# Default OAuth client for local builds.
#
# You do NOT need this file to use grr.
#
# - Release binaries (grr-cli.pages.dev/install, Homebrew) are
# built in CI with a client already compiled in, so `grr auth login`
# works immediately after install.
# - This file only matters when you build grr from source
# (`cargo build --release`, `cargo install`).
#
# `.env` is gitignored. Never commit real credentials.
#
# To get these values, create your own OAuth client — `grr auth setup`
# walks you through it and writes ~/.grr/config.toml for you, which is the
# better option if you are not building from source:
# https://grr-cli.pages.dev/install/
#
# Alternatively set them as environment variables for a single build:
# GRR_CLIENT_ID=... GRR_CLIENT_SECRET=... cargo build --release
# From Google Cloud console -> Google Auth Platform -> Clients.
# Must end in .apps.googleusercontent.com
GRR_CLIENT_ID=
# From the same page. Required by Google's token endpoint even for
# Desktop clients; PKCE alone is not enough.
GRR_CLIENT_SECRET=
# ── Device flow (`grr auth login --device`) ─────────────────────────────
#
# The device flow needs a client of its own: Google's device endpoint
# accepts one application type only — "TVs and Limited Input devices" — and
# answers the Desktop client above with `invalid_client: Invalid client
# type`. Create a second client on the same console page with that type.
#
# Both are optional: without them `--device` refuses with these same
# instructions and the browser flow is unaffected.
#
# Note the flow's ceiling: Google grants a device login drive.file, calendar,
# calendar.readonly, the legacy Calendar/Contacts feeds, userinfo and openid
# only (see DEVICE_FLOW_SCOPES in src/core/auth/device.rs).
GRR_DEVICE_CLIENT_ID=
# The secret shown next to the device-flow client ID.
GRR_DEVICE_CLIENT_SECRET=