Google Drive API Authentication: OAuth 2.0 & Service Accounts (2026)

Authentication overview

The Google Drive API utilizes OAuth 2.0 as its primary authentication and authorization protocol. OAuth 2.0 enables applications to obtain limited access to user accounts on an HTTP service, such as Google Drive, by obtaining an authorization grant from the resource owner (the user) and exchanging it for an access token. This token then permits the application to make requests on behalf of the user within the defined scopes (OAuth 2.0 specification). For scenarios where user authorization is not required, such as server-to-server interactions, service accounts provide an alternative authentication mechanism (Google Drive API documentation).

Authentication in the Google Drive API context involves two main aspects:

1. Identification: Verifying the identity of the application or user attempting to access the API.
2. Authorization: Determining what actions the identified application or user is permitted to perform.

Developers must configure credentials in the Google Cloud Console, which identify their application to Google. These credentials are then used in conjunction with OAuth 2.0 flows or service account keys to obtain the necessary access tokens.

Supported authentication methods

The Google Drive API supports various authentication methods tailored to different application types and use cases. The choice of method depends on whether your application requires user consent for accessing their Drive data or if it operates autonomously as a service.

OAuth 2.0 Scopes

When using OAuth 2.0, applications request specific permissions, known as OAuth scopes. These scopes define the extent of access an application has to a user's Google Drive data. Users must explicitly grant consent for these scopes during the authorization flow. Common scopes for the Google Drive API include (Google Drive API scope documentation):

• https://www.googleapis.com/auth/drive.file: Per-file access to files created or opened by the app.
• https://www.googleapis.com/auth/drive: Full, permissive scope to access all of a user's files and folders.
• https://www.googleapis.com/auth/drive.readonly: Read-only access to all of a user's files and folders.
• https://www.googleapis.com/auth/drive.metadata.readonly: Read-only access to file metadata, but not file content.

It is a security best practice to request the narrowest possible scopes required for your application's functionality.

Getting your credentials

Before your application can interact with the Google Drive API, you must obtain appropriate credentials from the Google Cloud Console. This process involves enabling the Google Drive API for your project and then creating the specific credential type needed.

Steps to obtain credentials:

1. Create or Select a Google Cloud Project: Go to the Google Cloud Console and create a new project or select an existing one.

2. Enable the Google Drive API: In the Google Cloud Console, navigate to APIs & Services > Library. Search for "Google Drive API" and enable it for your project.

3. Configure the OAuth Consent Screen: Before creating OAuth credentials, you must configure your application's OAuth consent screen. This screen is displayed to users when they authorize your app. Go to APIs & Services > OAuth consent screen. You will need to specify your application name, user support email, authorized domains, developer contact information, and potentially add the necessary scopes (Google Cloud authentication guide).

4. Create Credentials:

   • For OAuth Client IDs: Go to APIs & Services > Credentials. Click + CREATE CREDENTIALS and select OAuth client ID. Choose your application type (Web application, Desktop app, Android, iOS) and configure the necessary details (e.g., Authorized JavaScript origins and Authorized redirect URIs for web applications, package name/fingerprint for Android apps). After creation, you will receive a Client ID and potentially a Client Secret (for web applications).

   • For Service Accounts: Go to APIs & Services > Credentials. Click + CREATE CREDENTIALS and select Service Account. Provide a service account name, ID, and description. In the next step, grant the service account appropriate roles (e.g., Project > Editor or specific Drive roles if available). On the final step, you can create a new key (JSON is recommended) that will be downloaded to your computer. This JSON file contains the private key and other information required to authenticate as the service account.

Always store your credentials securely and never embed client secrets or service account keys directly in client-side code or public repositories.

