[Request] YouTube OAuth 2.0 Authentication

[BullyWiiPlaza]

I would like to request an OAuth 2.0 feature to authenticate for YouTube instead of submitting a username and a password. This is useful for e.g. downloading private videos since they require you to be logged in.

Basically, if the video is private the application should try to authenticate in order to download the video (in case it's the one from your account).

Here are Python code samples for the YouTube API and authentication:
https://developers.google.com/youtube/v3/code_samples/python

[jaimeMF]

It looks like OAuth 2.0 can only be used with the YouTube API v3 which we can't use for downloading videos, so it wouldn't be too useful. Could you confirm that?

Note that two factor authentication should work (look for the --twofactor option).
If you are concerned about you username+password being leaked to us or a third party, you can check the source code and build the youtube-dl exe yourself. We basically just follow the same method used when you login with a browser.

[BullyWiiPlaza]

Yes, you can't use the YouTube API to download videos but you might be able to authenticate and use youtube-dl to download the video with "your means" but I'm not sure if this is even possible.

[jaimeMF]

As far as I know the Oauth is needed so an application can use some features from the API on behalf of the user (private videos, modifying playlists, uploading videos ...), it wouldn't work in the normal YouTube website (which is what we use).

[jaimeMF]

I'm closing the issue because it doesn't seem we could benefit from it. If you find some feature that would need it, feel free to explain it.

[Jw86Ht]

I have a use case for OAuth 2.0 that isn't served by the --password option. I want to download lecture recordings from my university. The videos are stored on YouTube, but are private—they require you to be logged in with your university account (which is also a Google account).

The thing is, I don't want to give my university account password to Google (which is what I assume the --password option does). The university account is used for much more than just watching YouTube videos—the password grants access to all sorts of financial information and academic records. How it works in the browser is: on youtube.com, you click "sign in," and enter your university email address as the username. You then get redirected to auth.university.edu, which is where you enter your password. Some kind of magic happens (presumably OAuth) and then you are redirected back to youtube.com, authenticated. youtube.com never gets to see your password.

Currently I can work around youtube-dl's lack of OAuth 2.0 support by following the example of this gist, which uses cut-and-paste and a few curl commands to interact with accounts.google.com and get a temporary OAuth access token. I then insert the access \token using the --add-header option:

youtube-dl URL --add-header "Authorization:Bearer <access_token>"

It would be nice if I could just download my client_secret.json from the Google Developer's Console and do something like youtube-dl URL --oauth client_secret.json.

[Jw86Ht]

Here is a little helper script that allows you to use youtube-dl with YouTube and OAuth 2.0. It outputs an Authorization header. Use it like this:

youtube-dl URL --add-header "$(python2 youtube-oauth2.py ~/client_secrets.json ~/credentials.json)"

The first time you run it, it will print a URL to open in a browser and wait for you to paste in a code. The second and later times, it doesn't require interaction.

#!/usr/bin/env python2

import getopt
import httplib2
import oauth2client.client
import oauth2client.file
import os.path
import sys

def usage(f=sys.stdout):
    f.write("""\
Usage: %(program_name)s client_secrets.json credentials.json

The output of this program is an "Authorization" HTTP header that you
can provide to youtube-dl. Use it like this:
    youtube-dl https://www.youtube.com/watch?v=... --add-header "$(%(program_name)s ~/client_secrets.json ~/credentials.json)"

client_secrets.json must already exist. credentials.json is where to
store cached/refreshed credentials; it will be created if it doesn't
already exist. The first time you run it, it will ask you to open a web
browser to a specific URL and paste in a code. After that, your access
token will be cached in credentials.json.

To get client_secrets.json:
 * Go to https://console.cloud.google.com/apis/library/youtube.googleapis.com/
   and enable the "YouTube Data API v3" API. (You may be asked to create a
   project first.)
 * Go to https://console.cloud.google.com/apis/credentials and click "Create
   credentials", "OAuth client ID", with type "Other".
 * Under the "OAuth 2.0 client IDs" heading, click the download button.
""" % {"program_name": sys.argv[0]})

opts, args = getopt.gnu_getopt(sys.argv[1:], "h", ["help"])
for o, _ in opts:
    if o in ("-h", "--help"):
        usage()
        sys.exit()
try:
    client_secrets_filename, storage_filename = args
except ValueError:
    usage(sys.stderr)
    sys.exit(1)

http = httplib2.Http()
credentials = None
storage = oauth2client.file.Storage(storage_filename)
if os.path.exists(storage_filename):
    credentials = storage.get()
if credentials is None or credentials.invalid:
    flow = oauth2client.client.flow_from_clientsecrets(
        client_secrets_filename,
        redirect_uri="urn:ietf:wg:oauth:2.0:oob",
        scope="https://www.googleapis.com/auth/youtube",
    )
    authorize_url = flow.step1_get_authorize_url()
    print >> sys.stderr, "Open this URL in a browser, sign in, and paste the code."
    print >> sys.stderr, flow.step1_get_authorize_url()
    print >> sys.stderr, "code: ",
    code = raw_input().strip()
    credentials = flow.step2_exchange(code, http=http)
    storage.put(credentials)
    credentials.set_store(storage)
# get_access_token calls refresh if needed.
print("Authorization: Bearer " + credentials.get_access_token(http).access_token)

The process can be made a little more automatic: rather than asking the user to paste a code, you can have the OAuth server redirect to a local webserver and issue a request that contains the code. That's what the oauth2client.tools.run_flow function does. I didn't use it in the script because it writes to stdout and interferes with the Authorization output.

The pypi page for oauth2client says it is deprecated, and recommends using google-auth or oauthlib instead.

Beware that the helper script issues its own HTTP requests (in flow.step2_exchange and credentials.get_access_token), and will bypass any --proxy youtube-dl may be using.