My first version would work fully in the browser but the access token (an OAuth2 authorization protocol thing) would expire after 1 hour which required the user to login again, which is not a good experience.
To make it more seamless I had to implement 2 backend endpoints:
one to convert code received from Google after login to access token and refresh token
second to refresh expired access token using refresh token
Before every API call in the browser I now check if access token expired. If it did, I ask my backend to get a new access token.
It took several hours not because it’s a lot of code but because the docs are terrible and I was getting mysterious errors from Google servers. Thank god for the internet because how else could I possibly figure out that postmessage is a magic value for redirect_url
to fix redirect_uri_mismatch error.
Used https://www.termsfeed.com to generate basic privacy policy. Google wants that to enable Google Drive API.