I am building a plugin that will need to access the administrator's analytics account and pull some data on regular intervals, using the WP-Cron mechanism.

I have looked at the instructions for authorizing the analytics API version 4. My plan is to let the administrator do OAuth2 authorization with Google offline access. The user will verify their account and get back a token that can be copy-pasted into the plugin for API access. The plugin can then refresh the token for a new one as needed.

I have chosen the Web Server flow as the most appropriate in this use case.

I have been looking at the code for Google Analytics by MonsterInsights and they seem to be doing the same thing. But they need to include the client id and secret key for their app with the source code.

Isn't it a problem to include the client private key with the source code? Is there some better practice I need to be following?

Any info greatly appreciated.

Edit: See these quotes from https://developers.google.com/identity/protocols/OAuth2WebServer

We recommend that you design your app's auth endpoints so that your application does not expose authorization codes to other resources on the page.


Important: Do not store the client_secrets.json file in a publicly-accessible location. In addition, if you share the source code to your application—for example, on GitHub—store the client_secrets.json file outside of your source tree to avoid inadvertently sharing your client credentials.

  • You could save the private Key into an wordpress option... Sep 8, 2017 at 10:10
  • To be clear, the user token will be saved as an option. But to make the OAuth2 flow work I also need to identify the application (my plugin) to the google infrastructure. This requires the private key for the application to be available to the source code. Again, this is what MonsterInsights do and they seem to know what they're doing, my question is whether this is indeed correct security-wise, or if there's a better way to do authentication altogether.
    – alexg
    Sep 8, 2017 at 10:18
  • An alternative would be to send the user to the developer console and instruct them to create some new API credentials, then they could download the JSON file with the keys and import it into the plugin, but it seems like a lot of steps to ask the user to do.
    – alexg
    Sep 8, 2017 at 11:09

1 Answer 1


Answering my own question:

I reviewed another well-known plugin, Google Analytics, which provides both approaches to the user: The user can either:

  1. Use the plugin's client id and secret key to request an authorization code with offline access. The user pastes the code into a text field and the plugin proceeds to request an access token.

  2. Go to the developer console, create a new project, copy-paste the client id and secret from the developer console into the plugin, then proceed with authorization.

I ended up implementing the first approach only. It seems the most appropriate for novice users.

I am still unsure as to whether publishing the client secret is an issue, but what I know is that at least two major WordPress plugins do it already...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.