Connect Google Drive

This guide walks you — the tenant administrator — through everything you do in Google before connecting a Drive folder from OpenDome. At the end you will have two values, a Client ID and a Client secret, that you paste into the OpenDome console. All of the work here happens in the Google Cloud Console, outside OpenDome.

You do this once per organization; afterwards you can connect as many folders as you like with the same app.

Before you start: Workspace or personal Drive?

This is the most important decision, and it shapes every step below. The connector works in both cases — it is the same Google Drive API — but how you register the app differs a lot.

Your Google account	App type to create	Google verification?	Does access expire?	Recommended
Google Workspace (corporate domain)	Internal	No	No	✅ Yes
Personal Gmail, in testing	External · Testing	No	Yes — after 7 days	⚠️ Testing only
Personal Gmail, published	External · In production	Yes — security assessment (CASA)	No	❌ Not advised

Recommended path

If you are connecting a company’s Drive, use a Google Workspace account and create the app as Internal. It is the only path with no Google verification and no access expiry — exactly what a connector that syncs on a schedule needs.

Why personal Drive is awkward

The permission we request (read your Drive files) is a restricted scope for Google. In an external app in testing mode, Google expires access after 7 days: the connector would stop syncing every week until someone re-authorizes by hand. Avoiding that means publishing the app, and then Google requires an annual, paid, third-party security assessment (CASA). So personal Drive is fine for a one-off test but not for production.

What you will do

  Google Cloud Console
  ┌────────────────────────────────────────────────────────────────┐
  │ 1. Create / pick a project                                     │
  │ 2. Enable the Google Drive API                                 │
  │ 3. Configure the OAuth consent screen (Internal vs External)   │
  │ 4. Create OAuth client credentials  ─────►  Client ID + Secret │
  └────────────────────────────────────────────────────────────────┘
                                   │
                                   ▼
  OpenDome ── paste Client ID + Secret ── click "Connect" ── pick a folder

The Client secret is a password: treat it as one (see Security).

Prerequisites

• A Google account allowed to create projects in Google Cloud.
  • For the recommended (Internal) path, that account must belong to a Google Workspace organization with a sufficient project role (usually Owner or Editor).
• The redirect URI that OpenDome gives you (you’ll need it in step 4). It is the address Google returns the browser to after authorizing: https://<your-tenant-console>/v1/oauth/callback. OpenDome shows the exact URL on the connector’s connect screen — copy it from there.
• Know which folder you want to sync (you’ll pick it later, inside OpenDome).

Step 1 — Create (or pick) a Google Cloud project

A Google Cloud project is the container your OAuth app lives in.

1. Go to console.cloud.google.com.
2. In the project picker at the top, click New Project.
3. Give it a recognizable name (e.g. opendome-drive-connector) and, if asked, choose your Workspace organization. Click Create.
4. Wait for it to be created and select it in the top picker before continuing.

Note

You can reuse an existing project if you already have one for integrations. What matters is that steps 2–4 happen inside the selected project.

Step 2 — Enable the Google Drive API

The app can only call APIs that are enabled in the project.

1. Side menu → APIs & Services → Library.
2. Search for Google Drive API.
3. Open it and click Enable.

Step 3 — Configure the OAuth consent screen

This is the window whoever authorizes will see (“OpenDome wants to access your Google Drive”). Configure it once before you can create credentials.

1. Side menu → APIs & Services → OAuth consent screen.
2. User Type:
   • Choose Internal if your account is Google Workspace ← recommended. Only people in your organization can authorize, and Google will not require verification.
   • Choose External if you use personal Gmail (the only option there).
3. Fill in the app details: App name (e.g. OpenDome – Drive connector), User support email, and Developer contact. Logo and links are optional.
4. Scopes: click Add or remove scopes and add the Drive read-only permission:

   https://www.googleapis.com/auth/drive.readonly

   It is the only one OpenDome needs: read, never modify or delete. Save.
5. External only: under Test users, click Add users and add the Google address that will authorize the connection. Without this, authorization fails with an “app not verified” error.
6. Save. You do not need to click “Publish app” for the recommended (Internal) path, nor to test with an External app in testing mode.

Step 4 — Create the OAuth client credentials

This is where the Client ID and Client secret come from.

1. Side menu → APIs & Services → Credentials.
2. Click + Create Credentials → OAuth client ID.
3. Application type: choose Web application.
4. Name: something recognizable (e.g. opendome-drive-web).
5. Authorized redirect URIs: click + Add URI and paste the OpenDome redirect URI from Prerequisites. It must match exactly — scheme, host, port and path — a single different character makes Google reject the connection.

   https://<your-tenant-console>/v1/oauth/callback

6. Click Create. Google shows a box with the Client ID and Client secret.

Note

You can add several redirect URIs to the same app. You do not need to fill in “Authorized JavaScript origins”.

Step 5 — Copy the Client ID and Client secret

• Client ID — a long string ending in .apps.googleusercontent.com. Not secret, but copy it verbatim.
• Client secret — starts with GOCSPX-…. This is a password. Copy it to a safe place; if you lose it you can generate a new one from the same screen.

Then, in OpenDome

1. Open your tenant → Connectors → New connector → Documents — Google Drive.
2. Paste the Client ID and Client secret into their fields.
3. Click Connect. The Google window opens: pick the account and accept the read-only permissions. You are returned to OpenDome automatically.
4. Pick the folder to sync with the folder browser (or paste the folder link if you prefer: open it in Google Drive and copy the address).
5. Save. The connector is ready for its first sync.

Note

During Connect, OpenDome obtains — inside your cell — the refresh token that lets it read Drive continuously. That token never leaves your environment.

Troubleshooting

Symptom	Cause and fix
redirect_uri_mismatch on Connect	The app’s redirect URI does not match OpenDome’s exactly. Check scheme (http/https), host, port and path (/v1/oauth/callback), with no extra trailing slash.
“Access blocked: app not verified”	External app and you didn’t add your address as a test user (step 3.5), or you’re using an account not on the list. Add the user, or — if you have Workspace — switch to an Internal app.
Connector stops syncing after ~1 week	External app in testing mode: Google expires access after 7 days. Real fix: use Workspace + Internal app.
invalid_client	Client ID or Client secret mis-copied (spaces, truncation). Re-copy them from step 5.
The folder doesn’t appear in the browser	The app may lack the Drive permission, or the folder belongs to a shared drive. Check you added the drive.readonly scope (step 3.4); for shared drives, use the Shared drive field / paste the folder link.
“Refresh token not received”	Happens if you re-authorize without forcing consent. Our app already requests access_type=offline + prompt=consent, so click Connect again and accept once more.

Security

• Read-only. The only permission we request is drive.readonly. OpenDome cannot create, modify or delete anything in your Drive.
• Your credentials never leave your environment. The Client secret and token live in a Secret in your cell; the OAuth token exchange happens inside your cell. OpenDome’s global control plane never sees the secret or the token, and never contacts Google on your behalf.
• Minimal egress. The connector may only reach the strictly necessary Google domains (accounts.google.com, oauth2.googleapis.com, www.googleapis.com); any other outbound traffic is blocked by default.
• Revocable anytime. You can withdraw access from your Google account (myaccount.google.com/permissions) or by deleting the OAuth client in Google Cloud; the connector loses read access immediately.
• Rotating the secret. To rotate, generate a new Client secret in Google Cloud and reconnect in OpenDome; the old one is invalidated.