Google Drive
Connect Google Drive to search files, read and write documents, organize folders, manage sharing, and track comments and changes.
You end up pasting a Google OAuth Client ID and Client Secret from a Web application client you register in the Google Cloud console.
OAuth scope verification before this connector works
The broad Drive scopes (drive, drive.readonly, drive.metadata, drive.activity) are Google restricted scopes, which need OAuth app verification plus an annual third-party CASA security assessment from a Google-approved assessor before the app can serve the public.
- Typical wait
- Google says restricted scope verification 'can potentially take several weeks to complete' and does not guarantee a timeframe; the CASA assessment is a separate engagement with an authorized lab and must be repeated at least every 12 months from the Letter of Assessment approval date.
- Cost
- Verification itself is free. The mandatory annual CASA assessment is paid directly to an App Defense Alliance authorized lab, and neither Google nor the ADA publishes pricing, so budget from an actual quote rather than a figure found online. Cost scales with the assurance level your data handling requires.
- Blocked until approved
- Public distribution with full-Drive access. Unverified, the app is limited to 100 test users, shows the unverified-app warning, and in Testing status issues refresh tokens that expire after 7 days. Restricted-scope data cannot be handled for outside users until the Letter of Assessment lands.
- Works meanwhile
- A great deal. The drive.file scope (create and open only the files the user picks, typically via the Google Picker) is documented by Google as non-sensitive and needs no verification at all, so an upload/open-this-file connector can ship immediately. Full-Drive access also works right away for yourself and up to 100 test users, and an 'Internal' Workspace app is not put through verification.
Where to apply: Google Cloud Console > APIs & Services > OAuth consent screen: complete Branding, declare the Drive scopes on the Data Access page, publish the app and submit for verification; Google then routes you to the App Defense Alliance CASA flow to engage an approved assessor.
- Requesting drive or drive.readonly when drive.file would work is the single biggest self-inflicted cost here; Google labels drive and drive.readonly Restricted and drive.file Non-sensitive.
- CASA is assessed at an assurance level (AL1 or AL2) and both are lab-verified by an ADA-authorized assessor; there is no developer self-scan path any more, so plan for a lab engagement.
- The assessment is annual, not one-off, and lapsing it revokes production access.
- 'Internal' user type is not a blanket exemption: restricted Workspace services including Drive can still need a Workspace admin to allow the app.
- Privacy policy must be hosted on the verified app domain and cover Google user data handling and deletion.
- The Limited Use requirements ban using Drive content for advertising, selling data, or training generalized AI/ML models; declaring an AI feature without human-review carve-outs draws extra scrutiny.
- The demo video must show each restricted scope in genuine use end to end.
- Adding a restricted scope to an already-verified app restarts the whole process, assessment included.
- Setup time
- 10 min
- Auth
- OAuth authorization
- API base URL
- https://www.googleapis.com/drive/v3
- Rate limits
- Default Drive API quota is 1,000,000 quota units per minute per project and 325,000 per minute per user. Going over returns 403 rate-limit errors that should be retried with backoff.
Before you begin
- A Google account, plus a Google Cloud project you own (creating one is free and needs no billing card)
- Owner or Editor role on that Cloud project. Viewer cannot create OAuth clients
- The PopMCP callback URL, shown on the Google Drive connect form. Copy it before you start
- The Internal audience needs a Google Workspace organisation. Personal gmail.com accounts only get External
Get your credentials
Create or select a Google Cloud project
Open the Cloud console and pick a project from the picker in the top bar, or click New project. Keep that same project selected for every step below.
Enable the Google Drive API
Go to APIs & Services → Library, search for Google Drive API and open its card. Click Enable.
Fill in Branding, then publish the app on Audience
Open Google Auth Platform → Branding and enter App name, User support email and a developer contact address, then Save. Switch to Audience and click Publish app if Publishing status shows Testing.
Audience
Choose who can authorize your app to access their Google Account data.
