# Google Sheets setup for PopMCP

You end up pasting the OAuth Client ID and Client Secret of a Web application client you register in the Google Cloud console under Google Auth Platform > Clients.

- Auth: OAuth authorization
- Setup time: 12 min
- API base URL: https://sheets.googleapis.com/v4/spreadsheets
- Credentials screen: https://console.cloud.google.com/auth/clients
- Provider docs: https://developers.google.com/workspace/sheets/api/guides/concepts

## Approval required before this works

Google Cloud Console labels the spreadsheets and spreadsheets.readonly scopes Sensitive, so Google's Trust and Safety team must verify your OAuth app before those scopes can be granted to users beyond your test list or your own Workspace organization.

- Typical wait: Google states sensitive scope verification typically takes 3-5 business days; developers commonly report one to several weeks in practice
- Cost: Free. The Sheets scopes are sensitive, not restricted, so no paid CASA security assessment applies unless you also request full Drive scopes.
- Blocked until approved: Public distribution only. Unverified external apps are capped at their test-user list (100 accounts), show the unverified-app warning screen, and in Testing status get refresh tokens that expire after 7 days, which breaks scheduled or unattended sheet syncs.
- Works meanwhile: Full read/write on any spreadsheet, immediately, for yourself and up to 100 test users. The drive.file scope is documented by Google as non-sensitive and, combined with the Google Picker, lets a production app read and write only user-selected spreadsheets with no verification at all. An 'Internal' Workspace app is not put through verification.

## Before you begin

- A Google account that can create Google Cloud projects, with no billing account required for the Sheets or Drive API
- Both the Google Sheets API and the Google Drive API enabled on the same project, because Sheets alone cannot search, list or share a spreadsheet
- The OAuth app moved to In production on the Audience page, because Testing-mode refresh tokens expire after 7 days
- PopMCP's callback URL copied from the connect form, to paste under Authorized redirect URIs

## Get your credentials

### 1. Enable the Sheets API and the Drive API

Pick or create a project in the top bar, then open APIs & Services > Library. Search for Google Sheets API and click Enable, then come back and do the same for Google Drive API.

Screen: https://console.cloud.google.com/apis/library/sheets.googleapis.com

### 2. Fill in the Google Auth Platform branding

Open Google Auth Platform > Branding. On a project that has never been configured, enter App name, User support email, set Audience to External, add a Developer contact email, and click Create.

Screen: https://console.cloud.google.com/auth/branding

### 3. Publish the app

Open Google Auth Platform > Audience. If Publishing status reads Testing, click Publish app and confirm.

Screen: https://console.cloud.google.com/auth/audience

### 4. Create a Web application OAuth client

Open Google Auth Platform > Clients and click Create client. Set Application type to Web application, name it `PopMCP`, click Add URI under Authorized redirect URIs, paste the callback URL from the PopMCP connect form, and click Create.

Screen: https://console.cloud.google.com/auth/clients/create

### 5. Copy the Client ID and Client Secret

Copy the Client ID and Client secret from the OAuth client created dialog before closing it.

### 6. Paste both values into PopMCP and authorize

Enter the OAuth Client ID and OAuth Client Secret in PopMCP and click connect. Approve the Drive scope on Google's consent screen.

## Fields PopMCP asks for

- OAuth Client ID (clientId) [required]: Google Cloud Console → Google Auth Platform → Clients → Create client → Web application, with the callback URL above under Authorized redirect URIs. On the same project, enable BOTH the Google Sheets API and the Google Drive API (APIs & Services → Library). Sheets alone cannot list, search or share a spreadsheet, so Drive is what makes finding one by name work.
- OAuth Client Secret (clientSecret) [required]: Shown once, in the popup right after you create the client. Google hashes it and never shows it again. If you closed that popup, open the client and add a new secret. Stored encrypted here, used server-side only. IMPORTANT: in Google Auth Platform → Audience, if the status says "Testing", click "Publish app" first. Testing-mode apps get a refresh token that Google expires after exactly 7 days, so the connection would work for a week and then stop. Publishing does not require Google's review. It only adds a one-time "Google hasn't verified this app" screen, where you click Advanced and continue.

## Callback URL to register

https://app.popmcp.com/api/providers/google/callback

## Scopes requested

- https://www.googleapis.com/auth/drive

## Verify

PopMCP shows Google Sheets as Connected with your Google account's email, and a search for a spreadsheet by name returns results from your Drive.

## Troubleshooting

### Error 400: redirect_uri_mismatch

Cause: The Authorized redirect URI in the client does not exactly match the callback PopMCP sends, usually a missing trailing slash or http instead of https.

Fix: Open the client under Google Auth Platform > Clients and paste the callback URL straight from the PopMCP connect form. Changes can take a few minutes to propagate.

### Connection works for about a week then returns invalid_grant

Cause: The project is still in Testing, so Google expired the refresh token seven days after consent.

Fix: Go to Google Auth Platform > Audience, click Publish app, then disconnect and reconnect in PopMCP to mint a fresh refresh token.

### 403 accessNotConfigured or "Google Drive API has not been used in project"

Cause: Only the Sheets API was enabled on the project.

Fix: Enable the Google Drive API in APIs & Services > Library on the same project, then retry. It can take a minute to take effect.

### "Google hasn't verified this app" warning on the consent screen

Cause: The client is published but not through Google's verification review, which is expected for an internal-use client.

Fix: Click Advanced, then Go to <app name> (unsafe), and continue. Complete App name, user support email and developer contact under Google Auth Platform > Branding if the screen is blocked instead of warned.

### Client secret is gone

Cause: Google hashes the secret and shows only the last four characters after the creation dialog closes.

Fix: Open the client under Clients, click Add Secret, then update PopMCP and reconnect.

---

Source: https://www.docs.popmcp.com/docs/integrations/google-sheets/