Drive Picker Config
Mint a short-lived Google Picker config (token + app id + api key).
Drive-only. The leased token is sensitive and per-use, so the response is
marked no-store to keep it out of any shared/proxy cache.
GET
Drive Picker Config
Authorizations
Response
Successful Response
Short-lived config the SPA needs to open the Google Picker.
The access_token is a freshly-leased OAuth token (never persisted, never
logged); app_id (GCP project number) and api_key (browser key) come
from server config so they stay out of the SPA bundle. Served with
Cache-Control: no-store.
Drive Picker Config