Skip to content

OAUTH_SETUP.md

Latest commit

 

History

History
178 lines (123 loc) · 5.66 KB

OAUTH_SETUP.md

File metadata and controls

178 lines (123 loc) · 5.66 KB
Raw

Creating Google OAuth Credentials

This guide walks you through creating OAuth 2.0 credentials in Google Cloud Console. You'll need these credentials to authenticate the Secure Workspace MCP server with your Google account.

Time required: 10-15 minutes

Step 1: Create or Select a Google Cloud Project

  1. Go to Google Cloud Console
  2. Sign in with your Google account
  3. Click the project dropdown at the top of the page
  4. Either:
    • Select an existing project, OR
    • Click "New Project", give it a name (e.g., "Claude Workspace MCP"), and click Create

Step 2: Enable Required APIs

  1. Go to APIs & Services > Library (or use this link)
  2. Search for and enable each of these APIs:
API Name Search Term
Gmail API gmail
Google Drive API drive
Google Docs API docs
Google Sheets API sheets
Google Calendar API calendar
Google Forms API forms
Google Slides API slides

For each API:

  1. Click on it in the search results
  2. Click Enable
  3. Wait for it to enable, then go back to the Library

Tip: You only need to enable APIs for services you plan to use. Gmail, Drive, and Calendar are the most common.

Step 3: Configure OAuth Consent Screen

  1. Go to APIs & Services > OAuth consent screen (or use this link)
  2. Select User Type:
    • Choose Internal if you have Google Workspace and want to limit to your organization
    • Choose External if using a personal Google account or want broader access
  3. Click Create

Fill in the consent screen details:

App Information:

  • App name: Claude Workspace Integration (or any name you prefer)
  • User support email: Your email address
  • App logo: (optional, skip)

App domain: (optional, skip all)

Developer contact information:

  • Email addresses: Your email address
  1. Click Save and Continue

Scopes:

  1. Click Add or Remove Scopes
  2. In the filter box, paste each scope below and check it:
openid
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/gmail.compose
https://www.googleapis.com/auth/gmail.modify
https://www.googleapis.com/auth/gmail.labels
https://www.googleapis.com/auth/drive
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/drive.file
https://www.googleapis.com/auth/documents.readonly
https://www.googleapis.com/auth/documents
https://www.googleapis.com/auth/spreadsheets.readonly
https://www.googleapis.com/auth/spreadsheets
https://www.googleapis.com/auth/calendar
https://www.googleapis.com/auth/calendar.readonly
https://www.googleapis.com/auth/calendar.events
https://www.googleapis.com/auth/forms.body
https://www.googleapis.com/auth/forms.body.readonly
https://www.googleapis.com/auth/forms.responses.readonly
https://www.googleapis.com/auth/presentations
https://www.googleapis.com/auth/presentations.readonly
  1. Click Update at the bottom
  2. Click Save and Continue

Test Users (External only):

If you chose "External" user type:

  1. Click Add Users
  2. Add your email address
  3. Click Save and Continue

Note: While your app is in "Testing" status, only test users you add can authorize it.

  1. Click Back to Dashboard

Step 4: Create OAuth Credentials

  1. Go to APIs & Services > Credentials (or use this link)
  2. Click Create Credentials at the top
  3. Select OAuth client ID

Configure the OAuth client:

  • Application type: Desktop app
  • Name: Claude Code MCP (or any name you prefer)
  1. Click Create

Copy Your Credentials

A dialog will appear with your credentials:

  • Client ID: Looks like 123456789-abcdefg.apps.googleusercontent.com
  • Client Secret: Looks like GOCSPX-xxxxxxxxx

Important: Copy both values and store them securely. You'll need them when configuring Claude Code.

You can also click Download JSON to save a backup.

Step 5: Use Your Credentials

Now that you have your credentials, go back to SETUP.md and continue from Step 2.

When you reach the configuration step, use:

  • GOOGLE_OAUTH_CLIENT_ID = your Client ID
  • GOOGLE_OAUTH_CLIENT_SECRET = your Client Secret

Troubleshooting

"Access blocked: This app's request is invalid"

This usually means the OAuth consent screen isn't fully configured. Make sure you:

  1. Completed the OAuth consent screen setup
  2. Added the required scopes
  3. If using "External" type, added yourself as a test user

"This app isn't verified"

This warning is expected for apps in testing mode. Click Continue to proceed. Google only verifies apps that are published for public use.

"Access blocked: Authorization Error"

Check that:

  1. You enabled all the required APIs (Step 2)
  2. The OAuth client type is "Desktop app"
  3. You're signing in with an account that has access (test user for External apps)

Need to start over?

You can delete the OAuth client and create a new one. Go to Credentials, find your OAuth client, click the trash icon, and start Step 4 again.

Security Notes

  • Keep your Client Secret confidential. Never commit it to public repositories or share it publicly.
  • Rotate credentials if you suspect they've been exposed. Delete the old OAuth client and create a new one.
  • Review authorized apps periodically at myaccount.google.com/permissions