Initial setup is long.

[martinmake]

You could probably use PKCE: https://tools.ietf.org/html/rfc7636
Then the user will not have to get and store the secret key and they'll still be able to get a refresh token.
Another plus is that you will get to see usage metrics in your dashboard.

[dbarnett]

Do you know if this still applies if each user needs to set up their own oauth client with its own ID/secrets?

AFAICT it's not a viable option anymore to maintain a single shared client ID everyone can use due to Google's usage limits and security restrictions. In that model the Cloud Console setup has to be manual instructions AFAIK, and the one bit of somewhat annoying copy-paste is copying over client-id/client-secret after creating auth client & token, but I'm not following if PKCE offers a way to streamline just that step.

[dbarnett]

Or maybe gcloud cli has commands to streamline a few of the steps for those who have it installed and authenticated?

[dbarnett]

Closing as infeasible.

If anyone has details on how we could actually use PKCE in practice or other ways to streamline setup, please follow up here or in some other issue.