You do this once, ever. The resulting client_id + client_secret work on every machine you
own — only the per-machine token differs. Budget 10 minutes.
Why this is mandatory now. rclone ships a built-in shared
client_idthat everyone used to rely on. Google is charging for API calls made through it, so rclone is retiring it during 2026. Leavingclient_idblank produces a setup that stops working. Every tutorial written before mid-2026 skips this page; that is why they are now wrong.
Google renamed this whole area to Google Auth Platform in 2024. If a guide tells you to click "OAuth consent screen", it predates the rename — the settings now live under APIs & Services → Google Auth Platform, split across Branding, Audience, Data Access, and Clients.
https://console.cloud.google.com/ → project picker → New project.
Name it anything (rclone-drive is fine). Google appends a random suffix to make the project ID
unique, e.g. rclone-drive-507617. Wait for it to finish creating and make sure the picker shows
your new project before continuing — configuring the wrong project is the most common silent mistake.
APIs & Services → Enable APIs and Services → search Drive → Google Drive API → Enable.
Pick "Google Drive API". Not "Google Drive Activity API", not "Drive Labels API".
APIs & Services → Google Auth Platform → Branding (if it's your first time, click Get started).
| Field | Value |
|---|---|
| App name | rclone |
| User support email | your own address |
| App logo | leave empty |
| Application home page | a URL on a domain you own — see Step 6 |
| Application privacy policy link | the same URL is fine |
| Application terms of service link | leave empty |
| Authorized domains | the root domain of the URL above |
| Developer contact information | your own address |
Google's own text on that page: "After you upload a logo, you will need to submit your app for verification unless the app is configured for internal use only or has a publishing status of Testing." You are going to publish an External app, so a logo forces you into a verification review you do not otherwise need. Leave it blank and the consent screen shows a generic icon.
You can leave the domain fields empty for now — they become mandatory at Step 6, and it's clearer to see why when you hit it.
Data Access → Add or remove scopes. Scroll to Manually add scopes and paste this exact line:
https://www.googleapis.com/auth/docs,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/drive.metadata.readonly
Add to table → Update → Save (the Save button is at the bottom of the page and is easy to miss — if you navigate away without it, the scopes are silently lost).
Google will label .../auth/drive Restricted and .../auth/docs Sensitive. That is expected.
Choosing a narrower scope
| Scope | What rclone can see | Good for |
|---|---|---|
drive (default here) |
Everything in your Drive | A general-purpose mount. What you want. |
drive.readonly |
Everything, read-only | A backup source you never want written to. |
drive.file |
Only files rclone itself created | Not useful for a mount — it sees zero existing files. |
drive.file is the only non-sensitive option, which makes it tempting. Don't: a mount using it
shows an empty directory, because it cannot see anything you didn't create through rclone.
Set a narrower scope by editing scope = drive in rclone.conf, or pass it during rclone config.
Audience → User type should read External.
- External — required for a personal
@gmail.comaccount. - Internal — only available if the project lives in a Google Workspace organisation. If you have one, prefer it: no unverified-app warning, no publishing step, no 7-day token expiry. The Drive you mount must belong to the same organisation.
Under Test users → + Add users, add your own address. This becomes cosmetic once you publish, but add it anyway — if you ever flip back to Testing, it's already there.
Audience → Publish app. Status must end up reading In production.
This is not optional. An app left in "Testing" issues refresh tokens that expire after 7 days. Your mount will work perfectly, then die a week later with an auth error and no obvious cause.
You'll see this banner:
⚠️ Your app's OAuth configuration is incomplete. You must enter the missing information to proceed. Please visit the Branding page to finish configuring your app.
That banner does not tell you which fields. Hover the greyed-out Publish button — the tooltip does:
Valid app name, support email, homepage url, and privacy policy url are required for switching the app to external production mode.
So go back to Branding and fill in:
- Application home page — any URL on a domain you own, e.g.
https://example.com - Application privacy policy link — the same URL works
- Saving those makes Authorized domains mandatory → + Add domain → the root domain only
(
example.com, nohttps://, no subdomain, no trailing slash) - Save
Return to Audience and Publish is now clickable.
