{"slug":"google-drive","name":"Google Drive","domain":"drive.google.com","category":"File storage","summary":"You can register a Google Cloud OAuth client and connect your own account in under an hour. A public launch with full-Drive scopes (drive, drive.readonly) is harder: those scopes are restricted, so you need brand verification, a demo video, restricted-scope review and a paid CASA security assessment every year. If drive.file (non-sensitive) is enough for your app, you only need brand verification.","tier":"gated","tierReason":"A typical Drive integration needs the restricted drive or drive.readonly scope, and public launch with those scopes requires a paid annual CASA security assessment from a Google-empanelled assessor.","quality":"researched","updatedAt":"2026-10-28","composio":{"status":"managed","note":"Composio has a managed Google OAuth app for Google Drive, so you can prototype without registering your own. Before launch, register your own client so your app's name appears on the consent screen. You will then have to go through Google's verification and CASA yourself.","toolkit":"googledrive"},"totals":{"effort":{"min":3,"max":10,"unit":"days"},"wait":{"min":2,"max":8,"unit":"weeks"},"firstConnection":"Today, in about 30–60 minutes, as a test user in Testing mode"},"stages":[{"id":"build","name":"Your account","whoCanConnect":"You, added as a test user on an External app in Testing status. On an Internal app, anyone in your Google Workspace organization.","userSees":"A Google warning that the app hasn't been verified, then the consent screen. Test-user authorizations and refresh tokens expire after 7 days.","effort":{"min":30,"max":60,"unit":"minutes"},"wait":{"min":0,"max":0,"unit":"minutes"},"unlock":"Add other Google accounts as test users (up to 100).","evidence":{"kind":"docs","sources":["s5","s6","s7"],"confidence":"high"}},{"id":"beta","name":"Test users or unverified production","whoCanConnect":"Up to 100 listed test users in Testing mode. Or, once you publish to production without verification, up to 100 new users in total who click through the unverified-app screen.","userSees":"The unverified-app warning screen before consent. In Testing mode, tokens expire after 7 days.","effort":{"min":10,"max":30,"unit":"minutes"},"wait":{"min":0,"max":0,"unit":"minutes"},"unlock":"Publish the app, then pass verification: brand verification, plus restricted-scope review and a CASA assessment if you use restricted scopes.","evidence":{"kind":"docs","sources":["s3","s5"],"confidence":"high"}},{"id":"launch","name":"Verified public app","whoCanConnect":"Anyone with a Google Account.","userSees":"A normal consent screen with your app name and logo and no warning.","effort":{"min":3,"max":10,"unit":"days"},"wait":{"min":2,"max":8,"unit":"weeks"},"unlock":null,"evidence":{"kind":"community","sources":["s4","s8","s9","s11","s12"],"confidence":"medium"}}],"requirements":[{"id":"google-account-cloud-project","label":"Google account and Google Cloud project","detail":"Any Google account can create a Cloud project. Internal apps also need a Google Cloud Organization (Workspace).","stage":"build","actor":"you","evidence":{"kind":"docs","sources":["s5","s10"],"confidence":"high"}},{"id":"redirect-uri","label":"Your OAuth client's redirect URI","detail":"This is the callback URL of whatever OAuth client you use. It goes in Authorized redirect URIs.","stage":"build","actor":"agent","evidence":{"kind":"docs","sources":["s7"],"confidence":"high"}},{"id":"verified-domain","label":"Verified domain and public homepage","detail":"You must verify every authorized domain in Google Search Console. The homepage must be on that domain and not behind a login.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s4","s9"],"confidence":"high"}},{"id":"privacy-policy","label":"Privacy policy on the same domain","detail":"Link it from your homepage and the consent screen. It must disclose how you access, use, store and share Google user data, including the Limited Use statement.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s4","s9"],"confidence":"high"}},{"id":"demo-video","label":"Demo video","detail":"Required for sensitive and restricted scopes. It must show the full OAuth flow, with the consent screen in English and the exact scopes, plus each feature that uses them.