I'm creating a website for a client that utilizes the Google Calendar API. Essentially, the client needs to be able to input his calendar ids and have events populate on the website. This is handled via a firebase function that performs a request to the Calendar API.
The first thing I tried was following Google's quickstart tutorial for calendar API. This worked for a while until the temporary access token they provided expired, and I realized the access token was temporary.
Next, I generated my own OAuth2 client ID and used that. This worked briefly until I started receiving "Anonymous usage expired" errors from Google, which after some time I realized was because the key did not have the read-only calendar scope enabled.
In attempting to enable the scope, I was told that I need to verify my app with Google, which can take several weeks and requires that I write terms of service and privacy policy for my app. This seems a little unnecessary, as it will only be reading events from one person's calendar, and he has already granted me approval and access.
My next thought was to make the calendars public and use a static API key, but the calendar is synced from a booking service called Peak Pro, which populates the calendar descriptions with the names, emails, and phone numbers of the clients attending events. I can't expose those publicly.
Next, I was drawn to the CalDAV API, but it seems to have the same requirements with regards to verifying the OAuth2 consent screen with Google.
I wouldn't normally pose such a basic question, but I've been unable to find a solution after 3 weeks. Does Google provide another option here that I'm missing?
