Observed Signal · May 16, 2026 · Technical Guidance · Source: DEV Community · Impact: 2/5 · Sentiment: Neutral
Gmail OAuth client_id Is Not a Secret
A dev.to technical note argues that a Gmail OAuth client_id is a public application identifier, not a secret, and that leaking it does not by itself compromise an authorization flow. The author emphasises protecting the real sensitive surfaces: access tokens, client_secret (when used), and the integrity of the authorization exchange. For self-hosted "Actor" deployments the post recommends focusing security efforts on flow integrity via four layers: redirect-URI allowlists, state/anti-CSRF binding, secure token storage and rotation, and strict tenant isolation. The piece warns against spending effort to "hide" client_id and instead advises scope minimization, explicit token lifecycle policies, auditable execution paths, secure defaults, and clear documentation for multi-tenant and open-source projects. Published 2026-05-16.
Practical security guidance on OAuth flows and token handling is useful for developers and architects (including those building identity-related systems in AdTech), but it is not industry-shifting.
Track Gumroad Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- OAuth client_id is a public application identifier and was never intended to be a secret.
- The real sensitive items to protect are access tokens, the client_secret (if used), and the authorization exchange boundary.
- For self-hosted Actor designs, the author recommends four security layers: redirect URI allowlist, state/anti-CSRF, token storage and rotation, and tenant isolation.
- Recommended practices include scope minimization, explicit token lifecycle and revocation, auditable execution paths, secure defaults, and clear documentation.
- The article was published on 2026-05-16.
Connected Companies & Entities
1 Entity mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Refresh-token-only OAuth for multi-tenant Apify Actor
This technical guide explains a simple pattern to let multi-tenant Apify Actors call per-user Google APIs (Gmail, Calendar, Drive) using only a user-provided refresh token plus client_id and client_secret. Buyers generate a long-lived refresh token locally using Google's InstalledApp (Desktop) OAuth flow and paste refresh_token, client_id, and client_secret into the Actor input. At runtime the Actor exchanges the refresh token for a short-lived access token via https://oauth2.googleapis.com/token, calls the API, and exits without storing per-user identities. The post covers Google Cloud setup, token generation code, runtime token exchange, Apify input schema (isSecret masking), and an optional dry_run mode for buyers to preview output without OAuth. Source code and an example Actor are linked on GitHub and apify.com.
OAuth Tunnel Trap: Preventing Subdomain Hijacking
A technical advisory from the InstaTunnel engineering team describes the "OAuth Subdomain Trap": attackers squatting freed ephemeral localhost tunnel subdomains (ngrok, Localtunnel, Cloudflare Tunnels, etc.) to receive OAuth authorization codes that remain whitelisted in identity provider consoles. The post explains attack stages (reconnaissance, subdomain squatting, code interception, token exchange), documents real-world incidents (Microsoft OAuth redirection abuse, JFrog's CVE-2025-6514), and highlights increased risk from AI agents and CI/CD preview environments. Recommended mitigations include using persistent custom subdomains under organizational control, mandating PKCE and strict state validation, enforcing edge (Zero Trust) authentication on tunnels, automating redirect_uri hygiene, and updating mcp-remote to v0.1.16 with HTTPS-only MCP connections.
Deleted Google API Keys Remain Active for 23 Minutes
A security researcher (Joe Leon) found that deleting a Google API key does not immediately invalidate it: due to eventual consistency and cached credential state across Google Cloud's distributed authentication layer, revoked keys can remain valid for up to 23 minutes. Google initially called this expected behavior but later reclassified the issue as a critical P0/S0 bug after public disclosure. The problem is amplified because Google reused the same API key infrastructure for Gemini (LLM) as for lower-risk services like Maps, increasing the blast radius of leaked keys. The article explains implications for incident response, compares propagation/invalidations for AWS and Postmark, and recommends stricter key restrictions, backend proxies for sensitive APIs, credential rotation, explicit session invalidation, billing alerts, and enhanced monitoring after key deletion.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.