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s4"],"confidence":"high"}},{"id":"casa-assessment","label":"CASA security assessment (restricted scopes)","detail":"An annual assessment by a Google-empanelled assessor that ends in a Letter of Validation. You pay for it: developers report about $540–$720 a year for Tier 2.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s8","s9","s11"],"confidence":"medium"}},{"id":"allowed-use-case","label":"An allowed use case for restricted scopes","detail":"Restricted Drive scopes are limited to backup and sync, productivity and education, and reporting and security apps.","stage":"launch","actor":"you","evidence":{"kind":"docs","sources":["s1"],"confidence":"high"}}],"steps":[{"id":"create-project","title":"Create a Google Cloud project","actor":"you","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Sign in to the Google Cloud console and create or select a project for the integration. Consider a separate dev project: it gives you a second pool of 100 test users.","actions":["Open console.cloud.google.com and sign in","Create a new project"],"agentNote":"Once you're signed in, an agent can create the project.","gotcha":"Review emails go to project owners and editors. Use a monitored shared address and add a second editor.","link":{"label":"Google Cloud console","url":"https://console.cloud.google.com/projectcreate"},"evidence":{"kind":"docs","sources":["s10","s9"],"confidence":"high"}},{"id":"enable-drive-api","title":"Enable the Google Drive API","actor":"agent","stage":"build","time":{"min":2,"max":5,"unit":"minutes"},"detail":"Enable the Google Drive API for the project in the API Library.","actions":["APIs & Services > Library > search 'Google Drive API' > Enable"],"agentNote":"An agent can do this in the signed-in console.","link":{"label":"Drive API in API Library","url":"https://console.cloud.google.com/apis/library/drive.googleapis.com"},"evidence":{"kind":"docs","sources":["s10"],"confidence":"high"}},{"id":"configure-branding","title":"Set up Google Auth Platform branding","actor":"you","stage":"build","time":{"min":5,"max":15,"unit":"minutes"},"detail":"Under Google Auth platform > Branding, click Get Started. Enter the app name, support email, audience (External for customers) and contact email, then accept the Google API Services User Data Policy.","actions":["Fill in the App name and User support email","Choose the audience: External","Enter the developer contact email","Agree to the User Data Policy and click Create"],"agentNote":"An agent can fill in the fields. You must accept the User Data Policy yourself.","gotcha":"Choose Internal only if all your users are in your own Workspace organization. Outside users then get an org_internal error.","link":{"label":"Branding","url":"https://console.developers.google.com/auth/branding"},"evidence":{"kind":"docs","sources":["s6","s5"],"confidence":"high"}},{"id":"add-scopes","title":"Add Drive scopes under Data Access","actor":"agent","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Add only the scopes you will use. drive.file is non-sensitive and avoids CASA. drive and drive.readonly are restricted.","actions":["Data Access > Add or Remove Scopes","Select e.g. https://www.googleapis.com/auth/drive.file or .../auth/drive","Save"],"agentNote":"An agent can select the scopes once you decide which ones to use.","gotcha":"If the scopes your code requests differ from the ones configured here, users see the unverified screen and verification is rejected.","link":{"label":"Data Access","url":"https://console.developers.google.com/auth/scopes"},"evidence":{"kind":"docs","sources":["s1","s6","s3","s9"],"confidence":"high"}},{"id":"add-test-users","title":"Add test users","actor":"agent","stage":"build","time":{"min":2,"max":5,"unit":"minutes"},"detail":"Under Audience > Test users, add your own Google account and any testers. You can add up to 100.","actions":["Audience > Add users > enter emails > Save"],"agentNote":"An agent can add the email addresses you give