Connect Google (Gmail, Drive, Sheets, Calendar)

≈ 6 min Extension Web app OAuth2

Each Google app has its own credential, because each one asks Google for different permissions. They can all share one OAuth client: create it once, then reuse its Client ID and Secret.

Note — 

Looking for Gemini models? That is an API key, not a sign-in: see Connect Google Gemini.

Before you start

• A Google account (personal or Google Workspace).
• Access to the Google Cloud Console to create a free OAuth client (once, about 5 minutes).

Used by

• Gmail
• Google Drive
• Google Sheets
• Google Calendar

Set it up

This is the only method: Google signs you in and gives the token to your browser, never to AWFlow’s servers.

1. Create your OAuth client in the Google Cloud Console: a project, the API you need enabled (Gmail API, Google Drive API, Google Calendar API, or both Google Sheets API and Google Drive API for Sheets), the consent screen with your account as a test user, and an OAuth client ID of type Web application with AWFlow’s redirect URI. Full steps with links.

2. Fill the credential in AWFlow. Open Credentials and click Add Credential, then fill the New Credential form. In the browser side panel the form comes in two steps: tap the Google app in the list, then fill the rest.

   12345678

   1. 1 Step 1:Pick the Google app Under Integration App / Service, pick Gmail, Google Drive, Google Sheets or Google Calendar. There is no Auth Type menu: Google uses OAuth2.
   2. 2 Step 2:Name it For example Gmail – work. A Description is optional.
   3. 3 Step 3:Copy the redirect URI Open Create your Google OAuth client: it shows your install's redirect URI with a Copy button. Add it under Authorized redirect URIs in your OAuth client if you haven't yet.
   4. 4 Step 4:Paste the Client ID Copy it from your Google OAuth client.
   5. 5 Step 5:Paste the Client Secret In Client Secret (optional): a Web application client needs it; a Desktop app client has none.
   6. 6 Step 6:Click Check connection Approve the Google window. While your consent screen is in Testing, Google may warn Google hasn't verified this app: click Continue in that Google window.
   7. 7 Step 7:Check where it is saved Signed in, choose Local (this browser only) or Cloud (synced to your account) under Storage location. Without an account it is saved locally in this browser, as here.
   8. 8 Step 8:Click Create Credential Check: the credential is listed on the Credentials page, ready to pick in Google nodes.

   Numbered areas in the screenshot: 1. Integration App / Service: Gmail; 2. Name; 3. Create your Google OAuth client guide; 4. Client ID; 5. Client Secret (optional); 6. Check connection (sign in); 7. Where the secret is stored (here, locally in this browser); 8. Create Credential.

3. Repeat for each Google app you use (Gmail, Drive, Sheets, Calendar), with the same Client ID and Secret.

Check it's connected — 

After Check connection, AWFlow shows Connection successful and the link icon on the button turns connected. In a Google node, the file, spreadsheet or calendar lists now load from your account.

Where your token lives

Where your token lives — 

The Client ID and Secret are saved in the credential. The access and refresh tokens Google returns are kept in this browser’s storage and never synced to your account, so each browser signs in once.

The credential itself is stored where you choose:

• Local (this browser only): encrypted in this browser. The encryption key is kept on the same device, so turn on the local secret vault to lock it with a passphrase only you know.
• Cloud (synced to your account): sent over an encrypted connection and stored encrypted on AWFlow’s server, so it works on your other devices.

When a step runs, your browser sends it only to accounts.google.com and oauth2.googleapis.com (sign-in) and gmail.googleapis.com, sheets.googleapis.com and www.googleapis.com (the APIs). AWFlow’s servers never relay the call.

Privacy & your data →

Permissions each operation needs

App	Permission (scope)	What it allows
Gmail	gmail.readonly	Read messages and drafts (Message · Get, Search; Draft · Get, List)
Gmail	gmail.compose	Create drafts and send (Message · Send; Draft · Create, Update, Delete)
Gmail	gmail.modify	Move a message to the Trash (Message · Delete trashes, it does not erase)
Google Calendar	calendar.events	Create, update and delete events
Google Calendar	calendar.readonly	List calendars, read events and free/busy
Google Drive	drive	List, read, create, copy and delete your files and folders
Google Sheets	spreadsheets	Read and write values, create and clear spreadsheets and worksheets
Google Sheets	drive.metadata.readonly	List your existing spreadsheets in the picker

AWFlow asks for exactly these scopes, per app. All start with https://www.googleapis.com/auth/.

Common issues

• redirect_uri_mismatch. The redirect URI in your OAuth client doesn’t match this install. Copy it again from the credential form. Using AWFlow in Chrome and Firefox? Add both browsers’ URIs to the same client.
• access_denied or “This app is blocked”. Your account isn’t a test user on the consent screen. Add it under OAuth consent screen › Test users.
• A node fails with “insufficient scope” or 403. The API for that app isn’t enabled in your Cloud project (Sheets needs the Drive API too). Enable it, then click Check connection again so Google grants the new permissions.
• It worked for a week, then stopped. Google expires sign-ins for consent screens in Testing after 7 days. Click Check connection again, or publish the consent screen to In production.
• “No Client Secret set” warning. A Web application client needs its secret. Paste it, or leave it empty only for a Desktop app client.

Related

Gmail node

All connections

Create and manage credentials

Privacy & your data