When working with Google APIs, you’ll need a client_secret.json file to authenticate your Google account. This article walks you through creating a Client Secret in Google Cloud step by step: creating a project, configuring the OAuth consent screen, creating an OAuth Client ID, and downloading the Client Secret JSON file. It’s written mainly for people who use Google APIs, so it skips the app review steps that application developers go through. By the end, you’ll be ready to use Python libraries like google-auth, google-api-python-client or simple-drive smoothly.
What is Client Secret?
A Client Secret is a unique, random string of characters that is generated when you register an application (also known as a client) to access Google Cloud Platform (GCP) services. This string of characters acts as a “security key,” authenticating your application to Google, ensuring that only your application can access authorized resources. Each Client Secret comes paired with its own OAuth Client ID.
Why is Client Secret important?
- Security: Client Secret protects your account and data from unauthorized access.
- Authentication: It’s an essential part of OAuth 2.0 authentication, making sure your application is identified securely.
- Access Management: Use Client Secrets to control your application’s access to Google Cloud resources.
When is Client Secret needed?
- Using APIs: Whenever an application calls Google Cloud APIs to perform operations such as reading, writing, or deleting data, the Client Secret authenticates the request.
- OAuth 2.0 flow: The Client Secret is the secure key that lets users grant your application access to their Google accounts.
Create Client Secret
Step 1: Create a Project on Google Cloud. Go to console.cloud.google.com/projectcreate to create a new Project.
Step 2: Go to the OAuth consent screen page. You need to configure the OAuth consent screen before creating a Client Secret.
Note: The screenshots in this article show the 2024 interface. Since 2025, Google has moved the OAuth consent screen into Google Auth Platform (10/2026). In the new interface, go to Menu > Google Auth Platform > Branding and click Get started. The wizard walks you through App Information (app name, support email), Audience (Internal or External), Contact Information, and Finish. After that, scopes live under Data Access, test users under Audience, and OAuth client IDs under Clients. The information you fill in is the same as in the steps below.
Step 3: Select User Type. Based on the description below, select the User Type that suits your purpose. For example, if you use it with Python for personal purposes, select External.
- External: If you only use Google APIs for personal purposes (no review required) or are developing a public application (review required).
- Internal: If you’re developing an app for a company using Google Workspace. No review is required.
Step 4: Fill in the essential information for the application. Since the app doesn’t need to be reviewed, you only need to fill in the required information (marked with an asterisk).
- App name: Any name.
- User support email: Enter your email.
- Developer contact information: Enter your email.
Leave the rest blank. It’s only needed when you submit a public application for review.
Step 5: Select Scopes for your application. Click the ADD OR REMOVE SCOPES button (new interface: Data Access section) to add the API permissions you need. For example, if you want to use Google Drive API in Python, search for “Google Drive API” and check each permission you need. Even for personal use, I’d recommend selecting only the scopes you actually need: if your token file ever leaks, broader scopes mean bigger damage.
Developers of public apps have to submit sensitive scopes for review. Individuals and organizations using Google Workspace don’t need to.
I’ve gone through the review process for a few web applications. Here’s what I learned, in case it helps.
- Fill in all the information completely.
- Select only the scopes you really need.
- Describe why you need each permission and how users will use the application, in as much detail as possible.
- Prepare a video showing how users use that permission.
- Prepare a test account in the app for the Google review team.
- If everything checks out, it gets approved. If not, you have to resubmit with a more detailed description and video.
- Reviewing a scope takes from one to several weeks, but you can have multiple scopes reviewed at the same time.
Step 6: Add the emails allowed to use the app in testing mode (new interface: Audience section, Test users, click Add users). This step matters for personal use, because apps that haven’t gone through public review can only be used in testing mode.
Step 7: Complete the OAuth consent screen configuration. Review the information and return to the dashboard.
Step 8: Create Client Secret via OAuth client ID. Go to Credentials, click the CREATE CREDENTIALS button, and select OAuth client ID (new interface: open the Clients section of Google Auth Platform and click Create client).
Step 9: Select the Application type and enter a name for the client ID. Here are the supported types.
Types for personal Google API usage:
- Desktop app: The simple choice for using Google APIs. For example, you’re creating a Client Secret to use with Python libraries.
- Web application: Choose this if your application asks you to fill in Authorized JavaScript origins and Authorized redirect URIs. For example, some website plugins require this type and will tell you what to enter.
Types for application developers: The types above plus the following.
- Android.
- Chrome Extension.
- iOS.
- TVs and Limited Input devices.
- Universal Windows Platform (UWP).
Step 10: Download the Client Secret JSON file. Click the DOWNLOAD JSON button to download.
Enable API for the project
Having a Client Secret isn’t enough on its own: you also need to enable each API you plan to use in the project. If you skip this, your code will fail with a 403 error saying something like “API has not been used in project … or it is disabled”.
Step 1: Open the API Library. In Google Cloud Console, make sure the project you just created is selected, then go to APIs & Services > Library.
Step 2: Find the API you need. Type its name in the search box, for example “Google Drive API”, and click the matching result.
Step 3: Enable the API. Click Enable and wait a few seconds. Repeat for every API you plan to use.
If you’d like screenshots for each step, see the section on how to enable the API in Google Cloud in my Service Account article.
Security notes for Client Secret
- Do not store Client Secret in public source code: Avoid committing Client Secret to a public repository (like GitHub) if using a version control system.
- Use environment variables or secret configuration files: Store the Client Secret in an environment variable or .env file for added security.
- Rotate your Client Secret: If the Client Secret is exposed or at risk, generate a new one and update the application configuration.
Conclusion
That’s how you create a Client Secret and configure the OAuth consent screen in Google Cloud for personal Google API use, or for organizations on Google Workspace. Remember to keep your Client Secret private to avoid data risks. Now you’re ready to put Google Cloud services to work in your own projects. If you get stuck at any step, leave a comment below.
