Does the Google Docs API use an API key or OAuth?

OAuth. You create a Google Cloud OAuth client once, then connect the account from Outloop in your browser — Outloop mints and stores the refresh token host-side in the macOS Keychain. The agent uses the credential's capability without ever seeing it.

Do I have to enter the Client Secret again for every Google connector?

No. The first Google connector you set up asks for the Client ID and Client Secret; save it as your default Google OAuth app and every later Google connector picks it from the dropdown. Each connector still signs in separately and holds its own refresh token, scopes and connected account, so you can revoke one without touching the others.

How do I stop an agent touching the wrong client's document?

Approve specific document IDs on the workspace. A request naming a document that is not on the approved list is refused with RESOURCE_ID_NOT_ALLOWED, and a workspace with nothing approved and no explicit account-wide setting refuses every call with CUSTOMER_RESOURCE_PIN_REQUIRED. Both refusals happen before the credential is read, so no Google call is made.

Can an agent create a new document while the workspace is pinned?

Creating a new document is refused while the workspace is pinned to an approved list — Outloop never widens a pin by itself. Approve the new ID afterwards and the agent can work with it. If you genuinely want agents working across the whole account, choose account-wide deliberately in the Access section.

What can agents do by default?

Practical work is on by default: read documents, create new documents, insert and format text, tables and lists. Actions that destroy content are unchecked by default and shown with a warning marker — you turn them on deliberately, per workspace, or leave them off.

Can the agent see the OAuth credential?

No. The refresh token is minted and stored host-side in the macOS Keychain and used on the wire at request time. Every request is audited with secret_exposed: false, and the raw value never reaches chat, prompts, logs, or project files.

Learn · Setup guides

Connect Google Docs to Outloop

Last updated: August 14, 2026

In short

Connecting Google Docs to Outloop means signing in to Google once from Outloop in your browser, then approving the exact documents each client workspace is allowed to touch.

Outloop mints and stores the refresh token host-side in the macOS Keychain — there is no token to copy. Agents then read and edit only the documents you approved for that workspace; a request naming any other document is denied before any call reaches Google, and every request is audited with secret_exposed:false.

Summarize this setup guide with AI ChatGPT Claude Perplexity

What this setup gives you

Agents that can do real Docs work inside the client files you approved — and nothing outside them. Outloop holds the Google credential locally, decides which document each workspace may reach, and audits every request.

→An agent can created a document, inserted and formatted text, tables and structural elements in an approved document.

→Each client workspace is pinned to its own documents — one agency Google account, many separated clients.

→The refresh token is minted host-side and never appears on your clipboard, in a screenshot, or in a prompt.

→A wrong-file request is refused before any call reaches Google, not after.

What you need before starting

✓Access to a Google Cloud project with the OAuth consent screen configured.

✓A Client ID and Client Secret for your first Google connector. After that, Outloop reuses the saved Google OAuth app and never asks for the secret again.

✓The Google account that can open the client documents — you will sign in as it in your browser.

✓The document IDs the workspace should be allowed to touch (the segment between /d/ and /edit in the document URL).

✓Outloop installed and activated, with a workspace selected.

1. Enable the Google Docs API

In Google Cloud Console, open APIs & Services → Library, search Google Docs API, and click Enable. Outloop calls it at docs.googleapis.com.

2. Create the OAuth client (once, for all Google connectors)

In Google Auth Platform → Clients, create a Web application OAuth client and copy the Client ID and Client Secret. Google may show the secret only once; if you lose it, create a new one. The scope this connector requests is:

https://www.googleapis.com/auth/documents
openid
email

The openid and email scopes are how Outloop verifies which Google account you actually connected — that identity check is Google OIDC, and it does not involve any Drive scope.

You only enter the Google OAuth app once

The first Google connector you set up asks for the Client ID and Client Secret from your Google Cloud OAuth client. Tick save as my default Google OAuth app and every later Google connector — Gmail, Drive, Docs, Slides and Analytics GA4 — picks it from the Google OAuth app dropdown with no Client Secret to re-enter. When a saved profile supplies the app, Outloop shows “Using <client-id> — no Client Secret needed. This connector still signs in separately and gets its own access.”

Reusing the app does not mean sharing one login. Each connector still opens its own browser sign-in and gets its own refresh token, its own scopes and its own connected account — so you can revoke or re-authenticate one connector without touching the others.

