Description of process

Google's AuthSub page describes the authentication process like this:

I think that most applications will want to use the session-based api key for repeated access to Google's webservices instead of the one-time-use token that you can easily get through the AuthSub method. So the steps of Authentication (in terms of module development) are like this:

1: Create an admin page to keep track of api keys, on that page have hidden form element for the one-time-use token, a link to go and get the token, and a textbox for the session-based api key.
2: Have the administrator click the link to get the token, authenticate to Google and be redirected back to the administrative page. Store the token in the hidden form element.
3: Have the admin page prepare the custom http (GET) request necessary for obtaining the Session api key and redirect back to google to get it.
4: Store the Session api key in the text box. Indicate to the user that the registration process is done and instruct them to save the settings.

After the session api key has been retrieved and stored it could be used by a service to get data from google using the GData protocol.

Potential problems:
1: The session key is good for only one kind of service (Google Calendar, whatever else) and only one google account. Each user will have to get their own key.
2: This key will not be secure. Meaning it won't be encrypted. It is possible to encrypt the key, but given the steps an administrator will have to do in order to obtain a secure key, it's pretty safe to assume that the average administrator won't think it's worth the effort.