When using a custom build, fork, or integration of Chromium, or if you’re building ChromiumOS, you will need access to Google API for key functionality.
[TOC]
*** note Note: Software distribution with keys acquired for yourself is allowed, but the keys themselves cannot be shared with parties outside the legal entity that accepted the API ToS. Keep in mind that a number of the APIs will have no or very limited quota and not all of the APIs have additional quota available for purchase.
Googlers only:
How-to: First, acquire API keys. Then, specify the API keys to use either when you build Chromium, or at runtime using environment variables.
Open the APIs and Services > Library from the hamburger menu, search for all of the following APIs. For each of these APIs:
Enable API
button at the topI have read and agree to the <API name> Terms of Service
checkboxList of APIs (if any are not shown, recheck step 1 above):
Go to the Credentials sub tab under the API & Services section in the hamburger menu.
Click the Create credentials
button then click on the OAuth client
ID item in the drop-down list.
Configure consent screen
button. Fill in the «product
name» (anything you choose) and other details, then click on Save
.Add credentials
button
again, then select «OAuth 2.0 client ID» from the drop-down list.Create
.In the pop-up window that appears, you’ll see a client ID and a Client
secret string. Copy and paste those in a text file on your dev box then
click OK
to dismiss. A new item should now appear in the OAuth 2.0 client
IDs list. You can click on the name of your client ID to retrieve the ID and
secret at any time. In the next few sections, these values will be referred
to as the Client ID and Client secret fields.
Click the Create credentials
button again on the same page.
API key
button.OK
to dismiss.You should now have an API key and an OAuth 2.0 client ID in the Credentials tab. The next sections will refer to the value as the «API key».
*** note Note: Your keys are not for distribution, and should not be shared with others.
If you are building Chromium yourself, you can provide keys as part of your build configuration, that way they are always baked into your binary.
Specify three variables in your args.gn
file (edit by running gn args
out/your_out_dir_here
)
google_api_key = "your_api_key"
google_default_client_id = "your_client_id"
google_default_client_secret = "your_client_secret"
If you prefer, you can build a Chromium binary (or use a pre-built Chromium
binary) without API keys baked in, and instead provide them at runtime. To do
so, set the environment variables GOOGLE_API_KEY
, GOOGLE_DEFAULT_CLIENT_ID
and GOOGLE_DEFAULT_CLIENT_SECRET
to your «API key», «Client ID» and «Client
secret» values respectively.
On Chromium OS to specify the keys as environment variables append them to the
end of /etc/chrome_dev.conf
:
GOOGLE_API_KEY=your_api_key
GOOGLE_DEFAULT_CLIENT_ID=your_client_id
GOOGLE_DEFAULT_CLIENT_SECRET=your_client_secret
Signing in to Chromium requires an OAuth 2.0 token for authentication. As this OAuth 2.0 token gives access to various Google services that handle user data (e.g. Chrome sync), for security and privacy reasons the generation of this OAuth 2.0 token is restricted. This means that signing in to Chromium is restricted (as the OAuth 2.0 token cannot be generated). In order to sign in to Chromium builds, please add your test account to google-browser-signin-testaccounts@chromium.org (accounts in this group are allowed to get access tokens bypassing the restriction above).
*** note
Note: Starting with Chromium M69, when the browser is set up with an OAuth
2.0 client ID and client secret, signing in with your Google Account to any
Google web property will also attempt to sign you in to Chromium (which will
fail as explained above). To avoid such errors, remove your OAuth 2.0 client
ID and client secret from your build to stop generating tokens when users sign
in to Google web properties (remove google_default_client_id
,
google_default_client_secret
from gn args and GOOGLE_DEFAULT_CLIENT_ID
and GOOGLE_DEFAULT_CLIENT_SECRET
from your environment settings).
Many of the Google APIs used by Chrome are specific to Google and not intended for use in derived products. In the API Console you may be able to purchase additional quota for some of the APIs listed above. For APIs that do not have a «Pricing» link, additional quota is not available for purchase.
The default Chromium chrome.identity.getAuthToken
API that extensions may
call to obtain auth tokens will fail outside of Google Chrome as the
implementation uses restricted APIs.
A prototype CL for Chromium embedders might use to replace the implementation with one not dependent upon private APIs can be found attached to this post.