Google Docs
Connect Google Docs to find, read and write documents in Markdown, edit and format text, tables and sections, fill templates, comment, and share the file.
You end up pasting the OAuth Client ID and Client Secret of a Web application client you create in the Google Cloud console, on a project where both the Google Docs API and the Google Drive API are enabled.
OAuth scope verification before this connector works
The connection asks your OAuth client for the full Drive scope (drive), which Google's Docs API scope table labels Restricted. Serving users beyond your own team therefore needs Google's restricted-scope verification, plus a security assessment because the data passes through a server.
- Typical wait
- Google says restricted-scope verification 'can potentially take several weeks to complete', and brand verification typically takes 2-3 business days. The security assessment must be renewed at least every 12 months.
- Cost
- Verification itself is free. The security assessment is run under the App Defense Alliance's CASA framework by a Google-approved assessor who sets its own fee, so budget from a quote rather than a figure found online.
- Blocked until approved
- Wide distribution only. An unverified app shows the "Google hasn't verified this app" screen and is limited to 100 new users. Left in Testing, only listed test users can sign in and their refresh tokens expire 7 days after consent.
- Works meanwhile
- Everything, for your own team. Publish the app on the Audience page without submitting it for verification, click Advanced on the warning screen when you connect, and the connection keeps working past 7 days. An Internal app inside your Google Workspace organisation is not put through verification.
Where to apply: Google Cloud console > Google Auth Platform: complete Branding, add https://www.googleapis.com/auth/drive on Data access, publish the app, then submit from the Verification center. Restricted scopes add a security assessment request sent to your listed contact.
- The narrower scopes do not fit this connector: documents and documents.readonly (Sensitive) cannot find, rename, share or export a file, and drive.file (Non-sensitive) only reaches files the app created or was handed.
- Google verifies only the scopes you added on Data access, so add the drive scope there before you submit.
- Review checks your brand and domain, a privacy policy linked from your home page, a justification for each scope and a demo video showing the scopes in use.
- Adding another restricted scope later may require a new assessment.
- Google Workspace admins can still block the app for their users, who then see Error 400: admin_policy_enforced until the admin trusts the client ID in the Admin console's API controls.
- Setup time
- 10 min
- Auth
- OAuth authorization
- API base URL
- https://docs.googleapis.com/v1/documents
- Rate limits
- Per minute: 3,000 read requests per project and 300 per user, 600 write requests per project and 60 per user. Going over returns 429 Too many requests, which should be retried with backoff.
Before you begin
- A Google account that can open the documents you want the AI to work on, plus a Google Cloud project you own. Creating one is free and the Docs and Drive APIs need no billing account
- Owner or Editor role on that Cloud project, so you can enable APIs and create OAuth clients
- Both the Google Docs API and the Google Drive API enabled on the same project, because Docs alone cannot find, rename, share or export a document
- The PopMCP callback URL, copied from the Google Docs connect form before you start
- Personal gmail.com accounts can only use the External audience. Internal needs a Google Workspace organisation
Get your credentials
Enable the Google Docs API and the Google Drive API
Pick or create a project in the top bar, then open APIs & Services → Library. Search for Google Docs API and click Enable, then come back and do the same for Google Drive API.
Google Docs API
Reads and writes Google Docs documents.
- Service name
- docs.googleapis.com
- Project
- acme-docs-mcp
- Status
- Not enabled
Repeat at console.cloud.google.com/apis/library/drive.googleapis.com for the Drive API.
Fill in the Google Auth Platform branding
Open Google Auth Platform → Branding. If it says Google Auth platform not configured yet, click Get Started. Enter an App name and a User support email, choose External under Audience unless every user sits in your Workspace organisation, add an Email address under Contact Information, agree to the user data policy, then click Continue and Create.
Branding
The wizard then asks for Audience, Contact Information and the user data policy before Create.
Publish the app
Open Google Auth Platform → Audience. If Publishing status reads Testing, click Publish app and confirm. Publishing needs no review from Google; it only means the consent screen will show a one-time unverified-app warning.
Audience
Choose who can authorize this app to access their account data.
| Test users | Added |
|---|---|
| ops@acme.com | Mar 4, 2026 |
Once published this reads In production and the test-user list no longer applies.
Create a Web application OAuth client
Open Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it PopMCP Docs, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form exactly as shown, and click Create. If you already made a client here for another PopMCP Google connector, you can reuse it.
