Media-Aggregation-and-Sorting-System/ignorefiles/GOOGLE_OAUTH_SETUP.md

Google OAuth Setup for Android APK

Step 1: Create a Google Cloud Project

1. Go to https://console.cloud.google.com/
2. Click Select a project → New Project
3. Name it and click Create

Step 2: Enable the Photos Library API

1. Go to APIs & Services → Library
2. Search for Photos Library API → Enable it
3. ⚠️ This step is required — without it, all Photos API calls return 403

Step 3: Configure the OAuth Consent Screen

1. Go to APIs & Services → OAuth consent screen
2. Choose External → Create
3. Fill in:
   • App name: MASS Photo App
   • User support email: your email
   • Developer contact: your email
4. Scopes → Add or Remove Scopes → add these:
   • openid
   • https://www.googleapis.com/auth/photoslibrary
   • https://www.googleapis.com/auth/userinfo.email
   • https://www.googleapis.com/auth/userinfo.profile
5. Test users → Add your Google account email address
   • ⚠️ This is critical — if your email is not listed as a test user, Google will silently strip the Photos scope from the granted token, causing a 403 "insufficient authentication scopes" error.

Step 4: Create an Android OAuth Client ID

1. Go to APIs & Services → Credentials
2. + Create Credentials → OAuth client ID
3. Application type: Android
4. Package name: com.bobthebob.massphotoapp
5. SHA-1 certificate fingerprint: get it by running eas credentials --platform android
6. Click Create and copy the Client ID
7. Open src/AUTH/GoogleAUTH.js and set ANDROID_CLIENT_ID to the copied value

How it works

• The Android client ID is used for both the authorization request and the token exchange. Google verifies the request using the app's package name + SHA-1 signing certificate, so no redirect URI registration is needed.
• The redirect goes to com.bobthebob.massphotoapp:/oauthredirect which Android routes back into the app via the intent filter in app.json.
• Android clients are public (no client_secret required). PKCE code_verifier is used to secure the authorization code exchange.

Testing the API with OAuth Playground

1. Go to https://developers.google.com/oauthplayground
2. Click the gear icon → check "Use your own OAuth credentials"
3. You will need a Web application client for the playground only (the playground cannot use Android clients). Create one in the console if needed, add https://developers.google.com/oauthplayground to its redirect URIs.
4. Select Photos Library API scopes and authorize
5. Copy the access token and run: node TEST/testGooglePhotosAPI.js <TOKEN>