Yes, it is technically feasible to implement this flow, but it is strongly advised against. Sharing an API key with all website users and handling parts of the oauth process yourself can lead to security risks. It is recommended to delegate this task to a server-side application that can utilize supported client libraries and execute the necessary actions securely.
- Utilize supported client libraries
- Possibly carry out the required action involving the secret and provide the response. This may not be applicable if you intend to only reveal metadata about the secret rather than its actual content.
If you are determined to proceed with this approach:
Instead of using an API key, consider utilizing a service account and implementing the oauth flow through google.com/
Here are the detailed steps outlined by Google. The appropriate scope to use would likely be this one.
You can also refer to this link for more information on scopes related to Google OAuth2.