Say what is documented about the 7-day token expiry, not what I assumed Google's OAuth page states the expiry applies to Testing projects with an external audience, unless the scopes are a subset of name, email address and profile. The contacts scope falls outside that, so the rule should apply here - but it is not what users actually see, so the note now says both rather than promising a weekly sign-in that does not happen. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Document the web OAuth flow, click by click Rewritten from Marco's page, which walks through the desktop client type that the v5 add-on no longer offers. Differences beyond the client type: - the redirect URI is printed literally. It is derived from the add-on's ID rather than from an installation, so every user pastes the same string. - two scopes rather than three. The add-on requests contacts and userinfo.email; it never asks for userinfo.profile. - the People API is enabled before the scopes are chosen, because the picker only lists scopes for APIs that are already on. - authorized domains are never touched. They only appear if a redirect URI on a real domain is used, which the loopback form avoids. Screenshots carry arrows for what to click, so the prose between them stays short. images/raw holds the unannotated originals and is git ignored: several still show a live client ID, secret or email address. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Initial Home page