Google Cloud Storage
Connect Google Cloud Storage to browse buckets, read and upload files, move and restore them, and see who has access. MCP setup for Claude and ChatGPT.
You end up pasting a service account's JSON key file, and the project comes from the file. If your organization blocks service account keys, you paste the OAuth Client ID and Client Secret of a Web application client you create instead.
- Setup time
- 5 min
- Auth
- OAuth authorization
- API base URL
- https://storage.googleapis.com/storage/v1
- Rate limits
- Google publishes no per-project request quota for the core JSON API. It allows about one write a second to the same object name, about one bucket created or deleted every two seconds per project, and one metadata update a second per bucket. An object can be up to 5 TiB, and a resumable upload must finish within 7 days.
Before you begin
- A Google Cloud project with Cloud Storage, and a role that can create service accounts and keys in it, such as Owner, or Service Account Admin with Service Account Key Admin
- Billing on the project that holds your buckets. Google asks for it before a bucket can be created
- For the OAuth route only: the PopMCP callback URL, copied from the Google Cloud Storage connect form. Personal gmail.com accounts can only use the External audience; Internal needs a Google Workspace organisation
Get your credentials
Create a service account
Open IAM & Admin → Service Accounts, pick your project in the top bar and click Create service account. Enter a Service account name such as PopMCP. Google fills in the ID from it. Click Create and continue.
Create service account
Give it a Storage role
Under Permissions, add one role. Storage Admin lets the AI manage buckets, files and access. Storage Object User lets it read and change files, and Storage Object Viewer only read them. Those two cannot list buckets, so add Storage Bucket Viewer as well, or tell the AI your bucket name. Click Continue, then Done. To limit it to one bucket, leave the role off here, then open the bucket's Permissions tab in Cloud Storage and grant the role to the account's email address.
Create service account
The next step, Principals with access, is optional. Click Done.
Download a JSON key
Click the new account's email address in the list. Open the Keys tab, click Add key, then Create new key. Choose JSON and click Create. Your browser downloads the file. Anyone with it can use this account, so keep it safe and delete it once it is connected. If Google says key creation is blocked by an organization policy, go to the steps below that start with "If keys are blocked".
Keys
popmcp@acme-storage.iam.gserviceaccount.com
Paste the key into PopMCP
Open the downloaded file in any text editor and copy everything in it. On PopMCP's Google Cloud Storage connect form, paste it into Service account key and click Continue. No consent screen follows, and there is nothing else to fill in: the project comes from the key. If your buckets are in another project, enter its ID under More options → Google Cloud project ID.
If keys are blocked: check the Cloud Storage JSON API is enabled
Pick the project in the top bar and open APIs & Services → Library. Search for Google Cloud Storage JSON API. Google turns it on automatically in new projects, so click Enable only if an older project shows it off.
Google Cloud Storage JSON API
- Service name
- storage-api.googleapis.com
- Project
- acme-storage
- Status
- Not enabled
New projects have this on already. If yours does, go on to the next step.
If keys are blocked: fill in the Google Auth Platform branding
Open Google Auth Platform → Branding. If it says Google Auth platform not configured yet, click Get Started. Enter an App name and a User support email, choose External under Audience unless every user sits in your Workspace organisation, add an Email address under Contact Information, agree to the user data policy, then click Continue and Create.
Branding
The wizard then asks for Audience, Contact Information and the user data policy before Create.
If keys are blocked: publish the app
Open Google Auth Platform → Audience. If Publishing status reads Testing, click Publish app and confirm. Publishing needs no review from Google; it only means the consent screen will show a one-time unverified-app warning.
Audience
Choose who can authorize this app to access their account data.
| Test users | Added |
|---|---|
| ops@acme.com | Mar 4, 2026 |
Once published this reads In production and the test-user list no longer applies.
If keys are blocked: create a Web application OAuth client
Open Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it PopMCP Cloud Storage, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form exactly as shown, and click Create. If you already made a client here for another PopMCP Google connector, the same one works.
Create OAuth client ID
A client ID identifies a single app to Google's OAuth servers.
Leave Authorized JavaScript origins empty. Google matches the redirect URI character for character.
If keys are blocked: copy the Client ID and Client Secret
Copy the Client ID and Client secret from the OAuth client created dialog before you close it. If the dialog is already gone, open the client from Clients and click Add secret to mint a new one.
Clients
| Name | Type | Client ID | Creation date |
|---|---|---|---|
| PopMCP Cloud StorageWeb application | Web | 8836****-q2w5 | Mar 4, 2026 |
After this dialog closes the console shows only the last four characters of the secret.
If keys are blocked: paste the values into PopMCP and authorize
On PopMCP's Google Cloud Storage connect form, open More options and paste the values into OAuth Client ID and OAuth Client Secret. Enter your Google Cloud project ID if your buckets are in a different project from this client. Under Permission at Google, tick Transfers, inventory reports and batch jobs only if the AI should use those, or View only at Google if Google itself should refuse every change. Click Continue, click Advanced on the Google hasn't verified this app screen and continue, and leave the permission ticked.