- User type
- External
- Publishing status
- Testing
| Test user | Added |
|---|---|
| you@example.comProject owner | Mar 4, 2026 |
After publishing, the status reads In production.
Open Clients and start a new OAuth client
In the Google Auth Platform nav click Clients, then click Create client.
Clients
OAuth clients that let your app request access to Google user data.
| Name | Type | Client ID | Status | Creation date |
|---|---|---|---|---|
| Internal toolsLegacy client | Web application | 8412****-a1b2.apps.googleusercontent.com | Enabled | Mar 4, 2026 |
This page replaced APIs & Services → Credentials.
Register a Web application client with the callback URL
Set Application type to Web application and give the client a name you will recognise. Under Authorized redirect URIs click Add URI, paste the callback URL from the PopMCP Google Drive connect form exactly as shown, then click Create.
Create OAuth client ID
A client ID identifies your app to Google's OAuth servers.
Leave Authorized JavaScript origins empty. PopMCP calls Google server-side.
Copy the client ID and secret into PopMCP
Copy Client ID and Client secret out of the OAuth client created dialog and paste them into PopMCP's OAuth Client ID and OAuth Client Secret fields. If the dialog is already closed, open the client and click Add secret.
Clients
Google hashes the secret. After this dialog only the last four characters are shown.
Connect in PopMCP
Open your workspace, choose Google Drive in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| OAuth Client IDtext | Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. Enable the Google Drive API on the same project first (APIs & Services → Library → Google Drive API → Enable), or the Drive permission won't be offered. |
| OAuth Client Secretsecret | Shown once, in the popup right after you create the client. Google hashes it and never shows it again. If you closed that popup, open the client and add a new secret. Stored encrypted here, used server-side only. IMPORTANT: in Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first. Testing-mode apps get a refresh token that Google expires after exactly 7 days, so the connection would work for a week and then stop. Publishing does not require Google's review. It only adds a one-time "Google hasn't verified this app" screen, where you click Advanced and continue.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/google/callbackPopMCP verifies the credential against Google Drive immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Google Drive at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| https://www.googleapis.com/auth/drive | Full read and write access to files and folders in the connecting user's Drive, so PopMCP can search, read, create, move and share. Google classes this as a restricted scope, which is why the unverified-app warning appears on first consent. |
Verify it worked
Back in PopMCP, click Connect, pick the Google account, click through the "Google hasn't verified this app" screen with Advanced → Go to (app), and grant Drive access. The connector flips to Connected and the Drive tools list files from your account.
Troubleshooting
Error 400: redirect_uri_mismatch
Why: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends.
Fix: Copy the callback URL straight from the PopMCP connect form into Clients → your client → Authorized redirect URIs. Watch for http vs https and a trailing slash. Changes can take a few minutes to propagate.
Connection works for a week then stops with invalid_grant
Why: The app is still in Testing on the Audience page. Google expires refresh tokens issued to test users after exactly 7 days.
Fix: Go to Google Auth Platform → Audience → Publish app, then reconnect in PopMCP to obtain a non-expiring refresh token.
403 accessNotConfigured, or "API has not been used in project"
Why: The Google Drive API was never enabled on the project that owns the OAuth client.
Fix: Enable Google Drive API in APIs & Services → Library on the same project, wait a minute, then retry.
Error 403: access_denied on the consent screen
Why: The app is External and still in Testing while the Google account is not on the test-user list, or the audience is Internal and the account sits outside the Workspace organisation.
Fix: Publish the app, or add the account under Audience → Test users.
The client secret is no longer visible in full
Why: Google hashes the secret after creation and only ever shows the last four characters.
Fix: Open the client in Clients and click Add secret to mint a fresh one, then paste it into PopMCP.
Reference
Google Calendar
Connect Google Calendar to see what is coming up, book and reschedule meetings, add Google Meet links, check who is free, and manage sharing.
Google Sheets
Connect Google Sheets to find spreadsheets, read and write rows, add and format tabs, sort and filter data, build charts, and share the file.