain endpoints. Doesn't matter if the app is local or cloud-hosted, if it makes certain REST requests, it needs special access, and Google controls which API keys get that special access. See https://developers.google.com/drive/api/guides/api-specific-auth https://developers.google.com/drive/api/guides/api-specific-...