Authentication method using JSON credentials file(s) for local use

[Dyl-M]

Hello,

I'd like to suggest or at least discuss the authentication method for using the Client class. Whether on the method presented on the documentation side or on the method presented among the examples. Maybe I'm missing something, maybe not. In any case, I'd rather open this Issue to get an answer.

Initially, I found myself in a similar position to Issue #146, bogged down and annoyed by the need to use a web browser to check the identifiers entered as the Client class attributes (client_id and client_secret) using the get_authorize_url method. It's a manual step that I'd like to avoid, as I'm working on a project where processing has to be done autonomously. Or at least, if I have to do a manual check, I'd like to do it just once.

This led me to Issue #125, which provides a decent answer to the problem, but without adding any feature to the library, it seems (and if not, I'd be glad to have your solution).

So I came up with an approach already used on one of my current projects, but integrating the Client class to be able to use all its methods afterwards.

The main goal is to turn the Client ID for Desktop JSON file (that I call oauth.json) ...

{
  "installed": {
    "client_id": "PROJECT_CLIENT_ID",
    "project_id": "youtube-release-tracker",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://oauth2.googleapis.com/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_secret": "PROJECT_CLIENT_SECRET",
    "redirect_uris": [
      "http://localhost"
    ]
  }
}

Into a credentials JSON file credentials.json (or Python dictionary-ish object) :

{
    "token": "GENERATED_TOKEN",
    "refresh_token": "GENERATED_REFRESH_TOKEN",
    "token_uri": "https://oauth2.googleapis.com/token",
    "client_id": "PROJECT_CLIENT_ID",
    "client_secret": "PROJECT_CLIENT_SECRET",
    "scopes": [
        "https://www.googleapis.com/auth/youtube",
        "https://www.googleapis.com/auth/youtube.force-ssl"
    ],
    "universe_domain": "googleapis.com",
    "expiry": "EXPIRATION_TIMESTAMP"
}

This second contains now all elements necessary to build the Client

• token ➡️ access_token
• refresh_token
• client_id
• client_secret

In fact, token / access_token could be the only element necessary to achieve the authentification step (as explained in Issue #125), but I would add the rest of them to the class for informational purposes. Knowing this, I was able to come up with a solution using several Google authentication libraries and other methods from built-in Python librairies.

import ast
import json
import os
import pyyoutube as pyt
import sys

from google.auth.transport.requests import Request
from google.oauth2.credentials import Credentials
from google_auth_oauthlib.flow import InstalledAppFlow

def create_service():
    """Create a GCP service for YouTube API V3.
    Mostly inspired by this: https://learndataanalysis.org/google-py-file-source-code/
    :return service: pyt.Client class to interact with YouTube API elements
    """
    oauth_file = '../tokens/oauth.json'  # OAUTH 2.0 ID path
    scopes = ['https://www.googleapis.com/auth/youtube', 'https://www.googleapis.com/auth/youtube.force-ssl']
    instance_fail_message = 'Failed to create service instance for YouTube'
    cred = None

    if os.path.exists('../tokens/credentials.json'):
        cred = Credentials.from_authorized_user_file('../tokens/credentials.json')  # Retrieve credentials

    if not cred or not cred.valid:  # Cover outdated or non-existant credentials
        if cred and cred.expired and cred.refresh_token:
            cred.refresh(Request())

        else:
            # Create the authentification Flow from 'oauth_file' and then run authentication process
            flow = InstalledAppFlow.from_client_secrets_file(oauth_file, scopes)
            cred = flow.run_local_server()

        with open('../tokens/credentials.json', 'w') as cred_file:  # Save credentials as a JSON file
            json.dump(ast.literal_eval(cred.to_json()), cred_file, ensure_ascii=False, indent=4)

    try:
        service = pyt.Client(client_id=cred.client_id, client_secret=cred.client_secret, access_token=cred.token)
        print('YouTube service created successfully.')

        return service

    except Exception as error:
        print(f'{error}: {instance_fail_message}')
        sys.exit()

The create_service function covers 2 scenarios :

• The Credentials JSON file exists and can be used for authentication
• The Credentials JSON file does not exist or is outdated
  • We can try to refresh the credentials, with refresh method
  • Or we need to generate it from the OAuth JSON file, using InstalledAppFlow class and run_local_server method.
  • In both cases, the new version of the credentials will be stored as the new Credentials JSON for further calls.

After that, we can fill in the elements needed to generate our Client object (or not, i.e. return an error if something is wrong regarding any elements in OAuth or Credentials files / object).

I've drawn heavily on a method I saw a long time ago, developed and explained by Jie Jenn (@DataSolveProblems) here. And I reused this methodology in another project, with adaptations for local use and with a few tweaks for use with GitHub Actions workflows.

I'd be happy to get feedback on this, even if it's just to say that my method isn't optimal. 🙃