Create OAuth client ID
A client ID identifies a single app to Google's OAuth servers.
Leave Authorized JavaScript origins empty. Google matches the redirect URI character for character.
Copy the Client ID and Client Secret
Copy the Client ID and Client secret from the OAuth client created dialog before you close it. If the dialog is already gone, open the client from Clients and click Add secret to mint a new one.
Clients
| Name | Type | Client ID | Creation date |
|---|---|---|---|
| PopMCP DocsWeb application | Web | 6120****-d4k8 | Mar 4, 2026 |
After this dialog closes the console shows only the last four characters of the secret.
Paste both values into PopMCP and authorize
On PopMCP's Google Docs connect form, paste the values into OAuth Client ID and OAuth Client Secret, then click Authorize with Google. Choose the Google account whose documents the AI should reach. On the Google hasn't verified this app screen click Advanced and continue to your app, then allow the Google Drive permission.
Connect in PopMCP
Open your workspace, choose Google Docs in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| OAuth Client IDtext | Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. On the same project, enable BOTH the Google Docs API and the Google Drive API (APIs & Services → Library). Docs alone cannot find, rename, share or export a document, so Drive is what makes those work. |
| OAuth Client Secretsecret | Shown once, in the popup right after you create the client. Google hashes it and never shows it again. If you closed that popup, open the client and add a new secret. Stored encrypted here, used server-side only. IMPORTANT: in Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first. Testing-mode apps get a refresh token that Google expires after exactly 7 days, so the connection would work for a week and then stop. Publishing does not require Google's review. It only adds a one-time "Google hasn't verified this app" screen, where you click Advanced and continue.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/google/callbackPopMCP verifies the credential against Google Docs immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Google Docs at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| https://www.googleapis.com/auth/drive | The one permission the connection asks for. It covers the Docs API, comments and suggestions included, and the Drive calls around it, so PopMCP can find a document by name or by the words inside it, read and edit it, copy a template, export it, and rename, move, share or trash the file. The narrower documents scopes cannot list, share or export a file. Google classes drive as a restricted scope, which is why the unverified-app warning appears on first consent. |
Verify it worked
After consent PopMCP shows Google Docs as Connected with the Google account's name and email. If the Docs API was left off, the connect stops with "The Google Docs API is not enabled in your Google Cloud project" instead. Ask the AI to list your documents and real document titles come back from your Drive.
Troubleshooting
Error 400: redirect_uri_mismatch
Why: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends, usually a trailing slash or http instead of https.
Fix: Open the client under Google Auth Platform → Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to take effect.
The connection works for about a week, then stops with invalid_grant
Why: The app is still in Testing on the Audience page, so Google expired the refresh token 7 days after consent. PopMCP reports it as Google's 7 day Testing-mode expiry.
Fix: Go to Google Auth Platform → Audience, click Publish app, then reconnect Google Docs in PopMCP. Reconnecting without publishing only buys another 7 days.
Connecting fails with "The Google Docs API is not enabled in your Google Cloud project"
Why: PopMCP probes the Docs API while connecting, and Google answered SERVICE_DISABLED for the project that owns the OAuth client.
Fix: Enable Google Docs API in APIs & Services → Library on that same project, wait a minute, then connect again.
Finding, sharing or exporting a document fails with 403 accessNotConfigured, or "Google Drive API has not been used in project"
Why: Only the Docs API was enabled. Search, rename, move, share, export and template copies all go through the Drive API.
Fix: Enable Google Drive API in APIs & Services → Library on the same project, then retry.
Error 400: admin_policy_enforced on Google's sign-in screen
Why: Your Google Workspace admin restricts which third-party apps can reach Drive, and this OAuth client is not trusted.
Fix: Ask the admin to allow the client ID under the Admin console's API controls (Manage third-party app access), or connect with an account outside that restriction.
429 Too many requests during a long run of edits
Why: A per-minute Docs quota ran out. Writes are the tightest: 60 per minute per user.
Fix: Wait a minute and retry. Ask for several changes in one call (insert_markdown or batch_update_document) instead of one request per edit.
The client secret is no longer visible in full
Why: Google hashes the secret after creation and only ever shows the last four characters.
Fix: Open the client under Clients and click Add secret, then update PopMCP and reconnect.