> Public product help. This page has no customer entries, projects, chat transcripts, API keys, or horizon contents.
> Reading that data requires `Authorization: Bearer` (a signed-in app session JWT, or a Headless access token).
> Do not call Supabase `/rest/v1` with a Headless JWT. Data reads go through `/casc/v1/headless/v1/rest`.

# Google Authentication

Google Spreadsheet and Google Drive Folder ingestion read files using **your personal Google account**. Zagger does not use a single shared system Google login for ingestion — each user connects OAuth, and ingestion jobs use the initiating user's token.

## Overview

1. Register a Google Cloud OAuth app (or use one your admin published).
2. Store OAuth client credentials in Zagger (user or imported shared app).
3. Connect your Google account (consent screen).
4. Run spreadsheet or folder ingestion while connected.

## Step 1 — Google Cloud Console

In [Google Cloud Console](https://console.cloud.google.com/):

- Create or select a project.
- Enable **Google Drive API**, **Google Sheets API**, **Google Docs API**, and (for email drafts) **Gmail API** as needed.
- Configure OAuth consent screen (internal or external). For Gmail drafts, add scope `https://www.googleapis.com/auth/gmail.compose` (restricted scope — Workspace Internal apps avoid public verification; external apps may need Google verification).
- Create OAuth 2.0 **Web application** credentials.
- Add authorized redirect URI: `{your-api-host}/casc/v1/api/google/auth/callback` (same host the React app uses for API calls).

## Step 2 — User credentials in Zagger

**Settings → User → Google OAuth App Credentials**

- Enter **Client ID** and **Client Secret** from Google (secret optional if server has `GOOGLE_CLIENT_SECRET` env).
- Save user Google credentials.

## Step 3 — Import shared credentials (optional)

Admins publish OAuth apps under **Settings → Admin → Google Credentials**. Users on the same email domain can **Import shared Google credentials** on the User settings page instead of pasting secrets manually.

## Step 4 — Connect personal account

**Settings → User → Personal Google Drive → Connect Personal Google Account**

- Opens Google consent for read-only Drive, Docs, and Sheets scopes, plus `gmail.compose` so Zagger can create Gmail drafts (never send).
- On success, Horizon status bar shows connected state.
- **Disconnect** revokes the session token in Zagger (re-consent required to ingest again).
- If Gmail draft save fails with a missing-scope error after an upgrade, **Disconnect → Connect** again so the new `gmail.compose` grant is stored on your token.

## Horizon status bar

On Horizon pages, the header shows Google connection status. If disconnected, ingestion from Sheets or Drive fails until you reconnect under Settings → User.

## Troubleshooting

| Issue | Check |
| --- | --- |
| Redirect URI mismatch | Google Console redirect must exactly match API callback URL. |
| Access denied on ingest | User who clicks Ingest must own the connection; spreadsheet/folder must be shared with that Google account. |
| Invalid client | Client ID/secret pair matches the Google project; shared import selected correct provider. |
| Works locally, fails in prod | Prod API URL in redirect URIs; HTTPS required for production OAuth. |

> Legacy documentation may refer to a single system Google token. Current builds use **per-user OAuth** resolved at ingestion time.