3. Add Google Docs in Outloop

In Outloop, open API Keys & Access → Add Access and choose Google Docs. The panel opens on Connect in your browser, with the Cloud Console detail in the collapsed Setup details — Google Cloud OAuth client, scopes and caveats and Before you connect disclosures.

Under Access to request from Google, choose the level:

→Full documents — read, create, insert and format content (recommended)

→Read-only documents

The full option is preselected because it is what most agency work needs; read-only is offered but never preselected. Then check the Google OAuth app dropdown — a saved profile supplies the app with no Client Secret to re-enter.

Read the storage line before you continue. Where Outloop says the credential will be stored in the SHARED slot, it also warns that it replaces whatever is already there. If another workspace relies on that slot, change the scope before connecting rather than after.

4. Connect the account in your browser

Click Connect Google Docs in your browser. Google's own sign-in opens, you sign in as the account that can open the client documents, and you approve the consent screen there. Outloop mints and stores the refresh token host-side.

Nothing to copy or paste. There is no refresh token on your clipboard, so there is nothing to leak into a screenshot, a chat, or a .env file.

5. Confirm the account and capabilities

Outloop shows Connected as the Google account you just used. Check it — this is the moment to catch a sign-in to the wrong account, before any agent touches client work.

Under Agents will be able to (change any time in the Access profile), these are on by default:

✓Read documents

✓Create new documents

✓Insert and format text, tables and lists

And these are unchecked, marked ⚠, and only run if you turn them on:

⚠Delete document content

Then click Confirm — this is the approved account.

6. Approve the documents agents may touch

This is the step that separates clients, and the one people skip. Connecting the account is not the same as granting access to a file. On the connector's card, paste the document IDs this workspace may touch into Approved documents, one per line — the ID is the segment between /d/ and /edit in the document URL.

Approved documents:
1AbCdEf...              # client A — document the agent may edit
2GhIjKl...              # client B — a second approved document

Or, in the Access section, choose Account-wide deliberately. There are only two modes, and the safe pinned one is the default.

7. Run the first proof

Ask the agent for a safe read against an approved document:

{
  "tenant": "<WORKSPACE_ID>",
  "service": "google_docs",
  "verb": "api_bridge.request",
  "method": "GET",
  "path": "/v1/documents/<DOCUMENT_ID>?fields=documentId"
}

Success criteria:

decision: allow
HTTP 200
documentId matches the approved document
secret_exposed: false
audit entry exists

What happens when nothing is approved

Outloop fails closed here, which is the behaviour you want and the most common first confusion:

→No approved document and no explicit account-wide setting — every agent call is refused with CUSTOMER_RESOURCE_PIN_REQUIRED.

→A document that is not on the list — refused with RESOURCE_ID_NOT_ALLOWED.

→Both refusals happen before the credential is read — no Google call is made, and nothing is charged against your quota.

→Creating a new document while pinned is refused too. Approve the new ID afterwards; Outloop never widens a pin by itself.

Verified vs not claimed yet

Verified A full real workflow through Outloop — created a document, inserted and formatted text, tables and structural elements, and read them back — using files created for the proof.
Verified An audited read through a pin created in the dashboard: decision: allow, HTTP 200, secret_exposed: false.
Verified Wrong-resource denial (RESOURCE_ID_NOT_ALLOWED) and no-pin denial (CUSTOMER_RESOURCE_PIN_REQUIRED), both at zero Keychain reads.
Verified Several Google connectors sharing one OAuth app, each holding its own distinct refresh token.
Verified The audit contained no document content and no secrets.
Not claimed Anything on a machine other than the Mac this was proven on. Outloop is at controlled design-partner stage — reproduce it on your own Mac before relying on it for client work.

Troubleshooting

Every call returns CUSTOMER_RESOURCE_PIN_REQUIRED

The workspace has no approved document and has not been set to account-wide. Add at least one document ID under Approved documents, or choose account-wide deliberately.

A specific file returns RESOURCE_ID_NOT_ALLOWED

That document is not on the approved list for this workspace. Add its ID — and check you are adding it to the right workspace, because this refusal is usually correct.

The agent created a file and then could not use it

Expected while pinned. Approve the new document ID afterwards; Outloop never widens a pin on its own.

Why did my refresh token stop working after a week?

If the Google Cloud OAuth consent screen is in Testing with an External user type, Google revokes refresh tokens after 7 days. Publish the app to In production (or use an Internal user type inside a Google Workspace organisation) and connect again.

Outloop is an independent tool and is not affiliated with or endorsed by Google. See the security model, the Google Drive setup guide, or the full guide index.