title: Google OAuth Always Showing Consent Screen
body: <p>I'm building an <em>installed</em> application that will have features requiring the Google Drive REST API using Qt and C++. I understand Qt is now releasing new libraries to support OAuth flows but let's assume I'm a student and learning to use OAuth at this layer is a requirement for this project.</p>
  
  <p>In my application, I have a working OAuth flow for installed applications that ends with an Access Token and Refresh Token being stored using QSettings (I'm open to input on whether this is a disastrously bad idea too). The application requires no authentication/login for its own sake/data, but it does need authentication to Google for calling API's using an Access Token. This application has no associated web backend being hosted; its simple and should be deployable completely locally (I've written and included a simple TCP server that will receive the authorization redirect_uri and will run and close when called from within the application). </p>
  
  <p>As such, I'm curious about the best way to make sure that, when a user opens my application and wants to use the Google Drive features, they are appropriately authenticated on Google's end. Say, if I maintain an access token in the registry, and this access token is granted per-user/per-application basis (right?), then how can I make sure only the user the token belongs to is able to make calls to the API with it?</p>
  
  <p>Here's my understanding and approach; feel free to correct me or educate me if I've got the wrong interpretation.</p>
  
  <h2>If an Access Token is found, perform the following:</h2>
  
  <ol>
  <li>Open a browser page to a Google login domain and have the user authenticate there (this could prohibit a user from being able to use a cached login session that would have access to a token they otherwise shouldn't have access to)</li>
  <li>If user has correctly authenticated with a Google account, return control to the application and make a test call to an API using the stored token.</li>
  <li>If the call fails (responds with an <code>invalid_credentials</code>) I should be able to be sure its because the access token has expired and the application will go through the flow to renew an Access Token from a Refresh Token.</li>
  </ol>
  
  <h2>If no Access Token is initially found:</h2>
  
  <ol>
  <li>Start a normal OAuth installed application flow</li>
  <li>Get the tokens and store them so that when the user opens the application next time the former procedure is used </li>
  </ol>
  
  <p>My issue then is the first two steps if the Access Token is found. Nominally this could be done by the typical OAuth flow but it appears that when using a localhost as the redirect uri, Google will always prompt for consent, regardless of settings for <code>prompt</code> and <code>access_type</code> authorization query parameters.</p>
  
  <p>What can be done to accomplish these first two steps in a way that my application can control (i.e. not a solution that relies on a backend server being hosted somewhere)?</p>
  
  <p>If this question is too open-ended for SO requirements I can make some more restrictions/assumptions to limit the problem domain but I'd rather not do that yet in case I unknowingly rope off a good viable solution.</p>
  
  <p>Thanks for reading! Sorry if its a verbose; I wanted to ensure my problem domain was fully fleshed out!</p>