Install
Acting as the project
A secret key bypasses your access rules. Keep it in an environment variable and never send it to a browser.Acting for one user
When your server handles a request from a signed-in user, pass their token so your access rules apply to them exactly as they would in the browser.accessToken set, the client keeps no session of its own and does not refresh, so make one per request.
A script that signs in
For a script that runs as a particular user, sign in once; the session stays in memory for the life of the process.Keys and security
Which key goes where.
Python
The same in Python.