oAuth 2.0 will become the default authentication mechanism for deploying to App Engine

[Andrew Jessup]

Dear App Engine developers,

In the next release of App Engine you will notice that instead of being asked for a username and password, our SDKs will be defaulting to the more secure oAuth 2.0 web-based authentication flow to verify your identity. You can try this today using the --oauth2 flag with our appfg.py or appcfg.sh command line tools.

This change improves the security of your App Engine deployments as the oAuth 2.0 authentication flow supports additional Google account security features such as 2 Step Authentication.

In a subsequent release we will be removing username and password authentication entirely.

We expect that most developers will be unaffected by this change, but as always we recommend early testing, particularly if you are using continuous integration or other tools to authenticate to App Engine. For any issues, you can find or ask for help on the Google App Engine Stack Overflow Tag, or if you have a support package you may open a support ticket.

Happy (and secure) building!

Andrew, on behalf of the Google App Engine team