Set up Google OAuth for APIs

What OAuth does

OAuth lets a tool act on your behalf without giving it your Google password. You approve a small set of permissions, and Google returns tokens to the tool.

Create the project

1. Open Google Cloud Console and create or choose a project.
2. Open APIs & Services → Library and enable the API you need.
3. Keep unrelated automations in separate projects when ownership, billing, or risk differs.

Configure consent

Open Google Auth Platform and complete the branding and audience sections. During testing, add the Google accounts that are allowed to connect. A public app using sensitive or restricted scopes may need Google verification before launch.

Choose scopes

A scope is one permission. Ask for the smallest scope that completes the job. For example, access to files created by the app is safer than access to every file in Drive when the narrower option works.

Create the OAuth client

1. Create a client for a Web application when connecting a hosted tool such as n8n.
2. Copy the exact callback URL shown by that tool.
3. Add it to Authorized redirect URIs in Google Cloud.
4. Copy the client ID and client secret into the tool’s credential screen.
5. Connect the Google account and approve the requested scopes.

The callback must match exactly. Scheme, host, port, path, and trailing slash all matter.

Test it

Use the connected credential for one small read-only request. Confirm it uses the expected Google account and sees only the expected data.

Keep it safe

• Never commit the client secret or token files.
• Production apps should accurately describe who they are and why they need each scope.
• Refresh tokens can stop working after revocation, long inactivity, password changes, or account policy changes. Handle reconnection clearly.

Official references: Google OAuth overview, web server setup, and OAuth scopes.