it.","gotcha":"Test users count against the quota for good once added, and their tokens expire after 7 days.","link":{"label":"Audience","url":"https://console.developers.google.com/auth/audience"},"evidence":{"kind":"docs","sources":["s5","s9"],"confidence":"high"}},{"id":"create-client","title":"Create a Web application OAuth client","actor":"agent","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Under Google Auth platform > Clients, click Create Client, choose Web application, and add your redirect URI under Authorized redirect URIs. You can tick 'Use this client for an AI-powered agent' only at creation time.","actions":["Clients > Create Client","Application type: Web application","Name it","Authorized redirect URIs > Add URI > your redirect URI","Create"],"agentNote":"An agent can fill in the form and copy the client ID. You should copy the client secret into your OAuth client yourself.","gotcha":"The redirect URI must match exactly, including scheme, path and trailing slash.","link":{"label":"Clients","url":"https://console.developers.google.com/auth/clients"},"evidence":{"kind":"docs","sources":["s7"],"confidence":"high"}},{"id":"store-credentials","title":"Put client ID and secret in your OAuth client","actor":"you","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Copy the client secret into your OAuth client's configuration and keep it out of shared logs. Request offline access if you need refresh tokens.","agentNote":"Do this yourself. Do not give the client secret to an agent.","evidence":{"kind":"inferred","sources":["s7"],"confidence":"medium"}},{"id":"test-connection","title":"Connect your own Drive account","actor":"agent","stage":"build","time":{"min":5,"max":10,"unit":"minutes"},"detail":"Run the OAuth flow as a test user, click through the unverified warning and confirm the API calls work.","agentNote":"An agent can run the test once you are signed in to the test Google account.","gotcha":"Under Google's granular consent, users can untick individual scopes. Handle missing permissions in your app.","evidence":{"kind":"docs","sources":["s5","s9"],"confidence":"medium"}},{"id":"prepare-brand-assets","title":"Verify domain, publish homepage and privacy policy","actor":"you","stage":"launch","time":{"min":1,"max":2,"unit":"days"},"detail":"Verify your domains in Search Console. Publish a public homepage and a privacy policy on the same domain, and add both links to Branding.","actions":["Verify domain ownership in Google Search Console as project owner or editor","Add the homepage, privacy policy and authorized domains in Branding"],"agentNote":"An agent can fill in the Branding fields. You handle DNS verification and the policy text.","gotcha":"Leave out the Limited Use disclosure and your app gets rejected.","link":{"label":"Branding","url":"https://console.developers.google.com/auth/branding"},"evidence":{"kind":"docs","sources":["s4","s9"],"confidence":"high"}},{"id":"publish-and-submit","title":"Publish the app and submit for verification","actor":"you","stage":"launch","time":{"min":3,"max":8,"unit":"hours"},"detail":"Click Publish App to move to production. Apps in Testing can't be verified. Then click Prepare for Verification, write a justification for each scope, attach the demo video and click Submit.","actions":["Audience > Publish app","Prepare for Verification","Write a justification for each scope, naming the feature and why a narrower scope won't work","Attach a demo video (unlisted YouTube link)","Submit for Verification"],"agentNote":"An agent can draft the scope justifications. You record the video and submit.","gotcha":"Clicking 'Proceed' on each fixed error doesn't resubmit. You must click Submit at the bottom.","link":{"label":"Verification Center","url":"https://console.developers.google.com/auth/verification"},"evidence":{"kind":"docs","sources":["s10","s4","s9"],"confidence":"high"}},{"id":"google-review","title":"Wait for Google's Trust & Safety review","actor":"provider","stage":"launch","time":{"min":3,"max":14,"unit":"days"},"detail":"Google checks branding, scopes and the video by email. Developers report a first reply within days. Sensitive-only apps often