Does the Google Sheets API use an API key or OAuth?

OAuth. You create a Google Cloud OAuth client once, then connect the account from Outloop in your browser — Outloop mints and stores the refresh token host-side in the macOS Keychain. The agent uses the credential's capability without ever seeing it.

Do I have to enter the Client Secret again for every Google connector?

No. The first Google connector you set up asks for the Client ID and Client Secret; save it as your default Google OAuth app and every later Google connector picks it from the dropdown. Each connector still signs in separately and holds its own refresh token, scopes and connected account, so you can revoke one without touching the others.

How do I stop an agent touching the wrong client's spreadsheet?

Approve specific spreadsheet IDs on the workspace. A request naming a spreadsheet that is not on the approved list is refused with RESOURCE_ID_NOT_ALLOWED, and a workspace with nothing approved and no explicit account-wide setting refuses every call with CUSTOMER_RESOURCE_PIN_REQUIRED. Both refusals happen before the credential is read, so no Google call is made.

Can an agent create a new spreadsheet while the workspace is pinned?

Creating a new spreadsheet is refused while the workspace is pinned to an approved list — Outloop never widens a pin by itself. Approve the new ID afterwards and the agent can work with it. If you genuinely want agents working across the whole account, choose account-wide deliberately in the Access section.

What can agents do by default?

Practical work is on by default: read spreadsheets, create new spreadsheets, edit cells, formulas and formatting. Actions that destroy content are unchecked by default and shown with a warning marker — you turn them on deliberately, per workspace, or leave them off.

Can the agent see the OAuth credential?

No. The refresh token is minted and stored host-side in the macOS Keychain and used on the wire at request time. Every request is audited with secret_exposed: false, and the raw value never reaches chat, prompts, logs, or project files.

Learn · Setup guides

Connect Google Sheets to Outloop

Last updated: August 14, 2026

In short

Connecting Google Sheets to Outloop means signing in to Google once from Outloop in your browser, then approving the exact spreadsheets each client workspace is allowed to touch.

Outloop mints and stores the refresh token host-side in the macOS Keychain — there is no token to copy. Agents then read and edit only the spreadsheets you approved for that workspace; a request naming any other spreadsheet is denied before any call reaches Google, and every request is audited with secret_exposed:false.

Summarize this setup guide with AI ChatGPT Claude Perplexity

What this setup gives you

Agents that can do real Sheets work inside the client files you approved — and nothing outside them. Outloop holds the Google credential locally, decides which spreadsheet each workspace may reach, and audits every request.

→An agent can created a spreadsheet, wrote values, formulas and formatting in an approved spreadsheet.

→Each client workspace is pinned to its own spreadsheets — one agency Google account, many separated clients.

→The refresh token is minted host-side and never appears on your clipboard, in a screenshot, or in a prompt.

→A wrong-file request is refused before any call reaches Google, not after.

What you need before starting

✓Access to a Google Cloud project with the OAuth consent screen configured.

✓A Client ID and Client Secret for your first Google connector. After that, Outloop reuses the saved Google OAuth app and never asks for the secret again.

✓The Google account that can open the client spreadsheets — you will sign in as it in your browser.

✓The spreadsheet IDs the workspace should be allowed to touch (the segment between /d/ and /edit in the spreadsheet URL).

✓Outloop installed and activated, with a workspace selected.

1. Enable the Google Sheets API

In Google Cloud Console, open APIs & Services → Library, search Google Sheets API, and click Enable. Outloop calls it at sheets.googleapis.com.

2. Create the OAuth client (once, for all Google connectors)

In Google Auth Platform → Clients, create a Web application OAuth client and copy the Client ID and Client Secret. Google may show the secret only once; if you lose it, create a new one. The scope this connector requests is:

https://www.googleapis.com/auth/spreadsheets
openid
email

The openid and email scopes are how Outloop verifies which Google account you actually connected — that identity check is Google OIDC, and it does not involve any Drive scope.

You only enter the Google OAuth app once

The first Google connector you set up asks for the Client ID and Client Secret from your Google Cloud OAuth client. Tick save as my default Google OAuth app and every later Google connector — Gmail, Drive, Docs, Slides and Analytics GA4 — picks it from the Google OAuth app dropdown with no Client Secret to re-enter. When a saved profile supplies the app, Outloop shows “Using <client-id> — no Client Secret needed. This connector still signs in separately and gets its own access.”

Reusing the app does not mean sharing one login. Each connector still opens its own browser sign-in and gets its own refresh token, its own scopes and its own connected account — so you can revoke or re-authenticate one connector without touching the others.

3. Add Google Sheets in Outloop

In Outloop, open API Keys & Access → Add Access and choose Google Sheets. The panel opens on Connect in your browser, with the Cloud Console detail in the collapsed Setup details — Google Cloud OAuth client, scopes and caveats and Before you connect disclosures.

