# Client Secrets

The Google APIs client library for .NET uses
`client_secrets.json` files for storing the
`client_id`, `client_secret`, and other OAuth 2.0 parameters.

A `client_secrets.json`
file is a [JSON](http://www.json.org/) formatted file
containing the client ID, client secret, and other OAuth 2.0 parameters.
Here is an example `client_secrets.json` file for a web application:

```
{
  "web": {
    "client_id": "asdfjasdljfasdkjf",
    "client_secret": "1912308409123890",
    "redirect_uris": ["https://www.example.com/oauth2callback"],
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://accounts.google.com/o/oauth2/token"
  }
}
```


Here is an example `client_secrets.json` file for an installed application:

```
{
  "installed": {
    "client_id": "837647042410-75ifg...usercontent.com",
    "client_secret":"asdlkfjaskd",
    "redirect_uris": ["http://localhost"],
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://accounts.google.com/o/oauth2/token"
  }
}
```


The format defines one of two client ID types:

- `web`: Web application.
- `installed`: Installed application.


The `web` and `installed` sub-objects have
the following mandatory members:

- `client_id` (string): The client ID.
- `client_secret` (string): The client secret.


All the other members of this file are optional and
the .NET client library doesn't use them.

## Motivation


Traditionally, providers of OAuth 2.0 endpoints have expected
those who use their services to copy and paste the client ID
and client secret from a registration page into working code.
This method is error-prone and gives an incomplete picture
of the information that is needed to get OAuth 2.0 working.
(OAuth 2.0 also requires knowing all the endpoints,
and configuring a redirect URI.)

If service providers provide downloadable `client_secrets.json`
files, and client libraries are prepared to consume these files,
then implementing OAuth 2.0 will be easier and less prone to error.