I am building an app on Google App Engine using Flask. I am implementing Google+ login from the server-side flow described in the Python examples: <https://developers.google.com/+/web/signin/server-side-flow> and <https://github.com/googleplus/gplus-quickstart-python/blob/master/signin.py>.

Both of the examples have:

```
credentials = oauth_flow.step2_exchange(code)

```

and

```
session['credentials'] = credentials

```

storing the credentials object to the Flask session. When I run this code on my Google App Engine project, I get the error:

```
TypeError: <oauth2client.client.OAuth2Credentials object at 0x7f6c3c953610> is not JSON serializable

```

As discussed in [this issue](https://groups.google.com/forum/#!topic/google-api-python-client/HFrPW3679oA) (marked WontFix), the OAuth2Credentials is not designed to by JSON serializable. It has methods `to_json` and `from_json`, which could be used to store it, e.g:

```
session['credentials'] = credentials.to_json()

```

However, in the [same issue](https://groups.google.com/forum/#!topic/google-api-python-client/HFrPW3679oA):

> 
> Never store a Credentials object in a cookie, it contains the applications  
> 
>  client id and client secret.
> 
> 
> 

Perhaps I misunderstand how a Flask session object works, but from [the doc](http://flask.pocoo.org/docs/api/):

> 
> ... A session basically makes it possible to remember information from one request to another. The way Flask does this is by using a signed cookie. So the user can look at the session contents, but not modify it unless they know the secret key...
> 
> 
> 

And therefore, we should not be storing a credentials object in the session, even if it is a signed cookie.

In my case, I currently only need to re-use the access token for disconnect purposes, so I can just store that.

What is the correct way to deal with this situation? Should the credentials not be stored in the session at all? Should at this point in the examples there be a comment "Securely save credentials here"?