title: Google wants to block OAuth sign-in due to an embedded browser which doesn't exist
body: <p>Today I've got following email from Google:</p>
  <blockquote>
  <p>We are writing to let you know that Google will discontinue support for sign-ins to Google accounts from embedded browser frameworks, starting January 4, 2021.
  <strong>We have detected the use of an embedded browser framework with one or more of your OAuth clients that may be blocked on or after January 4, 2021</strong>. Please review your use of Google Account authorization flows in the following Google OAuth client IDs and make any required changes before January 4, 2021:</p>
  </blockquote>
  <p>This is strange as my B2C web application isn't loaded in an embedded browser nor in a web view. It's even not an mobile app using an embedded browser or a web view. There's no embedded browser or web view at all where users could log in. My web application is just a simple public B2C &quot;website&quot; which does 2 things:</p>
  <ul>
  <li>Users can log in by Google OAuth (Google Sign-In for Websites)</li>
  <li>Automatic retrieval of YouTube data by using YouTube data API via cronjob by using OAuth tokens with offline access</li>
  </ul>
  <p>So I'm wondering why I've got this email. Advice is very much appreciated as it seems as Google plans to limit/block my Google API clientID and I'm a bit concerned by website will break.</p>
  <p><strong>Update 1:</strong></p>
  <ul>
  <li>On my development environment I'm testing Google OneTap Sign-In since
  half a year on localhost. Maybe this could be the reason?</li>
  <li>I'm also using HotJar.com screen recording to optimize my website. The HotJar Javascript is dynamically generating invisible html iframes. Maybe this could be a reason?</li>
  </ul>
  <p><strong>Update 2:</strong><br />
  The <a href="https://developers.googleblog.com/2020/08/guidance-for-our-effort-to-block-less-secure-browser-and-apps.html" rel="noreferrer">Google blog article</a> about this topic describes that &quot;The browser must have JavaScript enabled&quot; and &quot;The browser must identify itself clearly in the User-Agent&quot; in order to do an OAuth Sign-In.</p>
  <p>I'm wondering if an server side API call to YouTube data API with an offline access token is considered as an OAuth Sign-In (which it basically is). But offline access is made for API access without user interaction (a browser). So I think this should <strong>not</strong> be the problem but who knows...</p>