It wild that this process is still so challenging. There's got to be some safe streamlined way that sets up an app identity you own that can only use to access your own account.
My guess is that organizationally within Google, the developer app authorization process must have many teams involved in its implementation and many other outside stakeholders. A single unified team wouldn't responsible for this confusion and complexity. I get why... it's a huge source of bad actors. But there's got to be a better way.
It’s a very different experience than AWS though and takes some getting used to.
Google Workspace API(s) keys and Roles was always confusing to me at so many levels .. and they just seem to keeping topping that confusion, no one is addressing the core (honestly not sure if that is even possible at this point)
Access blocked: [app name] is not approved by Advanced Protection. Error 400: policy_enforcedJust being able to send commands to my Nest thermostat (which I own, and is on the same LAN) involved creating a cloud account, a "project" (wtf is a project, I just want an API key damnit, this isn't JIRA), a billing account, enabling billing, enabling the billing account, creating another account somewhere else on some other Google site, doing through mountains of 2FA issues in the process where I had to tap "Yes" on another device instead of the device I was actually using, enabling the project in the other account, installing it, publishing it, paying $5 somewhere in between and I didn't understand exactly for what, ...
Why the hell can't I set my temperature with a simple "curl" command to the thermostat's LAN IP? At the most with a simple "Authentication: Bearer" header?
getting the authentication to work is a real pain and it's basically preventing people access to an otherwise really good and useful MCP
Imagine a marketing person trying to set it up...