finish within a week.","gotcha":"Reply quickly. Stale contact emails have stalled reviews for weeks.","evidence":{"kind":"community","sources":["s9","s11"],"confidence":"medium"}},{"id":"casa-assessment","title":"Complete the CASA security assessment","actor":"you","stage":"launch","time":{"min":1,"max":3,"unit":"weeks"},"detail":"For restricted scopes, Google contacts you to start CASA. Pick an empanelled assessor (e.g. TAC Security), pay, run the scans, fix findings and fill in the questionnaire to get a Letter of Validation.","actions":["Wait for Google's CASA email","Contract an assessor","Run a pre-scan (e.g. the free Fluid Attacks scanner) and fix high and medium findings","Submit the questionnaire and evidence"],"agentNote":"An agent can help triage scan findings. You handle the contract, payment and submission.","gotcha":"The self-scan option was removed in 2024, so you must use a paid assessor. Some developers report waiting a long time for the CASA instruction email.","link":{"label":"Security assessment","url":"https://support.google.com/cloud/answer/13465431"},"evidence":{"kind":"community","sources":["s8","s9","s11","s12","s13"],"confidence":"medium"}},{"id":"annual-recert","title":"Renew CASA every 12 months","actor":"you","stage":"launch","time":{"min":1,"max":5,"unit":"days"},"detail":"Restricted-scope apps must be revalidated every year, or the Letter of Validation lapses. Set a reminder 60–90 days ahead.","evidence":{"kind":"docs","sources":["s8","s9"],"confidence":"high"}}],"scopes":{"intro":"Google classifies every Drive scope, and the classification sets the review path. All scopes start with https://www.googleapis.com/auth/.","tiers":[{"scope":"drive.file","grants":"Only files the user creates with, opens with or picks in your app","level":"basic","consequence":"Brand verification only. No demo video or CASA."},{"scope":"drive.appdata / drive.install","grants":"Your app's hidden config folder / 'Open with' integration","level":"basic","consequence":"Brand verification only."},{"scope":"drive.apps.readonly","grants":"See which apps the user has authorized in Drive","level":"sensitive","consequence":"Sensitive-scope verification: justification and demo video."},{"scope":"drive, drive.readonly","grants":"Read (and write) all of the user's Drive files","level":"restricted","consequence":"Restricted-scope review, an allowed use case and a paid annual CASA assessment (if you store or transmit the data on servers)."},{"scope":"drive.metadata, drive.metadata.readonly, drive.activity, drive.activity.readonly, drive.meet.readonly, drive.scripts","grants":"Metadata, activity, Meet files and Apps Script","level":"restricted","consequence":"Restricted-scope review and CASA."}]},"blockers":[{"symptom":"'Google hasn't verified this app' screen, and new users blocked after 100","cause":"The app requests sensitive or restricted scopes without completed verification. Unverified apps are capped at 100 new users.","fix":"Complete verification, or switch to drive.file if it covers your use case.","evidence":{"kind":"docs","sources":["s3"],"confidence":"high"}},{"symptom":"Refresh tokens stop working after 7 days (invalid_grant)","cause":"The app is in Testing status. Test-user authorizations expire after 7 days.","fix":"Publish the app to production. Without verification, the unverified warning and 100-user cap still apply.","evidence":{"kind":"docs","sources":["s5"],"confidence":"high"}},{"symptom":"Error 403: access_denied for a user","cause":"The app is in Testing and the user isn't on the test-user list.","fix":"Add the user under Audience > Test users, or publish the app.","evidence":{"kind":"docs","sources":["s5"],"confidence":"medium"}},{"symptom":"Verification rejected for a scope mismatch or incomplete video","cause":"The scopes in code differ from Data Access, or the video leaves out the consent screen or features.","fix":"Make the requested scopes match exactly, and re-record the video showing the full English consent screen and every scoped feature.","evidence":{"kind":"community","sources":["s4","s9"],"confidence":"medium"}},{"symptom":"Status stuck at 'verification pending CASA' with no instructions","cause":"The CASA instruction email is delayed or goes to an unmonitored address.","fix":"Check project owner and editor emails, and follow up through the verification contact.","evidence":{"kind":"community","sources":["s13","s11"],"confidence":"low"}}],"unknowns":[{"question":"What is Google's official turnaround time for each verification type?","why":"The official pages I fetched give no timelines. The figures above come from developers and vendors.","resolve":"Check the Verification Center status in the console, or Google's verification FAQ."