Context

I'm building a React application that needs to interact with Google Calendar API to create events automatically. Currently using OAuth2 which requires user interaction, but I need this to work automatically without any user input.

Requirements

• Need to create calendar events programmatically
• No user interaction should be required
• Events should be created in a specific Google Calendar
• Running in a React/Vite application

What I've Tried

1. OAuth2 client implementation:

export class CalendarService {
    constructor() {
        this.oauth2Client = new google.auth.OAuth2(
            config.GOOGLE_CLIENT_ID,
            config.GOOGLE_CLIENT_SECRET,
            'http://localhost:5173'
        );

        this.calendar = google.calendar({ 
            version: 'v3', 
            auth: this.oauth2Client 
        });
    }

    getAuthUrl() {
        return this.oauth2Client.generateAuthUrl({
            access_type: 'offline',
            scope: ['']
        });
    }
}

2. Service account approach:

const auth = new google.auth.JWT(
    config.GOOGLE_CLIENT_EMAIL,
    null,
    config.GOOGLE_PRIVATE_KEY,
    ['']
);

3. Direct API calls with stored tokens:

await fetch(`/${calendarId}/events`, {
    headers: {
        'Authorization': `Bearer ${accessToken}`
    }
    // ...
});

Issues Faced

• OAuth2 requires user to click "Allow" every time
• Service account requires sharing calendar with service account email
• Stored tokens expire and need refresh mechanism
• Need to handle token rotation and security

Question

How can I set up automatic authentication for Google Calendar API that:

1. Doesn't require user interaction
2. Maintains persistent access
3. Handles token refresh automatically
4. Works in a production environment
5. Follows security best practices

Basically I want to have either a supabase way of handling this and get updated session values with the external google account automatically, or directly interacting with the google api, be able to speak to the google calendar(This might be less secure/harder but im not completely sure supabase can handle otherwise)Note also that i would prefer if you can just access the account api using only the user and password, but im fairly certain you can only manage this using api keys and secrets

Technical Details

• React 18.2.0
• Vite 4.4.5
• Google Calendar API v3
• googleapis ^128.0.0
• Running on Windows