Authenticated request example

This example demonstrates how to make an authenticated request to the Google Drive API using Python with OAuth 2.0, assuming you have already obtained an access token. The google-auth-oauthlib and google-api-python-client libraries simplify the authentication flow and API interactions.

import os

from google.auth.transport.requests import Request
from google.oauth2.credentials import Credentials
from google_auth_oauthlib.flow import InstalledAppFlow
from googleapiclient.discovery import build
from googleapiclient.errors import HttpError

# If modifying these scopes, delete the file token.json.
SCOPES = ["https://www.googleapis.com/auth/drive.metadata.readonly"]

def main():
    """Shows basic usage of the Drive v3 API.
    Prints the names and IDs of the first 10 files the user has access to.
    """
    creds = None
    # The file token.json stores the user's access and refresh tokens, and is
    # created automatically when the authorization flow completes for the first
    # time.
    if os.path.exists("token.json"):
        creds = Credentials.from_authorized_user_file("token.json", SCOPES)
    # If there are no (valid) credentials available, let the user log in.
    if not creds or not creds.valid:
        if creds and creds.expired and creds.refresh_token:
            creds.refresh(Request())
        else:
            flow = InstalledAppFlow.from_client_secrets_file(
                "credentials.json", SCOPES
            )
            creds = flow.run_local_server(port=0)
        # Save the credentials for the next run
        with open("token.json", "w") as token:
            token.write(creds.to_json())

    try:
        service = build("drive", "v3", credentials=creds)

        # Call the Drive v3 API
        results = (
            service.files()
            .list(pageSize=10, fields="nextPageToken, files(id, name)")
            .execute()
        )
        items = results.get("files", [])

        if not items:
            print("No files found.")
            return
        print("Files:")
        for item in items:
            print(f"{item['name']} ({item['id']})")

    except HttpError as error:
        # TODO(developer) - Handle errors from drive API.
        print(f"An error occurred: {error}")


if __name__ == "__main__":
    main()

This example assumes you have a credentials.json file (downloaded from the Google Cloud Console for an OAuth 2.0 Desktop app client ID) in the same directory. The first time it runs, it will open a browser for user authorization. Subsequent runs will use the saved token.json.

Security best practices

Implementing robust security measures is paramount when integrating with the Google Drive API to protect user data and maintain application integrity.

• Use the Principle of Least Privilege: Request only the minimum necessary OAuth scopes required for your application's functionality. Avoid requesting broad scopes like drive unless absolutely essential, as this grants extensive access to a user's Drive content (Google Drive API scope guidance).

• Protect Client Secrets and Service Account Keys: Client secrets (for web applications) and service account JSON key files should be treated as highly sensitive. Never embed them directly in client-side code, commit them to public version control systems, or expose them in any publicly accessible location. Store them in secure environment variables, secret management services, or encrypted configuration files.

• Secure Redirect URIs: For OAuth 2.0 web applications, configure strict and specific Authorized Redirect URIs in your Google Cloud Console project. Using wildcards or broad URIs can introduce security vulnerabilities like open redirect attacks.

• Handle Refresh Tokens Securely: If your application uses refresh tokens for long-lived access, store them securely. Refresh tokens allow your application to obtain new access tokens without re-prompting the user. Compromised refresh tokens can grant persistent unauthorized access.

• Implement State Parameter for CSRF Protection: When initiating an OAuth 2.0 flow, include a randomly generated state parameter. Your application should verify this state parameter upon callback to mitigate Cross-Site Request Forgery (CSRF) attacks (IETF RFC 6749 on CSRF).

• Error Handling and Logging: Implement comprehensive error handling for authentication and authorization failures. Log these events (while sanitizing sensitive information) to monitor for suspicious activity and aid in debugging.

• Regularly Review Permissions: Periodically review the permissions granted to your service accounts and OAuth client IDs in the Google Cloud Console. Remove any unnecessary or outdated access rights.

• Stay Updated with Google's Security Recommendations: Google frequently updates its security recommendations and authentication libraries. Ensure your application uses the latest versions of client libraries and follows current best practices.

• Domain-Wide Delegation for Service Accounts: When a service account needs to impersonate users in a Google Workspace domain, use domain-wide delegation. This allows the service account to authorize API calls on behalf of users without requiring their explicit consent, but it must be enabled and configured by a Google Workspace administrator.