Hello,
I am troubleshooting a Test-only Google Cloud OAuth setup and would appreciate guidance on the documented configuration requirements for this case:
- OAuth client type: Desktop app.
- App status: External, Testing; a dedicated Test user is allowlisted.
- Requested Drive scope: metadata-only.
- A native macOS browser completes consent and reaches the bare loopback callback successfully.
- The authorization-code exchange sends `client_id`, `code`, `code_verifier`, `grant_type=authorization_code`, and the same `redirect_uri`. It intentionally omits `client_secret`, because the installed-app documentation lists it as optional.
- The token endpoint returns OAuth error `invalid_request`.
No Drive API request, Drive read, watch creation or data write has been made. This is an isolated Test setup using only synthetic fixtures.
What published Desktop OAuth/PKCE configuration condition could cause `invalid_request` after the loopback callback has already succeeded? In particular, does the presence of enabled client secrets in the Cloud Console change any requirement for a Desktop authorization-code exchange where no client secret is sent?
I have intentionally omitted all identifiers and sensitive values. Please let me know which non-sensitive, redacted evidence would be useful.
Thank you.