The six little parts
- Client ID: the app’s public name tag.
- Client secret: the app’s password.
- Redirect URL: the one address Google may send you back to.
- Scope: the jobs you allow the app to do.
- Access token: a short-term pass.
- Refresh token: a way to get a new pass without signing in again.
The handshake
1n8n asks
→2You allow
→3Google returns a pass
→4n8n saves it
n8n sends you to Google. Google shows what n8n wants to do. You approve it. Google sends a temporary code back to the exact address saved earlier. n8n swaps that code for passes and stores them safely.
Why redirect mismatch happens
Google compares the return address character by character. http is different from https. One changed path or extra slash can break the match.
Least privilege
Choose the smallest scope that can complete the job. “Upload files created by this app” is safer than “read and modify every file” when the narrower scope is supported by the node and workflow.
Official overview: Google’s OAuth 2.0 documentation.