secrets/auth_flow.md

🔐 Google MCP Auth Flow Summary

• credentials.json → App credentials (downloaded once from Google Cloud Console).
• token.json → User-specific OAuth token (auto-created on first run).

---

⚙️ When & How It Happens

1. At MCP startup:
   The script loads credentials.json (OAuth client info).
2. If no valid token.json:
   • Browser-based OAuth flow starts.
   • You log in and grant access.
   • A new token.json is saved locally.
3. On later runs:
   • The MCP reads the existing token.json.
   • Automatically refreshes it if expired.
   • No browser prompt needed.

---

🚫 Git Hygiene

• ❌ Never commit token.json to Git.
• 👤 Each developer generates their own token.
• 🖥️ For servers or CI → use a service account instead.