> ## Documentation Index
> Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure private OAuth for Google Drive labels

> Advanced setup for organizations that need Drive classification labels in Field Controls conditional rules.

Most Google Drive setups can use Barndoor's stored public OAuth credentials.
Follow this advanced guide only if you need Barndoor to discover your
organization's published Drive classification labels. This enables:

* Admins to search and select labels in
  [Field Controls](/how-tos/data-control-center/field-controls) conditional rules
* Agents and administrators to use the Google Drive MCP server's `list_labels`
  and `list_file_labels` tools

Label discovery requires a private Google OAuth client owned by your
organization.

<Warning>
  Do not add the Google Drive Labels scope while **Use stored public OAuth
  credentials** is enabled. Barndoor's managed Google OAuth app does not request
  this restricted scope. Use your own Google Client ID and Client Secret for a
  Google Drive server that needs label discovery.
</Warning>

This guide applies to the Barndoor-managed [Google Drive MCP
server](/mcp-servers/google_drive) available in the MCP server directory. It
does not apply to Google's official remote Drive MCP server.

## Prerequisites

You need:

* Admin access to your Barndoor organization
* A Google Workspace edition that supports
  [Drive labels](https://developers.google.com/workspace/drive/labels/guides/create-label)
* Permission to create an OAuth client and enable APIs in a Google Cloud project
* At least one published, Drive-enabled label in your Google Workspace
* A Google Workspace user who can view the labels you want Barndoor to discover

## 1. Prepare your Google Drive labels

Barndoor discovers existing labels; it does not create or publish the label
taxonomy.

1. Open [Label manager](https://admin.google.com/ac/dc/labels) in the Google
   Admin console, or navigate to **Security → Access and data control → Label
   manager**. You need the **Manage Classification Labels** privilege.
2. On **Classification labels**, create the labels your organization needs.
3. Enable the labels for Drive and publish them. Published Drive-enabled
   labels show **Drive** under **Applications** and **Published** under
   **Status**.

Only published, Drive-enabled labels visible to the connected identity appear
in Barndoor.

<Note>
  If you lack that privilege, Google may send you to `/permissiondenied` or a
  redirect-loop error. That is an authorization failure, not a broken link.
</Note>

<Check>
  Before continuing, confirm that at least one label is published and enabled for
  Drive in Label manager.
</Check>

## 2. Configure a Google Cloud project

Use the same Google Cloud project for the OAuth client and both required APIs.

1. Create or select a project in Google Cloud.

2. Enable the
   [Drive Labels API](https://console.cloud.google.com/apis/library/drivelabels.googleapis.com).

3. Enable the
   [Google Drive API](https://console.cloud.google.com/apis/library/drive.googleapis.com).

4. Open [Google Auth Platform](https://console.cloud.google.com/auth) and
   configure the app's branding and audience. If the app is in Testing, add
   the identities that will connect to Barndoor as test users.

5. Create an OAuth client with application type **Web application**.

6. Add the production redirect URI from
   [Redirect URI Allowlisting](/how-tos/redirect-uri-allowlisting):

   ```text theme={null}
   https://app.barndoor.ai/callback
   ```

   If you are connecting from a Barndoor trial hostname, allowlist that
   hostname's `/callback` URI as well. A mismatch is a Google redirect error,
   not a Barndoor scope error.

7. On **Google Auth Platform → Data Access**, add every scope Barndoor will
   request. A new private client needs the default Google Drive scopes plus
   Labels:

   ```text theme={null}
   https://www.googleapis.com/auth/drive.file
   https://www.googleapis.com/auth/drive.readonly
   https://www.googleapis.com/auth/drive.metadata.readonly
   openid
   https://www.googleapis.com/auth/drive.labels.readonly
   ```

   Adding a scope on Data Access only makes it **available** to request.
   Barndoor must also list it on the server instance, then the user must
   reconnect.

