google

var (
	DefaultClientID     = ""
	DefaultClientSecret = ""
)

DefaultClientID / DefaultClientSecret are the RevenueCat-owned Desktop OAuth client baked into the binary. They are intentionally empty until RevenueCat provisions the official client; RC_GOOGLE_CLIENT_ID / RC_GOOGLE_CLIENT_SECRET override them (and let developers test against their own Desktop client under Google's 100-user unverified cap in the meantime). A Desktop client secret is not confidential — PKCE is the real protection — so shipping it is expected.

var DefaultScopes = []string{ScopeAndroidPublisher, ScopeCloudPlatform, scopeOpenID, scopeEmail}

DefaultScopes covers the whole setup flow.

var ErrNoClientID = errors.New(
	"no Google OAuth client configured: set RC_GOOGLE_CLIENT_ID (and RC_GOOGLE_CLIENT_SECRET) " +
		"to a Google Cloud \"Desktop app\" OAuth client. Create one at " +
		"https://console.cloud.google.com/apis/credentials → Create credentials → OAuth client ID → Desktop app")

ErrNoClientID is returned when neither a baked-in nor an env-provided client ID is available. The message tells the human how to create one.

var PlayAppPermissions = []string{
	"CAN_VIEW_NON_FINANCIAL_DATA",
	"CAN_VIEW_FINANCIAL_DATA",
	"CAN_MANAGE_ORDERS",
}

PlayAppPermissions are the per-app (package-scoped) grant permissions RevenueCat needs. All three exist at the app level, so we never grant account-wide access. Maps to the Play Console labels:

• CAN_VIEW_NON_FINANCIAL_DATA → "View app information"
• CAN_VIEW_FINANCIAL_DATA → "View financial data, orders, and surveys"
• CAN_MANAGE_ORDERS → "Manage orders and subscriptions"

var ProjectRoles = []string{"roles/pubsub.editor", "roles/monitoring.viewer"}

ProjectRoles are the Google Cloud IAM roles the service account needs. Matches RevenueCat's current requirements.

var RequiredAPIs = []string{
	"cloudresourcemanager.googleapis.com",
	"iam.googleapis.com",
	"androidpublisher.googleapis.com",
	"playdeveloperreporting.googleapis.com",
	"pubsub.googleapis.com",
}

RequiredAPIs are the Google APIs RevenueCat's Play integration depends on. This matches RevenueCat's current Cloud Shell setup script.