Configure private OAuth for Google Drive labels

Most Google Drive setups can use Barndoor’s stored public OAuth credentials. Follow this advanced guide only if you need Barndoor to discover your organization’s published Drive classification labels. This enables:

• Admins to search and select labels in Field Controls conditional rules
• Agents and administrators to use the Google Drive MCP server’s list_labels and list_file_labels tools

Label discovery requires a private Google OAuth client owned by your organization. This guide applies to the Barndoor-managed Google Drive MCP server available in the MCP server directory. It does not apply to Google’s official remote Drive MCP server.

​

Prerequisites

You need:

• Admin access to your Barndoor organization
• A Google Workspace edition that supports Drive labels
• Permission to create an OAuth client and enable APIs in a Google Cloud project
• At least one published, Drive-enabled label in your Google Workspace
• A Google Workspace user who can view the labels you want Barndoor to discover

​

1. Prepare your Google Drive labels

Barndoor discovers existing labels; it does not create or publish the label taxonomy.

1. Open Label manager in the Google Admin console, or navigate to Security → Access and data control → Label manager. You need the Manage Classification Labels privilege.
2. On Classification labels, create the labels your organization needs.
3. Enable the labels for Drive and publish them. Published Drive-enabled labels show Drive under Applications and Published under Status.

Only published, Drive-enabled labels visible to the connected identity appear in Barndoor.

​

2. Configure a Google Cloud project

Use the same Google Cloud project for the OAuth client and both required APIs.

1. Create or select a project in Google Cloud.
2. Enable the Drive Labels API.
3. Enable the Google Drive API.
4. Open Google Auth Platform and configure the app’s branding and audience. If the app is in Testing, add the identities that will connect to Barndoor as test users.
5. Create an OAuth client with application type Web application.
6. Add the production redirect URI from Redirect URI Allowlisting:
   https://app.barndoor.ai/callback
   
   If you are connecting from a Barndoor trial hostname, allowlist that hostname’s /callback URI as well. A mismatch is a Google redirect error, not a Barndoor scope error.
7. On Google Auth Platform → Data Access, add every scope Barndoor will request. A new private client needs the default Google Drive scopes plus Labels:
   https://www.googleapis.com/auth/drive.file
   https://www.googleapis.com/auth/drive.readonly
   https://www.googleapis.com/auth/drive.metadata.readonly
   openid
   https://www.googleapis.com/auth/drive.labels.readonly
   
   Adding a scope on Data Access only makes it available to request. Barndoor must also list it on the server instance, then the user must reconnect.

​

3. Configure Google Drive in Barndoor

1. Navigate to Admin → MCP Servers.
2. Add Google Drive from the Barndoor-managed MCP server directory, or open an existing Google Drive server.
3. Turn off Use stored public OAuth credentials.
4. Paste the Client ID and Client Secret from your Google Cloud OAuth client. On an existing server, those fields are New Client ID and New Client Secret. Leave them blank to keep the current credentials.
5. In Scopes, keep the default Drive scopes and add:
   https://www.googleapis.com/auth/drive.labels.readonly
   
   drive.labels.readonly is the least-privilege scope for Field Controls discovery (list_labels / list_file_labels). The broader drive.labels scope is only for applying an existing label to a file (update_file_labels). It does not create or publish the taxonomy — there is no create_label tool — and it still cannot classify a file this OAuth app did not create. That write fails with appNotAuthorizedToFile because the default drive.file scope cannot stamp existing Docs.
6. Save the server configuration. Do not select Reset to default scopes afterward, because that removes the Labels scope.
7. On the server detail page, connect the service account that Field Controls will use for live label discovery.

If the server was already connected, reconnect it after changing scopes. Existing OAuth grants do not automatically receive newly added scopes. On the Google consent screen, confirm that access to Drive labels is included.

​

4. Search and select labels in Field Controls

1. Navigate to Data Control Center → Field Controls.
2. Click Add Conditional Rule.
3. Select the configured Google Drive server.
4. Under When, select Provider classification.
5. Use Search Drive labels to find a published label, then select it.
6. Configure the rule’s direction and action, then click Add Rule.

The live list is loaded with the service account connection on the selected Google Drive server. If Barndoor prompts you to connect or reconnect that account, complete the OAuth flow and retry the search.

​

Verify the setup

You can verify label discovery in either place:

• In Field Controls, Provider classification shows your published label titles under the live results.
• Through the Google Drive MCP server, the list_labels tool returns the published label taxonomy.

To verify a label on a specific file, apply the label in Google Drive and call list_file_labels with that file’s ID.

​

Troubleshooting

​

Limitations

• Barndoor discovers existing labels but does not create or publish the label taxonomy. There is no create_label tool on the Google Drive connector.
• Reading labels on an existing file works. Applying them often does not: update_file_labels returns appNotAuthorizedToFile for files this OAuth app did not create, even if you requested drive.labels instead of drive.labels.readonly. The default drive.file scope cannot stamp the customer’s existing corpus.
• Organizations that do not need Drive label discovery should continue using Barndoor’s stored public OAuth credentials.