Restricted Drive scopes (drive, drive.readonly, drive.metadata, …) require restricted-scope verification and, if data is stored or transmitted server-side, an annual security assessment. [1]
Guides · productivity · Popular APIs
Google Sheets and Drive APIs (OAuth app)
Enable the Sheets and/or Drive API in a Google Cloud project, configure the OAuth consent screen, create an OAuth client, and pass OAuth app verification if the app asks for sensitive or restricted scopes.
Researched · not yet run liveLast researched 25 October 2026 · Google · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
A Google account owns a Google Cloud project; the OAuth client and consent screen live in that project.
- Google account personal owned by the person
- Google Cloud project project · under Google accountUse a Workspace organisation project if the app is only for your own Workspace users (Internal audience).
Have ready
- A Google Cloud project you own
- google/oauth-verification: Only needed for External apps that request sensitive (e.g. spreadsheets) or restricted (e.g. drive, drive.readonly) scopes.
- A public privacy policy URL on your app's domain · Required on the consent screen branding for verification. [5]Needed for: Publish and verify the app (sensitive/restricted scopes)
- A public home page for the app on a domain you have verified [5]Needed for: Publish and verify the app (sensitive/restricted scopes)
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Enable the Sheets and/or Drive API
In the API Library of your project, enable the Google Sheets API and/or the Google Drive API.
Where: https://console.cloud.google.com/apis/library/sheets.googleapis.com
Configure the consent screen (Google Auth platform)
Under Google Auth platform > Branding enter app name and support email, choose Internal or External audience, add a contact email, and accept the Google API Services User Data Policy.
Where: https://console.cloud.google.com/auth/branding
Choose the narrowest scopes
Under Data Access add scopes. Prefer drive.file (non-sensitive) where possible. spreadsheets and spreadsheets.readonly are sensitive; drive and drive.readonly are restricted and bring a security assessment. For External apps, add test users under Audience.
If something goes wrong (1)
- Test users' sign-ins stop working after about a week: Refresh tokens for apps in Testing status expire after 7 days; publish the app to production (and verify if needed). [4]
Where: https://console.cloud.google.com/auth/scopes
Create an OAuth client ID
Under Google Auth platform > Clients create a client of the right type (e.g. Web application) with your redirect URIs, then copy the client ID and secret.
verapli captures
GOOGLE_OAUTH_CLIENT_SECREThere by plain code: encrypted in your browser, never shown to AI.Where: https://console.cloud.google.com/auth/clients
Publish and verify the app (sensitive/restricted scopes)optional
For External apps using sensitive or restricted scopes, publish to production and submit for OAuth app verification (see google/oauth-verification). Restricted scopes also need an annual CASA security assessment if the data reaches your servers. Internal apps skip this.
- The provider says
- Google does not state a fixed timeline; for restricted scopes the security assessment is the final step and Google's Trust and Safety team contacts the developer to start it. [7]
If something goes wrong (1)
- Users see the "Google hasn't verified this app" screen and new sign-ins stop at 100 users: Complete OAuth app verification, or switch to drive.file / non-sensitive scopes. [6]
Where: https://console.cloud.google.com/auth/verification
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
Apps in Testing publishing status get refresh tokens that expire after 7 days. [4]
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
GOOGLE_OAUTH_CLIENT_ID | not secret | 123456789012-abc….apps.googleusercontent.com | OAuth 2.0 client ID |
GOOGLE_OAUTH_CLIENT_SECRET | secret | GOCSPX-… | OAuth 2.0 client secret |
Renewals
- Restricted-scope re-verification / CASA security assessment: every 1 year [7]
Pricing
- Free tier: Standard Sheets API use is at no additional cost within quota (300 requests/min per project, 60/min per user).
- Google says charges for exceeding quota limits are planned later in 2026 [to verify].
Source [8]
For agents
The same entry as JSON: /api/v1/entries/google/sheets-drive-api · requirements /api/v1/requirements/google/sheets-drive-api · terms /api/v1/terms/google/sheets-drive-api.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Google Sheets and Drive APIs (OAuth app), and how long will it take?"
→ tools/call requirements { "provider_id": "google/sheets-drive-api" }Sources
- Choose Google Drive API scopes Drive scope tiers: drive.file, drive.appdata, drive.install are non-sensitive; drive.apps.readonly is sensitive; drive, drive.readonly, drive.metadata(.readonly), drive.activity(.readonly), drive.scripts, drive.meet.readonly are restricted; restricted scopes need restricted-scope verification and a security assessment if data is stored on or transmitted via servers. · accessed 25 October 2026 · official
- Choose Google Sheets API scopes spreadsheets and spreadsheets.readonly are sensitive; drive.file is non-sensitive and recommended. · accessed 25 October 2026 · official
- Configure the OAuth consent screen and choose scopes Consent screen steps (Branding, audience, contact email, accept API Services User Data Policy, test users, Data Access scopes); Internal apps do not need further review for sensitive/restricted scopes. · accessed 25 October 2026 · official
- Using OAuth 2.0 to Access Google APIs Testing-status apps get refresh tokens expiring in 7 days; limit of 100 refresh tokens per account per client. · accessed 25 October 2026 · official
- OAuth App Verification Help Center Sensitive/restricted scopes need OAuth app verification; restricted-scope apps re-verify annually. · accessed 25 October 2026 · official
- Unverified apps Unverified app screen; unverified apps limited to 100 new users. · accessed 25 October 2026 · official
- Security Assessment Restricted-scope apps need an annual CASA security assessment and Letter of Validation from the assessor. · accessed 25 October 2026 · official
- Usage limits | Google Sheets Standard use free; 300 read/write requests per minute per project, 60 per user; overage charges planned later in 2026. · accessed 25 October 2026 · official
Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Google is not affiliated with verapli.