},{"question":"What does CASA cost right now?","why":"Prices come from third parties (Aug 2025) and depend on the assessor.","resolve":"Get quotes from assessors on the App Defense Alliance CASA list."},{"question":"Does a client-only app with restricted scopes still need CASA?","why":"The Drive scopes page ties the assessment to server storage or transmission, but the CASA page doesn't make that distinction.","resolve":"Ask the OAuth review team during verification."}],"handoff":{"agentCan":["Enable the Drive API","Fill in the Branding, Data Access and Audience forms","Create the Web OAuth client and add your redirect URI","Add test users","Run a test connection","Draft scope justifications"],"youMust":["Sign in and create the Google Cloud project","Accept the User Data Policy","Handle the client secret","Verify domain ownership and publish the privacy policy","Record the demo video and submit for verification","Contract and pay a CASA assessor, then renew every year"]},"sources":[{"id":"s1","title":"Choose Google Drive API scopes","url":"https://developers.google.com/workspace/drive/api/guides/api-specific-auth","publisher":"Google for Developers","kind":"official","checkedAt":"2026-10-28"},{"id":"s2","title":"Managed auth toolkits","url":"https://docs.composio.dev/toolkits/managed-auth.md","publisher":"Composio docs","kind":"composio","checkedAt":"2026-10-28"},{"id":"s3","title":"Unverified apps","url":"https://support.google.com/cloud/answer/7454865","publisher":"Google Cloud Help","kind":"official","checkedAt":"2026-10-28"},{"id":"s4","title":"Verification requirements","url":"https://support.google.com/cloud/answer/13464321","publisher":"Google Cloud Help","kind":"official","checkedAt":"2026-10-28"},{"id":"s5","title":"Manage app audience","url":"https://support.google.com/cloud/answer/15549945","publisher":"Google Cloud Help","kind":"official","checkedAt":"2026-10-28"},{"id":"s6","title":"Configure the OAuth consent screen","url":"https://developers.google.com/workspace/guides/configure-oauth-consent","publisher":"Google for Developers","kind":"official","checkedAt":"2026-10-28"},{"id":"s7","title":"Create access credentials","url":"https://developers.google.com/workspace/guides/create-credentials","publisher":"Google for Developers","kind":"official","checkedAt":"2026-10-28"},{"id":"s8","title":"Security assessment","url":"https://support.google.com/cloud/answer/13465431","publisher":"Google Cloud Help","kind":"official","checkedAt":"2026-10-28"},{"id":"s9","title":"Google security review","url":"https://nango.dev/docs/api-integrations/google-shared/google-security-review","publisher":"Nango docs","kind":"community","checkedAt":"2026-10-28"},{"id":"s10","title":"Submitting your app for verification","url":"https://support.google.com/cloud/answer/13461325","publisher":"Google Cloud Help","kind":"official","checkedAt":"2026-10-28"},{"id":"s11","title":"Casa verification","url":"https://groups.google.com/g/google-apps-script-community/c/XgsHT2Fr7u8","publisher":"Google Groups","kind":"search","checkedAt":null},{"id":"s12","title":"End of Google Drive integration (r/androiddev)","url":"https://reddit.birdcat.cafe/r/androiddev/comments/1b483a6/end_of_google_drive_integration/kt2195p/?context=3","publisher":"Reddit mirror","kind":"search","checkedAt":null},{"id":"s13","title":"CASA Assessment Required, but Instruction Email Not Received","url":"https://discuss.google.dev/t/casa-assessment-required-but-instruction-email-not-received/266520","publisher":"Google Developer forums","kind":"search","checkedAt":null}],"researchedAt":"2026-10-28T13:36:46.577Z","feedback":{}}