{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"e9053a12b31c900266e789a4a317b30abf16cf9e6456bcb61a85348fa7159299","entry":{"id":"google/sheets-drive-api","name":"Google Sheets and Drive APIs (OAuth app)","vendor":"Google","summary":"Enable the Sheets and/or Drive API in a Google Cloud project, configure the OAuth consent screen, create an OAuth client, and pass OAuth app verification if the app asks for sensitive or restricted scopes.","category":"productivity","group":"C","homepage":"https://developers.google.com/workspace","docs":["https://developers.google.com/workspace/sheets/api/scopes","https://developers.google.com/workspace/drive/api/guides/api-specific-auth","https://developers.google.com/workspace/guides/configure-oauth-consent"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"drive_scopes","url":"https://developers.google.com/workspace/drive/api/guides/api-specific-auth","title":"Choose Google Drive API scopes","accessed":"2026-10-25","supports":"Drive scope tiers: drive.file, drive.appdata, drive.install are non-sensitive; drive.apps.readonly is sensitive; drive, drive.readonly, drive.metadata(.readonly), drive.activity(.readonly), drive.scripts, drive.meet.readonly are restricted; restricted scopes need restricted-scope verification and a security assessment if data is stored on or transmitted via servers.","kind":"official"},{"id":"sheets_scopes","url":"https://developers.google.com/workspace/sheets/api/scopes","title":"Choose Google Sheets API scopes","accessed":"2026-10-25","supports":"spreadsheets and spreadsheets.readonly are sensitive; drive.file is non-sensitive and recommended.","kind":"official"},{"id":"consent","url":"https://developers.google.com/workspace/guides/configure-oauth-consent","title":"Configure the OAuth consent screen and choose scopes","accessed":"2026-10-25","supports":"Consent screen steps (Branding, audience, contact email, accept API Services User Data Policy, test users, Data Access scopes); Internal apps do not need further review for sensitive/restricted scopes.","kind":"official"},{"id":"oauth2","url":"https://developers.google.com/identity/protocols/oauth2","title":"Using OAuth 2.0 to Access Google APIs","accessed":"2026-10-25","supports":"Testing-status apps get refresh tokens expiring in 7 days; limit of 100 refresh tokens per account per client.","kind":"official"},{"id":"verification_help","url":"https://support.google.com/cloud/answer/13463073","title":"OAuth App Verification Help Center","accessed":"2026-10-25","supports":"Sensitive/restricted scopes need OAuth app verification; restricted-scope apps re-verify annually.","kind":"official"},{"id":"unverified","url":"https://support.google.com/cloud/answer/7454865","title":"Unverified apps","accessed":"2026-10-25","supports":"Unverified app screen; unverified apps limited to 100 new users.","kind":"official"},{"id":"security_assessment","url":"https://support.google.com/cloud/answer/13465431","title":"Security Assessment","accessed":"2026-10-25","supports":"Restricted-scope apps need an annual CASA security assessment and Letter of Validation from the assessor.","kind":"official"},{"id":"sheets_limits","url":"https://developers.google.com/workspace/sheets/api/limits","title":"Usage limits | Google Sheets","accessed":"2026-10-25","supports":"Standard use free; 300 read/write requests per minute per project, 60 per user; overage charges planned later in 2026.","kind":"official"}],"allowed_domains":["console.cloud.google.com"],"account_model":{"summary":"A Google account owns a Google Cloud project; the OAuth client and consent screen live in that project.","accounts":[{"name":"Google account","kind":"personal","owned_by":"the person","required":true},{"name":"Google Cloud project","kind":"project","parent":"Google account","required":true,"note":"Use a Workspace organisation project if the app is only for your own Workspace users (Internal audience)."}]},"prerequisites":[{"need":"A Google Cloud project you own"},{"entry":"google/oauth-verification","note":"Only needed for External apps that request sensitive (e.g. spreadsheets) or restricted (e.g. drive, drive.readonly) scopes."