Signing in
ViewTitle never sees your Google password. You approve it on Google's own screen, and the app keeps only the token that comes back.
The sign-in uses OAuth 2.0 with PKCE, which means the request that starts the login and the request that finishes it have to prove they are the same request.
You click the button. Nothing has been asked of Google yet.
GET /login
/login — Flask
Builds the OAuth flow, generates a fresh PKCE code_verifier, and stashes
it in the Flask session next to the state value before redirecting.
Session holds
code_verifier
Redirect to
Google
Google consent screen
Google's page, not ours. You pick an account and approve the
youtube.force-ssl scope, then Google sends the browser back with a
one-time authorization code.
One-time
code
/oauth2callback
Rebuilds the flow with the same code_verifier pulled back out of
the session, then trades the code for an access token and a refresh token.
invalid_grant: Missing code verifier.
Store the
credentials
SQLite — users
Credentials.to_json() is written to the users.credentials
column, keyed by the Google sub. That row is the only thing the
background job needs later — no password, ever.
Same verifier, or no token The session is the only thing tying the two halves of the login together.