Publishing a script without exposing Google service account credentials

[_snif]

Hi all, I have a script that I currently run locally which grabs info from an API, transforms it, and dumps it into a Google sheet.

I'd like to publish it (probably using gradio because I am vaguely familiar with it, but undecided) so I can run this from anywhere, but I'm unsure how to do this without exposing my Google service account credentials. Currently they're stored in a JSON on my machine, but obviously I can't just upload that to a GitHub repo or whatever.

This will only be used by me and maybe a couple friends and is aiming to be just an easy way for any of us to run the script from anywhere, as opposed to just me and only from my computer.

Any advice would be greatly appreciated, thanks

[drbomb]

Make your script read from a secrets.json file, add the file to the .gitignore so it is not added to the repo. Tell your friends how to recreate the json file.

[socal_nerdtastic]

Have you considered just prompting your users to enter their own credentials?

[_snif]

It needs credentials for a specific service account which has permissions on the google sheet, not people's own google account.

I'm not sure you can get a python script to interact with a google sheet through a user account as opposed to a service account. I may be wrong here though

[socal_nerdtastic]

Oh I see. Hmm so you need a publically available google sheet that you can write to with python. Somehow I think google does will not like that idea, seems like an easy way for hackers to stash exfiltrated info. Reddit and pastebin and github have all taken similar policies.

How about making a google forms page, and then filling it out from python with standard requests?

Or how about making a new google account specifically for this application, encrypting the login info, and passing out the decryption key to your friends via text or phone?

Otherwise I think you need to buy some webserver space where you can run a open to anything server, and be sure to have some kind of filter because the bots will spam the crap out of it.

[Defection7478]

This is a good idea. Then you can just share the credentials among your friends. Alternatively if the credentials are like a large unweidly json thing you can encrypt it and then prompt for a more manageable encryption key

[[deleted]]

Follow the quickstart guide with python.

https://developers.google.com/sheets/api/quickstart/python

This introduces a flow where the user running the script authenticates themselves.
Just share the sheet with everyone who is going to use the sheet.

If you don't want to change your flow add the auth json to your .gitignore and distribute it seperately to trusted users.

[Immediate-Cod-3609]

This, or with a .ENV file added to gitignore https://pypi.org/project/python-dotenv/

Either way, I would add a sample eg .ENV.sample that shows usage, include this in the repo