Google does not fetch these URLs at publish time. It's form validation plus a match between the URLs and your authorized domain. The rules about the homepage describing your app and hosting a real privacy policy apply to verification review, which you are not entering. You do need a domain you actually own, because verifying domain ownership becomes required if you ever do pursue verification.
Then leave the app in Testing and accept re-running rclone config reconnect <remote>: weekly.
A free option: any GitHub Pages site (https://<username>.github.io) with github.io as the
authorized domain. Cheap domains are ~$10/year and permanently solve it.
Clients → Create client → Application type: Desktop app → Create.
Copy the Client ID and Client secret, or download the JSON. deploy.sh accepts either:
./deploy.sh --client-id <id> --client-secret-file <file-containing-only-the-secret>"Desktop app" is correct even for a headless server — it's the client type that permits the
loopback redirect (http://127.0.0.1:53682/) rclone uses. Don't pick "Web application".
Once published with the restricted drive scope, the Verification Center lights up and you may
get an email saying your app requires verification. Ignore it.
Google exempts personal-use apps: under 100 users, an unverified app keeps working indefinitely. The only consequence is a one-time interstitial during authorization:
Google hasn't verified this app → Advanced → Go to rclone (unsafe)
That's your own app, made by you, running on your own machine. Click through it. You'll see it once,
during rclone config / deploy.sh, and never again.
| Symptom | Cause | Fix |
|---|---|---|
| Publish app greyed out, banner points vaguely at Branding | Missing homepage / privacy-policy URL | Step 6. Hover the button for the real message. |
| Authorized domains won't accept your entry | You included the scheme or a subdomain | Root domain only: example.com |
| Mount works, then breaks after ~7 days with an auth error | App is in Testing | Publish to production (Step 6), then rclone config reconnect <remote>: |
Error 400: policy_enforced, "Access blocked: app is not approved by Advanced Protection" |
Your Google account is enrolled in the Advanced Protection Program, which blocks all unverified apps requesting sensitive/restricted scopes | Publishing and verification do not fix this — the allowlist is per-client-id and hand-curated. Use a non-APP account, or unenroll. |
Error 403: access_denied, "rclone has not completed the Google verification process" |
App in Testing and your account isn't a test user | Add yourself under Audience → Test users, or publish. |
| Scopes vanish after you set them | Didn't press Save at the bottom of Data Access | Re-add and Save. |
CRITICAL: Failed to read line: EOF |
rclone config run without a TTY (CI, a wrapper, an agent shell) |
Pipe answers: printf 'y\nn\n' | rclone config reconnect <remote>: |
| Browser never opens during auth | Headless or no xdg-open |
Copy the http://127.0.0.1:53682/auth?state=… URL from the output, or use ./deploy.sh --headless |
Error 400: redirect_uri_mismatch |
Client created as "Web application" | Delete it, create a Desktop app client. |
| Google Docs show as 0 bytes | Not fixable — Drive reports size -1 until export and FUSE needs a size up front |
Default --export-format link.html turns them into browser redirect files. |
Copy the same client_id/client_secret to each machine and run deploy.sh there. Each machine
does its own browser grant and gets its own token.
Two limits worth knowing:
- 100 refresh tokens per Google account per client ID. Exceeding it silently invalidates the oldest. That's 100 machines/re-authorizations, not 100 files — you will not hit it.
- The 100-user cap shown on the Audience page counts distinct Google accounts, not machines.
Mounting your own Drive on twenty machines still reads
1 user. It is lifetime-cumulative and cannot be reset, so don't burn it testing with throwaway accounts.
- Remove one machine's access: delete its
rclone.conf(or that remote'stoken =line). - Revoke everything: https://myaccount.google.com/permissions → your app → Remove access. Every machine's token dies immediately.
- Rotate the secret: Clients → your client → Add secret, update
rclone.confeverywhere, then delete the old secret.