# Google Docs setup for PopMCP You end up pasting the OAuth Client ID and Client Secret of a Web application client you create in the Google Cloud console, on a project where both the Google Docs API and the Google Drive API are enabled. - Auth: OAuth authorization - Setup time: 10 min - API base URL: https://docs.googleapis.com/v1/documents - Credentials screen: https://console.cloud.google.com/auth/clients - Provider docs: https://developers.google.com/workspace/docs/api/how-tos/overview ## Approval required before this works The connection asks your OAuth client for the full Drive scope (drive), which Google's Docs API scope table labels Restricted. Serving users beyond your own team therefore needs Google's restricted-scope verification, plus a security assessment because the data passes through a server. - Typical wait: Google says restricted-scope verification 'can potentially take several weeks to complete', and brand verification typically takes 2-3 business days. The security assessment must be renewed at least every 12 months. - Cost: Verification itself is free. The security assessment is run under the App Defense Alliance's CASA framework by a Google-approved assessor who sets its own fee, so budget from a quote rather than a figure found online. - Blocked until approved: Wide distribution only. An unverified app shows the "Google hasn't verified this app" screen and is limited to 100 new users. Left in Testing, only listed test users can sign in and their refresh tokens expire 7 days after consent. - Works meanwhile: Everything, for your own team. Publish the app on the Audience page without submitting it for verification, click Advanced on the warning screen when you connect, and the connection keeps working past 7 days. An Internal app inside your Google Workspace organisation is not put through verification. ## Before you begin - A Google account that can open the documents you want the AI to work on, plus a Google Cloud project you own. Creating one is free and the Docs and Drive APIs need no billing account - Owner or Editor role on that Cloud project, so you can enable APIs and create OAuth clients - Both the Google Docs API and the Google Drive API enabled on the same project, because Docs alone cannot find, rename, share or export a document - The PopMCP callback URL, copied from the Google Docs connect form before you start - Personal gmail.com accounts can only use the External audience. Internal needs a Google Workspace organisation ## Get your credentials ### 1. Enable the Google Docs API and the Google Drive API Pick or create a project in the top bar, then open APIs & Services → Library. Search for Google Docs API and click Enable, then come back and do the same for Google Drive API. Screen: https://console.cloud.google.com/apis/library/docs.googleapis.com ### 2. Fill in the Google Auth Platform branding Open Google Auth Platform → Branding. If it says Google Auth platform not configured yet, click Get Started. Enter an App name and a User support email, choose External under Audience unless every user sits in your Workspace organisation, add an Email address under Contact Information, agree to the user data policy, then click Continue and Create. Screen: https://console.cloud.google.com/auth/branding ### 3. Publish the app Open Google Auth Platform → Audience. If Publishing status reads Testing, click Publish app and confirm. Publishing needs no review from Google; it only means the consent screen will show a one-time unverified-app warning. Screen: https://console.cloud.google.com/auth/audience ### 4. Create a Web application OAuth client Open Google Auth Platform → Clients and click Create client. Set Application type to Web application, name it `PopMCP Docs`, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form exactly as shown, and click Create. If you already made a client here for another PopMCP Google connector, you can reuse it. Screen: https://console.cloud.google.com/auth/clients/create ### 5. Copy the Client ID and Client Secret Copy the Client ID and Client secret from the OAuth client created dialog before you close it. If the dialog is already gone, open the client from Clients and click Add secret to mint a new one. Screen: https://console.cloud.google.com/auth/clients ### 6. Paste both values into PopMCP and authorize On PopMCP's Google Docs connect form, paste the values into OAuth Client ID and OAuth Client Secret, then click Authorize with Google. Choose the Google account whose documents the AI should reach. On the Google hasn't verified this app screen click Advanced and continue to your app, then allow the Google Drive permission. ## Fields PopMCP asks for - OAuth Client ID (clientId) [required]: Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. On the same project, enable BOTH the Google Docs API and the Google Drive API (APIs & Services → Library). Docs alone cannot find, rename, share or export a document, so Drive is what makes those work. - OAuth Client Secret (clientSecret) [required]: Shown once, in the popup right after you create the client. Google hashes it and never shows it again. If you closed that popup, open the client and add a new secret. Stored encrypted here, used server-side only. IMPORTANT: in Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first. Testing-mode apps get a refresh token that Google expires after exactly 7 days, so the connection would work for a week and then stop. Publishing does not require Google's review. It only adds a one-time "Google hasn't verified this app" screen, where you click Advanced and continue. ## Callback URL to register https://app.popmcp.com/api/providers/google/callback ## Scopes requested - https://www.googleapis.com/auth/drive ## Verify After consent PopMCP shows Google Docs as Connected with the Google account's name and email. If the Docs API was left off, the connect stops with "The Google Docs API is not enabled in your Google Cloud project" instead. Ask the AI to list your documents and real document titles come back from your Drive. ## Troubleshooting ### Error 400: redirect_uri_mismatch Cause: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends, usually a trailing slash or http instead of https. Fix: Open the client under Google Auth Platform → Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to take effect. ### The connection works for about a week, then stops with invalid_grant Cause: The app is still in Testing on the Audience page, so Google expired the refresh token 7 days after consent. PopMCP reports it as Google's 7 day Testing-mode expiry. Fix: Go to Google Auth Platform → Audience, click Publish app, then reconnect Google Docs in PopMCP. Reconnecting without publishing only buys another 7 days. ### Connecting fails with "The Google Docs API is not enabled in your Google Cloud project" Cause: PopMCP probes the Docs API while connecting, and Google answered SERVICE_DISABLED for the project that owns the OAuth client. Fix: Enable Google Docs API in APIs & Services → Library on that same project, wait a minute, then connect again. ### Finding, sharing or exporting a document fails with 403 accessNotConfigured, or "Google Drive API has not been used in project" Cause: Only the Docs API was enabled. Search, rename, move, share, export and template copies all go through the Drive API. Fix: Enable Google Drive API in APIs & Services → Library on the same project, then retry. ### Error 400: admin_policy_enforced on Google's sign-in screen Cause: Your Google Workspace admin restricts which third-party apps can reach Drive, and this OAuth client is not trusted. Fix: Ask the admin to allow the client ID under the Admin console's API controls (Manage third-party app access), or connect with an account outside that restriction. ### 429 Too many requests during a long run of edits Cause: A per-minute Docs quota ran out. Writes are the tightest: 60 per minute per user. Fix: Wait a minute and retry. Ask for several changes in one call (insert_markdown or batch_update_document) instead of one request per edit. ### The client secret is no longer visible in full Cause: Google hashes the secret after creation and only ever shows the last four characters. Fix: Open the client under Clients and click Add secret, then update PopMCP and reconnect. --- Source: https://www.docs.popmcp.com/docs/integrations/google-docs/