Skip to content

Latest commit

 

History

History
201 lines (140 loc) · 10.3 KB

File metadata and controls

201 lines (140 loc) · 10.3 KB

Creating your Google OAuth client (the hard part)

You do this once, ever. The resulting client_id + client_secret work on every machine you own — only the per-machine token differs. Budget 10 minutes.

Why this is mandatory now. rclone ships a built-in shared client_id that everyone used to rely on. Google is charging for API calls made through it, so rclone is retiring it during 2026. Leaving client_id blank produces a setup that stops working. Every tutorial written before mid-2026 skips this page; that is why they are now wrong.

Google renamed this whole area to Google Auth Platform in 2024. If a guide tells you to click "OAuth consent screen", it predates the rename — the settings now live under APIs & Services → Google Auth Platform, split across Branding, Audience, Data Access, and Clients.


Step 1 — Project

https://console.cloud.google.com/ → project picker → New project.

Name it anything (rclone-drive is fine). Google appends a random suffix to make the project ID unique, e.g. rclone-drive-507617. Wait for it to finish creating and make sure the picker shows your new project before continuing — configuring the wrong project is the most common silent mistake.

Step 2 — Enable the Drive API

APIs & Services → Enable APIs and Services → search DriveGoogle Drive APIEnable.

Pick "Google Drive API". Not "Google Drive Activity API", not "Drive Labels API".

Step 3 — Branding

APIs & Services → Google Auth Platform → Branding (if it's your first time, click Get started).

Field Value
App name rclone
User support email your own address
App logo leave empty
Application home page a URL on a domain you own — see Step 6
Application privacy policy link the same URL is fine
Application terms of service link leave empty
Authorized domains the root domain of the URL above
Developer contact information your own address

Do not upload a logo

Google's own text on that page: "After you upload a logo, you will need to submit your app for verification unless the app is configured for internal use only or has a publishing status of Testing." You are going to publish an External app, so a logo forces you into a verification review you do not otherwise need. Leave it blank and the consent screen shows a generic icon.

You can leave the domain fields empty for now — they become mandatory at Step 6, and it's clearer to see why when you hit it.

Step 4 — Scopes (Data Access)

Data Access → Add or remove scopes. Scroll to Manually add scopes and paste this exact line:

https://www.googleapis.com/auth/docs,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/drive.metadata.readonly

Add to table → Update → Save (the Save button is at the bottom of the page and is easy to miss — if you navigate away without it, the scopes are silently lost).

Google will label .../auth/drive Restricted and .../auth/docs Sensitive. That is expected.

Choosing a narrower scope
Scope What rclone can see Good for
drive (default here) Everything in your Drive A general-purpose mount. What you want.
drive.readonly Everything, read-only A backup source you never want written to.
drive.file Only files rclone itself created Not useful for a mount — it sees zero existing files.

drive.file is the only non-sensitive option, which makes it tempting. Don't: a mount using it shows an empty directory, because it cannot see anything you didn't create through rclone.

Set a narrower scope by editing scope = drive in rclone.conf, or pass it during rclone config.

Step 5 — Audience and test users

Audience → User type should read External.

  • External — required for a personal @gmail.com account.
  • Internal — only available if the project lives in a Google Workspace organisation. If you have one, prefer it: no unverified-app warning, no publishing step, no 7-day token expiry. The Drive you mount must belong to the same organisation.

Under Test users → + Add users, add your own address. This becomes cosmetic once you publish, but add it anyway — if you ever flip back to Testing, it's already there.

Step 6 — Publish the app ← the step everyone gets stuck on

Audience → Publish app. Status must end up reading In production.

This is not optional. An app left in "Testing" issues refresh tokens that expire after 7 days. Your mount will work perfectly, then die a week later with an auth error and no obvious cause.

When "Publish app" is greyed out

You'll see this banner:

⚠️ Your app's OAuth configuration is incomplete. You must enter the missing information to proceed. Please visit the Branding page to finish configuring your app.

That banner does not tell you which fields. Hover the greyed-out Publish button — the tooltip does:

Valid app name, support email, homepage url, and privacy policy url are required for switching the app to external production mode.

