Passing OAuth Client ID directly to react-google-login will expose our credentials

[AminRafaey]

Hello everyone,
Using OAuth 2.0 Client ID directly in the client-side will not expose our credentials? Anyone can go into the console of browser and after getting this id can use it for getting data from google on our behalf

[ljharb]

Yes, you can’t do oauth from a browser securely.

This isn’t an npm-related question; please close it.

[ThisIsMissEm]

@AminRafaey indeed, you'll want to use a different OAuth 2.0 grant type for browser-based applications, commonly recommended now is the PKCE flow.

But this isn't an npm issue, so shouldn't be here on the npm RFCs discussion board. You can likely find more answers on stackoverflow.