Under Access to request from Google, choose the level:

→Full spreadsheets — read, create, edit values, formulas and formatting (recommended)

→Read-only spreadsheets

The full option is preselected because it is what most agency work needs; read-only is offered but never preselected. Then check the Google OAuth app dropdown — a saved profile supplies the app with no Client Secret to re-enter.

Read the storage line before you continue. Where Outloop says the credential will be stored in the SHARED slot, it also warns that it replaces whatever is already there. If another workspace relies on that slot, change the scope before connecting rather than after.

4. Connect the account in your browser

Click Connect Google Sheets in your browser. Google's own sign-in opens, you sign in as the account that can open the client spreadsheets, and you approve the consent screen there. Outloop mints and stores the refresh token host-side.

Nothing to copy or paste. There is no refresh token on your clipboard, so there is nothing to leak into a screenshot, a chat, or a .env file.

5. Confirm the account and capabilities

Outloop shows Connected as the Google account you just used. Check it — this is the moment to catch a sign-in to the wrong account, before any agent touches client work.

Under Agents will be able to (change any time in the Access profile), these are on by default:

✓Read spreadsheets

✓Create new spreadsheets

✓Edit cells, formulas and formatting

And these are unchecked, marked ⚠, and only run if you turn them on:

⚠Erase the contents of cells

⚠Delete tabs, rows and columns

Then click Confirm — this is the approved account.

6. Approve the spreadsheets agents may touch

This is the step that separates clients, and the one people skip. Connecting the account is not the same as granting access to a file. On the connector's card, paste the spreadsheet IDs this workspace may touch into Approved spreadsheets, one per line — the ID is the segment between /d/ and /edit in the spreadsheet URL.

Approved spreadsheets:
1AbCdEf...              # client A — spreadsheet the agent may edit
2GhIjKl...              # client B — a second approved spreadsheet

Or, in the Access section, choose Account-wide deliberately. There are only two modes, and the safe pinned one is the default.

7. Run the first proof

Ask the agent for a safe read against an approved spreadsheet:

{
  "tenant": "<WORKSPACE_ID>",
  "service": "google_sheets",
  "verb": "api_bridge.request",
  "method": "GET",
  "path": "/v4/spreadsheets/<SPREADSHEET_ID>?fields=spreadsheetId"
}

Success criteria:

decision: allow
HTTP 200
spreadsheetId matches the approved spreadsheet
secret_exposed: false
audit entry exists

What happens when nothing is approved

Outloop fails closed here, which is the behaviour you want and the most common first confusion:

→No approved spreadsheet and no explicit account-wide setting — every agent call is refused with CUSTOMER_RESOURCE_PIN_REQUIRED.

→A spreadsheet that is not on the list — refused with RESOURCE_ID_NOT_ALLOWED.

→Both refusals happen before the credential is read — no Google call is made, and nothing is charged against your quota.

→Creating a new spreadsheet while pinned is refused too. Approve the new ID afterwards; Outloop never widens a pin by itself.

Verified vs not claimed yet

Verified A full real workflow through Outloop — created a spreadsheet, wrote values, formulas and formatting, and read them back — using files created for the proof.
Verified An audited read through a pin created in the dashboard: decision: allow, HTTP 200, secret_exposed: false.
Verified Wrong-resource denial (RESOURCE_ID_NOT_ALLOWED) and no-pin denial (CUSTOMER_RESOURCE_PIN_REQUIRED), both at zero Keychain reads.
Verified Several Google connectors sharing one OAuth app, each holding its own distinct refresh token.
Verified The audit contained no spreadsheet content and no secrets.
Not claimed Anything on a machine other than the Mac this was proven on. Outloop is at controlled design-partner stage — reproduce it on your own Mac before relying on it for client work.

Troubleshooting

Every call returns CUSTOMER_RESOURCE_PIN_REQUIRED

The workspace has no approved spreadsheet and has not been set to account-wide. Add at least one spreadsheet ID under Approved spreadsheets, or choose account-wide deliberately.

A specific file returns RESOURCE_ID_NOT_ALLOWED

That spreadsheet is not on the approved list for this workspace. Add its ID — and check you are adding it to the right workspace, because this refusal is usually correct.

The agent created a file and then could not use it

Expected while pinned. Approve the new spreadsheet ID afterwards; Outloop never widens a pin on its own.

Why did my refresh token stop working after a week?

If the Google Cloud OAuth consent screen is in Testing with an External user type, Google revokes refresh tokens after 7 days. Publish the app to In production (or use an Internal user type inside a Google Workspace organisation) and connect again.

Outloop is an independent tool and is not affiliated with or endorsed by Google. See the security model, the Google Drive setup guide, or the full guide index.