# Google Drive setup for PopMCP You end up pasting a Google OAuth Client ID and Client Secret from a Web application client you register in the Google Cloud console. - Auth: OAuth authorization - Setup time: 10 min - API base URL: https://www.googleapis.com/drive/v3 - Credentials screen: https://console.cloud.google.com/auth/clients - Provider docs: https://developers.google.com/workspace/drive/api/guides/about-sdk ## Approval required before this works The broad Drive scopes (drive, drive.readonly, drive.metadata, drive.activity) are Google restricted scopes, which need OAuth app verification plus an annual third-party CASA security assessment from a Google-approved assessor before the app can serve the public. - Typical wait: Google says restricted scope verification 'can potentially take several weeks to complete' and does not guarantee a timeframe; the CASA assessment is a separate engagement with an authorized lab and must be repeated at least every 12 months from the Letter of Assessment approval date. - Cost: Verification itself is free. The mandatory annual CASA assessment is paid directly to an App Defense Alliance authorized lab, and neither Google nor the ADA publishes pricing, so budget from an actual quote rather than a figure found online. Cost scales with the assurance level your data handling requires. - Blocked until approved: Public distribution with full-Drive access. Unverified, the app is limited to 100 test users, shows the unverified-app warning, and in Testing status issues refresh tokens that expire after 7 days. Restricted-scope data cannot be handled for outside users until the Letter of Assessment lands. - Works meanwhile: A great deal. The drive.file scope (create and open only the files the user picks, typically via the Google Picker) is documented by Google as non-sensitive and needs no verification at all, so an upload/open-this-file connector can ship immediately. Full-Drive access also works right away for yourself and up to 100 test users, and an 'Internal' Workspace app is not put through verification. ## Before you begin - A Google account, plus a Google Cloud project you own (creating one is free and needs no billing card) - Owner or Editor role on that Cloud project. Viewer cannot create OAuth clients - The PopMCP callback URL, shown on the Google Drive connect form. Copy it before you start - The Internal audience needs a Google Workspace organisation. Personal gmail.com accounts only get External ## Get your credentials ### 1. Create or select a Google Cloud project Open the Cloud console and pick a project from the picker in the top bar, or click New project. Keep that same project selected for every step below. Screen: https://console.cloud.google.com/projectcreate ### 2. Enable the Google Drive API Go to APIs & Services → Library, search for Google Drive API and open its card. Click Enable. Screen: https://console.cloud.google.com/flows/enableapi?apiid=drive.googleapis.com ### 3. Fill in Branding, then publish the app on Audience Open Google Auth Platform → Branding and enter App name, User support email and a developer contact address, then Save. Switch to Audience and click Publish app if Publishing status shows Testing. Screen: https://console.cloud.google.com/auth/audience ### 4. Open Clients and start a new OAuth client In the Google Auth Platform nav click Clients, then click Create client. Screen: https://console.cloud.google.com/auth/clients ### 5. Register a Web application client with the callback URL Set Application type to Web application and give the client a name you will recognise. Under Authorized redirect URIs click Add URI, paste the callback URL from the PopMCP Google Drive connect form exactly as shown, then click Create. Screen: https://console.cloud.google.com/auth/clients/create ### 6. Copy the client ID and secret into PopMCP Copy Client ID and Client secret out of the OAuth client created dialog and paste them into PopMCP's OAuth Client ID and OAuth Client Secret fields. If the dialog is already closed, open the client and click Add secret. ## Fields PopMCP asks for - OAuth Client ID (clientId) [required]: Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. Enable the Google Drive API on the same project first (APIs & Services → Library → Google Drive API → Enable), or the Drive permission won't be offered. - OAuth Client Secret (clientSecret) [required]: Shown once, in the popup right after you create the client. Google hashes it and never shows it again. If you closed that popup, open the client and add a new secret. Stored encrypted here, used server-side only. IMPORTANT: in Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first. Testing-mode apps get a refresh token that Google expires after exactly 7 days, so the connection would work for a week and then stop. Publishing does not require Google's review. It only adds a one-time "Google hasn't verified this app" screen, where you click Advanced and continue. ## Callback URL to register https://app.popmcp.com/api/providers/google/callback ## Scopes requested - https://www.googleapis.com/auth/drive ## Verify Back in PopMCP, click Connect, pick the Google account, click through the "Google hasn't verified this app" screen with Advanced → Go to (app), and grant Drive access. The connector flips to Connected and the Drive tools list files from your account. ## Troubleshooting ### Error 400: redirect_uri_mismatch Cause: The Authorized redirect URI on the client does not exactly match the callback URL PopMCP sends. Fix: Copy the callback URL straight from the PopMCP connect form into Clients → your client → Authorized redirect URIs. Watch for http vs https and a trailing slash. Changes can take a few minutes to propagate. ### Connection works for a week then stops with invalid_grant Cause: The app is still in Testing on the Audience page. Google expires refresh tokens issued to test users after exactly 7 days. Fix: Go to Google Auth Platform → Audience → Publish app, then reconnect in PopMCP to obtain a non-expiring refresh token. ### 403 accessNotConfigured, or "API has not been used in project" Cause: The Google Drive API was never enabled on the project that owns the OAuth client. Fix: Enable Google Drive API in APIs & Services → Library on the same project, wait a minute, then retry. ### Error 403: access_denied on the consent screen Cause: The app is External and still in Testing while the Google account is not on the test-user list, or the audience is Internal and the account sits outside the Workspace organisation. Fix: Publish the app, or add the account under Audience → Test users. ### The client secret is no longer visible in full Cause: Google hashes the secret after creation and only ever shows the last four characters. Fix: Open the client in Clients and click Add secret to mint a fresh one, then paste it into PopMCP. --- Source: https://www.docs.popmcp.com/docs/integrations/google-drive/