}],"have_ready":[{"kind":"app_privacy_policy_url","description":"A public privacy policy URL on your app's domain","why":"Required on the consent screen branding for verification.","needed_for":["verification"],"auto_check":"website_live","source":"verification_help"},{"kind":"live_website","description":"A public home page for the app on a domain you have verified","needed_for":["verification"],"auto_check":"website_live","source":"verification_help"}],"steps":[{"id":"enable_apis","title":"Enable the Sheets and/or Drive API","summary":"In the API Library of your project, enable the Google Sheets API and/or the Google Drive API.","route":"copilot","depends_on":[],"gate":"human_submit","url":"https://console.cloud.google.com/apis/library/sheets.googleapis.com"},{"id":"consent_screen","title":"Configure the consent screen (Google Auth platform)","summary":"Under Google Auth platform > Branding enter app name and support email, choose Internal or External audience, add a contact email, and accept the Google API Services User Data Policy.","route":"copilot","depends_on":["enable_apis"],"gate":"human_terms","url":"https://console.cloud.google.com/auth/branding","sources":["consent"]},{"id":"choose_scopes","title":"Choose the narrowest scopes","summary":"Under Data Access add scopes. Prefer drive.file (non-sensitive) where possible. spreadsheets and spreadsheets.readonly are sensitive; drive and drive.readonly are restricted and bring a security assessment. For External apps, add test users under Audience.","route":"copilot","depends_on":["consent_screen"],"gate":"human_submit","url":"https://console.cloud.google.com/auth/scopes","recovery":[{"hiccup":"Test users' sign-ins stop working after about a week","fix":"Refresh tokens for apps in Testing status expire after 7 days; publish the app to production (and verify if needed).","source":"oauth2"}],"sources":["sheets_scopes","drive_scopes"]},{"id":"create_client","title":"Create an OAuth client ID","summary":"Under Google Auth platform > Clients create a client of the right type (e.g. Web application) with your redirect URIs, then copy the client ID and secret.","route":"copilot","depends_on":["consent_screen"],"gate":"human_submit","url":"https://console.cloud.google.com/auth/clients","capture":{"env":"GOOGLE_OAUTH_CLIENT_SECRET","kind":"secret"}},{"id":"verification","title":"Publish and verify the app (sensitive/restricted scopes)","summary":"For External apps using sensitive or restricted scopes, publish to production and submit for OAuth app verification (see google/oauth-verification). Restricted scopes also need an annual CASA security assessment if the data reaches your servers. Internal apps skip this.","route":"guided","depends_on":["choose_scopes","create_client"],"gate":"third_party_review","url":"https://console.cloud.google.com/auth/verification","lead_time":{"official":{"text":"Google does not state a fixed timeline; for restricted scopes the security assessment is the final step and Google's Trust and Safety team contacts the developer to start it.","source":"security_assessment"}},"recovery":[{"hiccup":"Users see the \"Google hasn't verified this app\" screen and new sign-ins stop at 100 users","fix":"Complete OAuth app verification, or switch to drive.file / non-sensitive scopes.","source":"unverified"}],"optional":true}],"outputs":[{"name":"GOOGLE_OAUTH_CLIENT_ID","description":"OAuth 2.0 client ID","secret":false,"example_format":"123456789012-abc….apps.googleusercontent.com","from_step":"create_client"},{"name":"GOOGLE_OAUTH_CLIENT_SECRET","description":"OAuth 2.0 client secret","secret":true,"example_format":"GOCSPX-…","from_step":"create_client"}],"terms_notes":[{"kind":"rules_say","severity":"amber","text":"Restricted Drive scopes (drive, drive.readonly, drive.metadata, …) require restricted-scope verification and, if data is stored or transmitted server-side, an annual security assessment.","source":"drive_scopes"},{"kind":"rules_say","severity":"yellow","text":"Apps in Testing publishing status get refresh tokens that expire after 7 days.","source":"oauth2"}],"renewals":[{"what":"Restricted-scope re-verification / CASA security assessment","every":"1 year","every_days":365,"source":"security_assessment"}],"pricing_notes":{"free_tier":"Standard Sheets API use is at no additional cost within quota (300 requests/min per project, 60/min per user).","notes":"Google says charges for exceeding quota limits are planned later in 2026 [to verify].","source":"sheets_limits"},"stripe_projects":false,"api_provisioning":{"available":"partial","notes":"APIs can be enabled with the Service Usage API; OAuth consent screen and verification submission are console-only [to verify]."}}}