Google sign-in on a Streamlit app: st.login() is only half the gate
·716 words·4 mins
A successful Google sign-in proves someone owns a Google account — not that they may use your app. Without an allowlist the page is open to everyone, and a new OAuth client answers every sign-in with 403 until the consent screen is dealt with.