Convince client oauth login does not take login credentials as input

[jojy]

I am not a regular freelancer, I get freelance work for a change in my routine. I got a project a month ago to import contacts from social network/email providers using PHP. There have been two major changes in the requirements since I started work, which I happily accepted.

My client is a very nice person, he has a lead developer from China. The lead developer is not aware of OAuth protocol, I figured out after exchanging couple of emails. After completion of this project, the lead developer now insists me to grab contacts by taking email as input, such as $gmail->get_contacts_of('[e-mail]');

As far as I know OAuth protocol, it does not work like that. The only possible solution is to scrape the service provider. This is illegal and unsafe and I am not willing to do it.

I tried to explain few times but probably I am failed. How would you explain if you run into this situation?

Thanks

[mack]

If the practice is indeed illegal i would also refuse to do so. Explain that you (and the client) would be accountable for your actions. Explain the benefits of your solution over the clients proposed solution.

Explain this is not a request, but a demand because you are not prepared to break the law,

Mack.

[swa66]

As far as I know OAuth protocol, it does not work like that.

Agree. With OAuth essentially the user logs in at the authentication provider and you do not get to see their credentials. All you know is that they logged in successfully.

But if you use the Google+ features you can access things like circles.

Some links to get you started:
[developers.google.com...]
[developers.google.com...]

Note that using it is dependent on accepting policies and terms:
[developers.google.com...]
[developers.google.com...]
Which do limit in what you are allowed to do.