Set up Google Cloud OAuth for personal tools

Use this when a tool asks for a Google Client ID and Client Secret (Composio custom auth, rclone, personal scripts). For why Google couples consent and quotas to a Project, and how to map “app” thinking onto the Console, see Google Cloud projects as OAuth boundaries.

Decide the trust boundary first

Pick one of these before clicking Create Project:

Goal Project strategy

All Google toolkits inside one platform (e.g. Composio)

One dedicated Project + one OAuth Client ID. Reuse credentials; add APIs/scopes as you grow.

A separate product (rclone, hobby web app)

Its own Project. Do not share with Composio.

Fastest path on an existing “Personal” project

Allowed, but you share consent name, scope union, quotas, and revoke coupling. Prefer a dedicated Project.
Recommended default for Composio

a Project named like composio-integrations, used only as that trust platform.

Create the Project

  1. Open Google Cloud Console.

  2. Project picker (top bar) → New Project.

  3. Name it for the trust platform, not “Personal 3”.

  4. Create and select it.

Enable the right APIs

  1. APIs & Services → Library.

  2. Enable only APIs the tool actually calls.

Examples:

  • Drive / NotebookLM-style doc access → Google Drive API

  • Gmail toolkit → Gmail API

  • Calendar toolkit → Google Calendar API

Do not enable Vertex AI Workbench / Enterprise Notebooks for consumer NotebookLM or Drive document access. That API manages GCP Jupyter instances; it is unrelated.

Configure the OAuth consent screen

  1. APIs & Services → OAuth consent screen.

  2. User type: External for personal Google accounts; Internal only on a Workspace domain that fits.

  3. App name: the trust platform people will see (e.g. Composio Integrations), not an old rclone label.

  4. Support email and developer contact: yours.

  5. Scopes: add what this platform needs now (see below).

  6. Test users: add your Google address while the app is in Testing.

  7. Save.

Scopes (Drive example)

Filter by Google Drive API and pick the least that still works:

Scope When

https://www.googleapis.com/auth/drive.readonly

Read-only context (search / read files)

https://www.googleapis.com/auth/drive.file

Only files the app creates or the user explicitly opens

https://www.googleapis.com/auth/drive

Full read/write when the agent must organize, upload, or edit

Add Gmail / Calendar / Docs scopes the same way when you enable those toolkits.

Create the OAuth Client ID

  1. APIs & Services → Credentials → Create Credentials → OAuth client ID.

  2. Application type: Web application (typical for hosted callbacks such as Composio).

  3. Authorized JavaScript origins: leave empty unless the tool documents browser origins. A lone https:// value is invalid—delete it.

  4. Authorized redirect URIs: add the tool’s callback exactly.

    Composio callback (confirm in Composio’s current docs if unsure)

    https://backend.composio.dev/api/v3.1/toolkits/auth/callback

  5. Create. Copy Client ID and Client Secret into the tool’s custom auth fields.

Paste into Composio (or similar)

  1. In Composio, choose custom / bring-your-own OAuth for the Google toolkit.

  2. Paste the same Client ID and Client Secret.

  3. Complete the authorization link so Google issues a grant with the current scopes.

For MCP install (marketplace / mcp.json), see Composio MCP setup. App connection is separate from MCP server auth.

Add another Google toolkit later (same Client ID)

When you want Gmail (or Calendar, …) on the same Composio trust platform:

  1. Enable the API in Library.

  2. Add scopes on the same consent screen → Save.

  3. Reuse the same Client ID / secret in Composio.

  4. Re-authorize the connection. Old tokens do not gain new scopes automatically.

Related