So go back to Branding and fill in:

  1. Application home page — any URL on a domain you own, e.g. https://example.com
  2. Application privacy policy link — the same URL works
  3. Saving those makes Authorized domains mandatory → + Add domain → the root domain only (example.com, no https://, no subdomain, no trailing slash)
  4. Save

Return to Audience and Publish is now clickable.

Google does not fetch these URLs at publish time. It's form validation plus a match between the URLs and your authorized domain. The rules about the homepage describing your app and hosting a real privacy policy apply to verification review, which you are not entering. You do need a domain you actually own, because verifying domain ownership becomes required if you ever do pursue verification.

No domain at all?

Then leave the app in Testing and accept re-running rclone config reconnect <remote>: weekly. A free option: any GitHub Pages site (https://<username>.github.io) with github.io as the authorized domain. Cheap domains are ~$10/year and permanently solve it.

Step 7 — Create the OAuth client

Clients → Create client → Application type: Desktop appCreate.

Copy the Client ID and Client secret, or download the JSON. deploy.sh accepts either:

./deploy.sh --client-id <id> --client-secret-file <file-containing-only-the-secret>

"Desktop app" is correct even for a headless server — it's the client type that permits the loopback redirect (http://127.0.0.1:53682/) rclone uses. Don't pick "Web application".

Step 8 — Ignore the verification nag

Once published with the restricted drive scope, the Verification Center lights up and you may get an email saying your app requires verification. Ignore it.

Google exempts personal-use apps: under 100 users, an unverified app keeps working indefinitely. The only consequence is a one-time interstitial during authorization:

Google hasn't verified this appAdvancedGo to rclone (unsafe)

That's your own app, made by you, running on your own machine. Click through it. You'll see it once, during rclone config / deploy.sh, and never again.


Troubleshooting

Symptom Cause Fix
Publish app greyed out, banner points vaguely at Branding Missing homepage / privacy-policy URL Step 6. Hover the button for the real message.
Authorized domains won't accept your entry You included the scheme or a subdomain Root domain only: example.com
Mount works, then breaks after ~7 days with an auth error App is in Testing Publish to production (Step 6), then rclone config reconnect <remote>:
Error 400: policy_enforced, "Access blocked: app is not approved by Advanced Protection" Your Google account is enrolled in the Advanced Protection Program, which blocks all unverified apps requesting sensitive/restricted scopes Publishing and verification do not fix this — the allowlist is per-client-id and hand-curated. Use a non-APP account, or unenroll.
Error 403: access_denied, "rclone has not completed the Google verification process" App in Testing and your account isn't a test user Add yourself under Audience → Test users, or publish.
Scopes vanish after you set them Didn't press Save at the bottom of Data Access Re-add and Save.
CRITICAL: Failed to read line: EOF rclone config run without a TTY (CI, a wrapper, an agent shell) Pipe answers: printf 'y\nn\n' | rclone config reconnect <remote>:
Browser never opens during auth Headless or no xdg-open Copy the http://127.0.0.1:53682/auth?state=… URL from the output, or use ./deploy.sh --headless
Error 400: redirect_uri_mismatch Client created as "Web application" Delete it, create a Desktop app client.
Google Docs show as 0 bytes Not fixable — Drive reports size -1 until export and FUSE needs a size up front Default --export-format link.html turns them into browser redirect files.

Reusing this on more machines

Copy the same client_id/client_secret to each machine and run deploy.sh there. Each machine does its own browser grant and gets its own token.

Two limits worth knowing:

  • 100 refresh tokens per Google account per client ID. Exceeding it silently invalidates the oldest. That's 100 machines/re-authorizations, not 100 files — you will not hit it.
  • The 100-user cap shown on the Audience page counts distinct Google accounts, not machines. Mounting your own Drive on twenty machines still reads 1 user. It is lifetime-cumulative and cannot be reset, so don't burn it testing with throwaway accounts.

Revoking

  • Remove one machine's access: delete its rclone.conf (or that remote's token = line).
  • Revoke everything: https://myaccount.google.com/permissions → your app → Remove access. Every machine's token dies immediately.
  • Rotate the secret: Clients → your client → Add secret, update rclone.conf everywhere, then delete the old secret.