Image CDN Google Drive Credentials

Generating Google Credentials for the Image CDN

The image CDN Cloudflare Worker authenticates with the Google Drive API using OAuth 2.0. It needs three secrets:

Secret	Purpose
IMAGE_CDN_GOOGLE_CLIENT_ID	Identifies your Google Cloud OAuth application
IMAGE_CDN_GOOGLE_CLIENT_SECRET	Authenticates your Google Cloud OAuth application
IMAGE_CDN_GOOGLE_REFRESH_TOKEN	Long-lived token used to obtain short-lived access tokens at runtime

At runtime, the worker exchanges the refresh token + client credentials for a short-lived access token, then uses that token to query Google Drive file metadata (drive/v3/files/{id}) and to detect stale cached thumbnails.

---

Step 1 — Create a Google Cloud project

1. Go to Google Cloud Console.
2. Create a new project (or select an existing one).
3. In the left sidebar, navigate to APIs & Services → Library.
4. Search for Google Drive API and enable it.

---

Step 2 — Create OAuth 2.0 credentials

1. Navigate to APIs & Services → Credentials.
2. Click Create Credentials → OAuth client ID.
3. If prompted, configure the OAuth consent screen first:
   • Set User type to External (or Internal if using a Google Workspace org).
   • Fill in the required app name and contact fields.
   • Add the scope https://www.googleapis.com/auth/drive.metadata.readonly.
   • Add your Google account as a test user.
4. Back on the Create OAuth client ID page:
   • Set Application type to Web application.
   • Under Authorised redirect URIs, add https://developers.google.com/oauthplayground.
5. Click Create.
6. Copy the Client ID and Client Secret — these become IMAGE_CDN_GOOGLE_CLIENT_ID and IMAGE_CDN_GOOGLE_CLIENT_SECRET.

---

Step 3 — Generate a refresh token via OAuth Playground

1. Open Google OAuth 2.0 Playground.
2. Click the gear icon (⚙️) in the top-right corner and check Use your own OAuth credentials.
3. Enter your OAuth Client ID and OAuth Client Secret from Step 2.
4. In the left panel under Step 1, find Drive API v3 and select the scope:

   https://www.googleapis.com/auth/drive.metadata.readonly
   

5. Click Authorise APIs and sign in with the Google account that owns (or has access to) the Drive files the CDN will serve.
6. Check Auto-refresh the token before it expires.
7. After authorisation, you will be on Step 2. Click Exchange authorisation code for tokens.
8. The response will contain a refresh_token field. Copy its value — this becomes IMAGE_CDN_GOOGLE_REFRESH_TOKEN.

Note: The refresh token is only shown once. If you lose it, repeat Step 3 to generate a new one.

---

Step 4 — Set the secrets in GitHub (preferred)

Add the three values as repository secrets (used by the CI/CD deployment workflow):

Secret name	Value
IMAGE_CDN_GOOGLE_CLIENT_ID	Client ID from Step 2
IMAGE_CDN_GOOGLE_CLIENT_SECRET	Client Secret from Step 2
IMAGE_CDN_GOOGLE_REFRESH_TOKEN	Refresh token from Step 3

Go to your repository → Settings → Secrets and variables → Actions → New repository secret to add each one.

---

Step 5 — Set the secrets in Cloudflare (manual deployments)

If deploying the worker manually with Wrangler, set the secrets directly on the worker:

wrangler secret put GOOGLE_CLIENT_ID
wrangler secret put GOOGLE_CLIENT_SECRET
wrangler secret put GOOGLE_REFRESH_TOKEN