gcalcli: App is blocked by Google

Steps, loosely following comment https://github.com/insanum/gcalcli/issues/497#issuecomment-592948891

1. Google Developers Console https://console.developers.google.com

• create a new project, e.g., gcalcli

2. + Enable APIs and Services"

• enable Google Calendar API
• go back to project gcalcli in Developers Console

3. Credentials section in left menu

• + Create Credentials > OAuth client ID
• Application type Desktop App
• name gcalcli
• The credentials produced here are needed in step 5

4. OAuth consent screen section in left menu

• I was restricted to choose External users
• OAuth consent screen
  • App name: e.g., gcalcli
  • User support email: e.g., put your own gmail address
  • App domain: leave all blank
  • Developer contact information: put your own gmail address
• Scopes: choose all calendar API related stuff plus more if necessary - I did trial and error here …
• Test users: again I put my own gmail address here
• Summary: click “Back to dashboard” at bottom
• leave Publishing status as Testing so your own gcalcli is not published to the world

5. call gcalcli from command line

• Use credentials from step 3 in shell command, e.g. for Google agenda view: gcalcli --client_id "your client ID ending in ...apps.googleusercontent.com" --client_secret "your client secret" agenda
• as my default browser is Firefox I had to copy the URL after Your browser has been opened to visit: (shown in shell after above command) and open it in chromium > follow steps and give permissions to gcalcli
• in shell, Google calendar agenda is shown 🎉
• to facilitate the command line call from above to just gcalcli agenda, create a file ~/.gcalclirc with

    --client_id=clientidfromstep3....apps.googleusercontent.com
    --client_secret=clientsecretfromstep3

SO easy! 😂

Update 1: Chromium or Firefox?

With gcalcli v4.0.0a3 from the Linux Mint/Ubuntu repos, the Google website confirmation only works in Chromium. The pip-installed version gcalcli v4.3.0 makes the Google website confirmation process possible in Firefox.

Update 2: --client_id or --client-id?

The above steps worked well with gcalcli v4.0.0a3 from the Linux Mint/Ubuntu repos. However, gcalcli v4.3.0 installed with pip warns:

WARNING: --client_id has been deprecated and will be removed in a future release.
Please use "--client-id", instead.
WARNING: --client_secret has been deprecated and will be removed in a future release.
Please use "--client-secret", instead.gcalcli v4.3.0

If this appears, change the call parameters accordingly in shell command and if applicable in ~/.gcalclirc.

Update 3: upgrade six

When running into error AttributeError: module 'six.moves' has no attribute 'collections_abc' then make sure to upgrade six to the latest version, e.g., by pip3 install --upgrade six.

I tried this guide for creating the client id and client secret and it worked flawlessly. I didn’t even have to run “DisplayUnlockCaptcha” nor enable Less Secure Apps.

https://github.com/aristosv/google_auth

I think the readme of this project should state a bit more clearly that you may have to do a 5+ step guide to authorize this app. Currently, it implies that only OAuth2 will be needed and anything else is optional.

Same issue. I’m trying to read my schedule from my work account, where I can’t change any of the above settings.

I’ve made some modifications in a fork using newer auth methods. Download a creds.json & put it in ~/.config/gcalcli/ - details in the update README.

I’m not providing support, but you can see if it works for you (it works for me).

Be warned this is a quick 30 minute hack, I suggest creating a virtualenv and installing it in there. Also it used my existing ~/.gcalcli_oauth file (not sure why currently) so I moved it to start a new auth flow.

I suggest inspecting the diffs, no guarantees this won’t wipe all your appointments!

https://github.com/jamespo/gcalcli

Additional information… (At 11:26)

I’ve been using gcalcli for about a week. I had authorized it to access one of my two Google accounts (my personal account) following the steps in the documentation. It was an awkward process, but I somewhat understand the complexities of working with Google’s security.