Connect in PopMCP
Open your workspace, choose Google Cloud Storage in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Service account keytextarea | Google Cloud Console → IAM & Admin → Service Accounts → Create service account. Give it a Storage role: Storage Admin to manage everything, Storage Object User to change files, or Storage Object Viewer to read them. The last two cannot list buckets, so add Storage Bucket Viewer or tell your assistant the bucket name. Then open it → Keys → Add key → Create new key → JSON, and paste the whole file here. It is stored encrypted, and it can reach only what its roles allow. If Google says key creation is blocked by an organization policy, use an OAuth client under More options, or ask your admin. |
| OAuth Client IDtext | Instead of a key: Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. If you already made a client for another Google connector here, the same one works. |
| OAuth Client Secretsecret | Shown once, in the popup right after you create the client. If you closed that popup, open the client and add a new secret. Stored encrypted here, used server-side only. IMPORTANT: in Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first. Testing-mode apps get a refresh token that Google expires after exactly 7 days. Publishing does not require Google's review. It only adds a one-time "Google hasn't verified this app" screen, where you click Advanced and continue.Encrypted with AES-256-GCM on save and never shown again. |
| Google Cloud project IDtext | The project your buckets are in, from the project picker at the top of the Google Cloud console. A service account key already names its project, and an OAuth client you made in the same project needs nothing here. |
| Default buckettext | Only if this account can reach a single bucket and cannot list buckets. Tools use it when no bucket is named. |
| Permission at Google (OAuth client only)checklist | Leave both off unless you need them. Without them your own OAuth client asks Google for full Cloud Storage access, and PopMCP's own read-only switch still decides what your assistant may do. A service account key needs neither: its roles decide. |
https://app.popmcp.com/api/providers/google/callbackPopMCP verifies the credential against Google Cloud Storage immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions to request
PopMCP asks Google Cloud Storage for exactly the permissions you tick in the connect form. Unticked permissions leave their tools listed but failing, so keep the defaults unless you have a reason to narrow them.
Google Cloud Storage grants exactly what you tick. 0 of 2 are on by default.
Other
cloudTransfers, inventory reports and batch jobsTick this to use Storage Transfer Service, Storage Insights and Storage Batch Operations. Google only allows those with its broad Google Cloud permission, so the consent screen asks for access to your Google Cloud data instead of Cloud Storage alone.viewonlyView only at GoogleGoogle itself will refuse every change, whatever is set here. Reading ACLs and bucket IAM policies also stops working, because Google asks for full access even to look at those. To change this later you connect again.
Verify it worked
After you paste the key or finish the consent, the connector shows Connected with the project and how many buckets it found. PopMCP checks by listing the project's buckets, which changes nothing. An account that can use a bucket but not list buckets still connects, and the form says so. Ask the AI to list your buckets and their names come back.
Troubleshooting
Key creation is not allowed on this service account, or an organization policy blocks it
Why: Google enforces iam.disableServiceAccountKeyCreation by default on organizations created on or after May 3, 2024.
Fix: Ask an organization admin to lift that policy for the project, or follow the steps in this guide that start with "If keys are blocked".
PopMCP says Google refused this service account key
Why: The key or the service account was deleted or disabled in the Google Cloud console.
Fix: Create a new JSON key under the account's Keys tab and connect Google Cloud Storage again.
PopMCP says the account can't list buckets in the project
Why: Storage Object Viewer and Storage Object User do not include storage.buckets.list, and a role granted on one bucket says nothing about the project.
Fix: Nothing is broken: the AI can use any bucket you name. To let it list them, add Storage Bucket Viewer on the project, or set a Default bucket under More options.
does not have storage.objects.get access
Why: The account has no role on that bucket that includes the permission Google names.
Fix: Open the bucket's Permissions tab in Cloud Storage and grant the account's email address a role that includes it, such as Storage Object Viewer.
PopMCP says the Cloud Storage JSON API is switched off
Why: It was turned off in the Cloud project, or an older project never had it on.
Fix: Open APIs & Services → Library, click Enable on Google Cloud Storage JSON API, wait a minute and connect again.
PopMCP says Google didn't accept the project this OAuth client belongs to
Why: With the project left empty, PopMCP uses the number at the start of your OAuth Client ID, and Google did not accept it.
Fix: Enter your Google Cloud project ID under More options. It is in the project picker at the top of the console.
Error 400: redirect_uri_mismatch
Why: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends, usually a trailing slash or http instead of https.
Fix: Open the client under Google Auth Platform → Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to take effect.
The connection works for about a week, then stops with invalid_grant
Why: The app is still in Testing on the Audience page, so Google expired the refresh token 7 days after consent. PopMCP reports it as Google's 7 day Testing-mode expiry.
Fix: Go to Google Auth Platform → Audience, click Publish app, then connect Google Cloud Storage again in PopMCP. A service account key never has this problem.
Bucket is a requester pays bucket but no user project provided
Why: The bucket's owner set it so whoever reads it pays.
Fix: Tell the AI which of your projects should pay. It passes that as userProject.
The AI refuses to make a bucket or file public
Why: PopMCP stops any grant to allUsers or allAuthenticatedUsers, which would open the data to anyone on the internet, until you agree.
Fix: Tell the AI you agree, and it repeats the call with confirmPublicAccess. Your organization's public access prevention setting can still refuse it at Google.