Google Sheets
Connect Google Sheets to find spreadsheets, read and write rows, add and format tabs, sort and filter data, build charts, and share the file.
You end up pasting the OAuth Client ID and Client Secret of a Web application client you register in the Google Cloud console under Google Auth Platform > Clients.
OAuth scope verification before this connector works
Google Cloud Console labels the spreadsheets and spreadsheets.readonly scopes Sensitive, so Google's Trust and Safety team must verify your OAuth app before those scopes can be granted to users beyond your test list or your own Workspace organization.
- Typical wait
- Google states sensitive scope verification typically takes 3-5 business days; developers commonly report one to several weeks in practice
- Cost
- Free. The Sheets scopes are sensitive, not restricted, so no paid CASA security assessment applies unless you also request full Drive scopes.
- Blocked until approved
- Public distribution only. Unverified external apps are capped at their test-user list (100 accounts), show the unverified-app warning screen, and in Testing status get refresh tokens that expire after 7 days, which breaks scheduled or unattended sheet syncs.
- Works meanwhile
- Full read/write on any spreadsheet, immediately, for yourself and up to 100 test users. The drive.file scope is documented by Google as non-sensitive and, combined with the Google Picker, lets a production app read and write only user-selected spreadsheets with no verification at all. An 'Internal' Workspace app is not put through verification.
Where to apply: Google Cloud Console > APIs & Services > OAuth consent screen: complete Branding, list the Sheets scopes on the Data Access page, publish the app, then submit for verification with a homepage, same-domain privacy policy and a demo video.
- Google's Sheets scopes table labels spreadsheets and spreadsheets.readonly Sensitive, drive.file Non-sensitive, and drive and drive.readonly Restricted. Pairing Sheets with full drive or drive.readonly moves you into restricted-scope territory, which adds the paid annual CASA assessment; use drive.file if you can.
- Privacy policy must be on the same verified domain as the homepage and linked from the consent screen.
- The authorized domain must be verified in Google Search Console by an account that is Owner or Editor on the Cloud project.
- The demo video must show the consent screen, the OAuth client ID in the address bar, and each scope genuinely in use.
- Adding scopes after approval re-triggers review.
- spreadsheets.readonly is Sensitive too, so read-only does not exempt you.
- Setup time
- 12 min
- Auth
- OAuth authorization
- API base URL
- https://sheets.googleapis.com/v4/spreadsheets
- Rate limits
- Sheets API allows 300 read and 300 write requests per minute per project, and 60 of each per minute per user, refilled every minute.
Before you begin
- A Google account that can create Google Cloud projects, with no billing account required for the Sheets or Drive API
- Both the Google Sheets API and the Google Drive API enabled on the same project, because Sheets alone cannot search, list or share a spreadsheet
- The OAuth app moved to In production on the Audience page, because Testing-mode refresh tokens expire after 7 days
- PopMCP's callback URL copied from the connect form, to paste under Authorized redirect URIs
Get your credentials
Enable the Sheets API and the Drive API
Pick or create a project in the top bar, then open APIs & Services > Library. Search for Google Sheets API and click Enable, then come back and do the same for Google Drive API.
Google Sheets API
Reads and writes Google Sheets.
- Service name
- sheets.googleapis.com
- Project
- acme-mcp-prod
- Status
- Not enabled
Repeat at console.cloud.google.com/apis/library/drive.googleapis.com for the Drive API.
Fill in the Google Auth Platform branding
Open Google Auth Platform > Branding. On a project that has never been configured, enter App name, User support email, set Audience to External, add a Developer contact email, and click Create.
Publish the app
Open Google Auth Platform > Audience. If Publishing status reads Testing, click Publish app and confirm.
Audience
Choose who can authorize this app to access their account data.
| Test users | Added |
|---|---|
| ops@acme.com | Mar 4, 2026 |
Once published this reads In production and the test-user list no longer applies.
Create a Web application OAuth client
Open Google Auth Platform > Clients and click Create client. Set Application type to Web application, name it PopMCP, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form, and click Create.
Create OAuth client ID
A client ID identifies a single app to Google's OAuth servers.
Google matches the redirect URI character for character, including the trailing slash.
Copy the Client ID and Client Secret
Copy the Client ID and Client secret from the OAuth client created dialog before closing it.
Clients
| Name | Type | Client ID | Creation date |
|---|---|---|---|
| PopMCPWeb application | Web | 5031****-a7q2 | Mar 4, 2026 |
After this dialog closes the console shows only the last four characters of the secret.
Paste both values into PopMCP and authorize
Enter the OAuth Client ID and OAuth Client Secret in PopMCP and click connect. Approve the Drive scope on Google's consent screen.
Connect in PopMCP
Open your workspace, choose Google Sheets in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| OAuth Client IDtext | Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. On the same project, enable BOTH the Google Sheets API and the Google Drive API (APIs & Services → Library). Sheets alone cannot list, search or share a spreadsheet, so Drive is what makes finding one by name work. |
| OAuth Client Secretsecret | Shown once, in the popup right after you create the client. Google hashes it and never shows it again. If you closed that popup, open the client and add a new secret. Stored encrypted here, used server-side only. IMPORTANT: in Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first. Testing-mode apps get a refresh token that Google expires after exactly 7 days, so the connection would work for a week and then stop. Publishing does not require Google's review. It only adds a one-time "Google hasn't verified this app" screen, where you click Advanced and continue.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/google/callbackPopMCP verifies the credential against Google Sheets immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Google Sheets at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| https://www.googleapis.com/auth/drive | Covers both the spreadsheet contents and the file itself, so PopMCP can search for a sheet by name, create new ones and change sharing. The narrower spreadsheets scope can only open a file whose id you already know. |
Verify it worked
PopMCP shows Google Sheets as Connected with your Google account's email, and a search for a spreadsheet by name returns results from your Drive.
Troubleshooting
Error 400: redirect_uri_mismatch
Why: The Authorized redirect URI in the client does not exactly match the callback PopMCP sends, usually a missing trailing slash or http instead of https.
Fix: Open the client under Google Auth Platform > Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to propagate.
Connection works for about a week then returns invalid_grant
Why: The project is still in Testing, so Google expired the refresh token seven days after consent.
Fix: Go to Google Auth Platform > Audience, click Publish app, then disconnect and reconnect in PopMCP to mint a fresh refresh token.
403 accessNotConfigured or "Google Drive API has not been used in project"
Why: Only the Sheets API was enabled on the project.
Fix: Enable the Google Drive API in APIs & Services > Library on the same project, then retry. It can take a minute to take effect.
"Google hasn't verified this app" warning on the consent screen
Why: The client is published but not through Google's verification review, which is expected for an internal-use client.
Fix: Click Advanced, then Go to <app name> (unsafe), and continue. Complete App name, user support email and developer contact under Google Auth Platform > Branding if the screen is blocked instead of warned.
Client secret is gone
Why: Google hashes the secret and shows only the last four characters after the creation dialog closes.
Fix: Open the client under Clients, click Add Secret, then update PopMCP and reconnect.