After using gcalcli for about a week, today I tried to use it to access the calendar belonging to my other Google account (my account in my employer’s enterprise). In Google Calendar, long ago I gave each of my Google accounts mutual access to their calendars. I tried to use the gcalcli authorization for my personal account to add an event to my work account. At first, I got the following stack trace…

Traceback (most recent call last):
  File "/Users/lsloan/homebrew/bin/gcalcli", line 33, in <module>
    sys.exit(load_entry_point('gcalcli==4.3.0', 'console_scripts', 'gcalcli')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/gcalcli/cli.py", line 181, in main
    gcal.QuickAddEvent(
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/gcalcli/gcal.py", line 1294, in QuickAddEvent
    new_event = self._retry_with_backoff(
                ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/gcalcli/gcal.py", line 112, in _retry_with_backoff
    return method.execute()
           ^^^^^^^^^^^^^^^^
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/googleapiclient/_helpers.py", line 130, in positional_wrapper
    return wrapped(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/googleapiclient/http.py", line 923, in execute
    resp, content = _retry_request(
                    ^^^^^^^^^^^^^^^
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/googleapiclient/http.py", line 191, in _retry_request
    resp, content = http.request(uri, method, *args, **kwargs)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/oauth2client/transport.py", line 186, in new_request
    credentials._refresh(orig_request_method)
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/oauth2client/client.py", line 761, in _refresh
    self._do_refresh_request(http)
  File "/Users/lsloan/homebrew/Cellar/gcalcli/4.3.0_3/libexec/lib/python3.11/site-packages/oauth2client/client.py", line 819, in _do_refresh_request
    raise HttpAccessTokenRefreshError(error_msg, status=resp.status)
oauth2client.client.HttpAccessTokenRefreshError: invalid_grant: Token has been expired or revoked.

Thinking that it might be a temporary problem, I tried again. This time, gcalcli opened the following address in a web browser…

https://accounts.google.com/o/oauth2/v2/auth?client_id=«REDACTED».apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcalendar&access_type=offline&response_type=code

In the Google page that opened, I selected my account name when prompted. The next page showed me the familiar message others have mentioned…

This app is blocked
This app tried to access sensitive info in your Google Account. To keep your account safe, Google blocked this access.

I’m not certain whether this was caused by my token being expired/revoked as mentioned in the first error message or maybe it was triggered by trying to access my work account calendar from my personal account.

Update 1

(Added at 12:09)

I went through all the auth. steps in README again. I created a completely new project in my personal account with new OAuth2 consent screen and client ID. gcalcli goes through the auth and shows me the output of the list command. Not wanting to cause any problems by accessing my work account from my personal account, I tried to add an event to my personal account. I still get the same blocked error message.

I wonder whether I need to add scopes to the Calendar API settings in my project.

Update 2

(Added at 14:10)

I have it working again. I changed a couple of things. First, I added all the GCal scopes to the OAuth consent screen of my new project. That didn’t make any difference. I can use the list command, but I get errors with the quick command. Then I had the idea that maybe gcalcli itself is referring to the old project.

So I deleted the gcalcli support files (rm ~/.gcalcli_*). Then I used the list command from the README with the auth settings. That was successful. I could get a calendar listing. Next, when I tried to use quick to create an event in my personal calendar, it worked.

Finally, I tried using my personal account to access the calendar of my work account, to which access has been granted. This time, it worked! 🎉

In conclusion, I’m not sure why access via the first project I set up stopped working. It seems that access between my two accounts doesn’t have any effect on the auth. It does seem that gcalcli holds on to past auth data longer than it should.

Just chiming in here that yes, the problem is still blocking simple usage of gcalcli, but on the other hand, the complicated process above does still work when applied with some flexibility. Google keeps changing the dashboards of the relevant API management, so it’s hard to feel confident that you are doing the right thing. 😃 Thank you, @AurisNoctis

Your best bet is to follow the steps here to get your own API keys: https://github.com/insanum/gcalcli#login-information

Though I have a problem with that where it keeps logging me out and making me re-authenticate every week or so. I may need to get it verified for it to stick.