IssueTracker

- We are looking for a permission or role to allow the user to create OAuth Client ID only.

- We tried the following permissions for creating OAuth Credentials in Google Cloud. However, the user couldn't create an OAuth CLient ID. By the way, we note that the permissions with TESTING support level, are being tested to check custom role compatibility and some behavior may be unexpected [1].

clientauthconfig.brands.create
clientauthconfig.brands.delete
clientauthconfig.brands.get
clientauthconfig.brands.list
clientauthconfig.brands.update
clientauthconfig.clients.create
clientauthconfig.clients.createSecret
clientauthconfig.clients.delete
clientauthconfig.clients.get
clientauthconfig.clients.getWithSecret
clientauthconfig.clients.list
clientauthconfig.clients.listWithSecrets
clientauthconfig.clients.undelete
clientauthconfig.clients.update

- Using one of Service Account Key Admin role [2] and Service Account Admin roles [3], the user can create OAuth client IDs. However, the user does not need to create Service Account Key and if we provide Service Account Key Admin role, the user will also be able to delete any existing service account keys in APIs & Services > Credentials and make changes to the "OAuth consent screen" where the user can make changes to the "Authorised domains". That is why we are asking for a minimal role which allows the user to create OAuth Client ID only.

[1] https://cloud.google.com/iam/docs/custom-roles-permissions-support
[2] https://cloud.google.com/iam/docs/creating-managing-service-account-keys#required_permissions
[3] https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating_a_service_account