Google's OAuth2 implementation requires a client_secret for installed desktop applications, (a type of "public clients").
It is not actually treated as a secret (docs):
The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)
Nevertheless, it must be provided to the token exchange endpoint (Step 5), but must not be part of the authorization URL (docs).
This is not something that can be achieved using this library as-is. Alternatively I am misunderstanding something horribly. Thanks.