BUG: avoid OOB flow in read_gbq and to_gbq

doc/source/whatsnew/v1.5.0.rst

@@ -196,7 +196,13 @@ See :ref:`install.dependencies` and :ref:`install.optional_dependencies` for mor
 
 Other API changes
 ^^^^^^^^^^^^^^^^^
--
+
+- BigQuery I/O methods :func:`read_gbq` and :meth:`DataFrame.to_gbq` default to
+  ``auth_local_webserver = True``. Google has deprecated the
+  ``auth_local_webserver = False`` `"out of band" (copy-paste) flow
+  <https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html?m=1#disallowed-oob>`_.
+  The ``auth_local_webserver = False`` option is planned to stop working in
+  October 2022. (:issue:`46312`)
 -
 
 .. ---------------------------------------------------------------------------

pandas/core/frame.py

@@ -1978,7 +1978,7 @@ def to_gbq(
         chunksize: int | None = None,
         reauth: bool = False,
         if_exists: str = "fail",
-        auth_local_webserver: bool = False,
+        auth_local_webserver: bool = True,
         table_schema: list[dict[str, str]] | None = None,
         location: str | None = None,
         progress_bar: bool = True,
@@ -2016,7 +2016,7 @@ def to_gbq(
                 If table exists, drop it, recreate it, and insert data.
             ``'append'``
                 If table exists, insert data. Create if does not exist.
-        auth_local_webserver : bool, default False
+        auth_local_webserver : bool, default True
             Use the `local webserver flow`_ instead of the `console flow`_
             when getting user credentials.
 
@@ -2026,6 +2026,12 @@ def to_gbq(
                 https://google-auth-oauthlib.readthedocs.io/en/latest/reference/google_auth_oauthlib.flow.html#google_auth_oauthlib.flow.InstalledAppFlow.run_console
 
             *New in version 0.2.0 of pandas-gbq*.
+
+            .. versionchanged:: 1.5.0
+               Default value is changed to ``True``. Google has deprecated the
+               ``auth_local_webserver = False`` `"out of band" (copy-paste)
+               flow
+               <https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html?m=1#disallowed-oob>`_.
         table_schema : list of dicts, optional
             List of BigQuery table fields to which according DataFrame
             columns conform to, e.g. ``[{'name': 'col1', 'type':

pandas/io/gbq.py

@@ -29,7 +29,7 @@ def read_gbq(
     index_col: str | None = None,
     col_order: list[str] | None = None,
     reauth: bool = False,
-    auth_local_webserver: bool = False,
+    auth_local_webserver: bool = True,
     dialect: str | None = None,
     location: str | None = None,
     configuration: dict[str, Any] | None = None,
@@ -63,7 +63,7 @@ def read_gbq(
     reauth : bool, default False
         Force Google BigQuery to re-authenticate the user. This is useful
         if multiple accounts are used.
-    auth_local_webserver : bool, default False
+    auth_local_webserver : bool, default True
         Use the `local webserver flow`_ instead of the `console flow`_
         when getting user credentials.
 
@@ -73,6 +73,12 @@ def read_gbq(
             https://google-auth-oauthlib.readthedocs.io/en/latest/reference/google_auth_oauthlib.flow.html#google_auth_oauthlib.flow.InstalledAppFlow.run_console
 
         *New in version 0.2.0 of pandas-gbq*.
+
+        .. versionchanged:: 1.5.0
+           Default value is changed to ``True``. Google has deprecated the
+           ``auth_local_webserver = False`` `"out of band" (copy-paste)
+           flow
+           <https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html?m=1#disallowed-oob>`_.
     dialect : str, default 'legacy'
         Note: The default value is changing to 'standard' in a future version.
 
@@ -202,7 +208,7 @@ def to_gbq(
     chunksize: int | None = None,
     reauth: bool = False,
     if_exists: str = "fail",
-    auth_local_webserver: bool = False,
+    auth_local_webserver: bool = True,
     table_schema: list[dict[str, str]] | None = None,
     location: str | None = None,
     progress_bar: bool = True,