OAuth Proxy for Google

A tiny Cloudflare Worker that brokers Google OAuth token exchanges, so a browser extension can use an authorization-code + PKCE flow without shipping its client secret. Built for The Marvellous Suspender's Google Drive backup on Brave and Vivaldi, and generic enough to fork for your own extension.

GitHub Source Documentation

Stars

Forks

Open issues

Release

// Key Features

01 //
Secret off the client.
The OAuth client secret lives in a Cloudflare secret, never inside the extension package.
02 //
Refresh tokens, no browser tricks.
Handles the authorization-code + PKCE grant and every refresh-token renewal, for browsers where getAuthToken() doesn't work.
03 //
Pass-through by design.
Adds the client credentials, forwards the request to Google and returns the response unchanged. No storage, and no logging of request or response bodies.
04 //
Fork and deploy.
Nothing is TMS-specific beyond its config: set your client ID, extension origin and secret, then deploy on the Cloudflare Workers free tier.

// Security model

The Worker keeps the client secret off users' machines, nothing more. Google remains the real security boundary: without a valid code or refresh token issued for this OAuth client, every request is rejected. The Origin check is a soft filter, not access control.

Authorization codes and tokens do pass through the Worker while an exchange is in flight, so it has to be trusted not to keep them. The source is public so you can check that it doesn't, or run your own. It never sees your Google Drive data.

The Marvellous Codeworks instance only serves The Marvellous Suspender. For your own extension, deploy your own.