Update 2/14/2010: As of version 2.6, Shashin now has support for unlisted albums, so you no longer need the workaround described in this post.

There’s still no support for unlisted albums in the new version of Shashin, but there is a workaround. If you temporarily make your unlisted album public, then add it to Shashin, and then make it unlisted again, it will work in Shashin. If you later add photos to the album, you’ll need to briefly make it public again to sync it with Shashin. I was actually surprised this worked. Shashin is able to display the photos even without the authkey for the unlisted album. It seems that Picasa requires an authkey to access the Picasa pages that display the unlisted photos, but doesn’t require an authkey for the images themselves.

The reason I haven’t added better unlisted album support yet is that it’s more difficult to do than it might seem. I could use an album’s authkey to give Shashin access to an unlisted album’s RSS feed. However, Shashin also needs to access your Picasa user feed, which contains important metadata about all your albums. Unlisted albums don’t show up in the public version of that feed, even if an authkey is available.

To access that feed, I’ll need to give Shashin the ability to log in to your Picasa account. This is possible with the Picasa Web Album API. There’s an officially supported PHP library for interacting with it, but the problem is that the library is over 3MB in size, and I don’t want to bundle something that enormous with Shashin.

I wrote my own authentication routine using Google’s ClientLogin method for another project, but that approach isn’t appropriate for a distributed web application like Shashin. I’ll have to figure out their AuthSub method instead, which is intended for web applications. So… look for better unlisted album support in a future version of Shashin, and hopefully the workaround described here will get you by in the meantime.