<Note>
  The **Drive Labels API** provides the label taxonomy. The **Google Drive API**
  provides file search and file-label access. Enabling the separate **Drive MCP
  API** does not enable these tools.
</Note>

<Check>
  Before continuing, confirm that both APIs show as enabled, the Web application
  OAuth client has `https://app.barndoor.ai/callback` (and any trial callback
  you use), and **Data Access** lists the default Drive scopes plus
  `drive.labels.readonly`.
</Check>

## 3. Configure Google Drive in Barndoor

<Info>
  In this guide, **service account** means the organization-level OAuth connection
  on the Barndoor server detail page. It does not mean a Google Cloud IAM service
  account. Connect a Google Workspace user that can view the labels you need.
</Info>

1. Navigate to **Admin → MCP Servers**.

2. Add **Google Drive** from the Barndoor-managed MCP server directory, or open
   an existing Google Drive server.

3. Turn off **Use stored public OAuth credentials**.

4. Paste the Client ID and Client Secret from your Google Cloud OAuth client.
   On an existing server, those fields are **New Client ID** and **New Client
   Secret**. Leave them blank to keep the current credentials.

5. In **Scopes**, keep the default Drive scopes and add:

   ```text theme={null}
   https://www.googleapis.com/auth/drive.labels.readonly
   ```

   `drive.labels.readonly` is the least-privilege scope for Field Controls
   discovery (`list_labels` / `list_file_labels`). The broader `drive.labels`
   scope is only for applying an existing label to a file
   (`update_file_labels`). It does not create or publish the taxonomy — there
   is no `create_label` tool — and it still cannot classify a file this OAuth
   app did not create. That write fails with `appNotAuthorizedToFile` because
   the default `drive.file` scope cannot stamp existing Docs.

6. Save the server configuration. Do not select **Reset to default scopes**
   afterward, because that removes the Labels scope.

7. On the server detail page, connect the service account that Field Controls
   will use for live label discovery.

If the server was already connected, reconnect it after changing scopes.
Existing OAuth grants do not automatically receive newly added scopes. On the
Google consent screen, confirm that access to Drive labels is included.

<Check>
  The service account connection should show as connected, and the completed
  Google consent flow should include access to Drive labels.
</Check>

## 4. Search and select labels in Field Controls

1. Navigate to **Data Control Center → Field Controls**.
2. Click **Add Conditional Rule**.
3. Select the configured Google Drive server.
4. Under **When**, select **Provider classification**.
5. Use **Search Drive labels** to find a published label, then select it.
6. Configure the rule's direction and action, then click **Add Rule**.

The live list is loaded with the service account connection on the selected
Google Drive server. If Barndoor prompts you to connect or reconnect that
account, complete the OAuth flow and retry the search.

<Check>
  Your organization's published labels should appear under the live results when
  you search **Provider classification**.
</Check>

## Verify the setup

You can verify label discovery in either place:

* In **Field Controls**, **Provider classification** shows your published label
  titles under the live results.
* Through the Google Drive MCP server, the `list_labels` tool returns the
  published label taxonomy.

To verify a label on a specific file, apply the label in Google Drive and call
`list_file_labels` with that file's ID.

## Troubleshooting

<AccordionGroup>
  <Accordion title="list_labels returns a 403 for drivelabels.googleapis.com">
    Enable the **Drive Labels API** on the Google Cloud project that owns the
    OAuth client. Wait a few minutes, then retry.
  </Accordion>

  <Accordion title="File search returns a 403 saying the Drive API is disabled">
    Enable the **Google Drive API** on the same project, wait a few minutes, and
    retry.
  </Accordion>

  <Accordion title="The Google consent screen omits Labels or Drive file scopes">
    Confirm that:

    * **Use stored public OAuth credentials** is off
    * The private Client ID and Client Secret are saved on the server
    * **Data Access** on the Google OAuth client lists every scope Barndoor
      will request, including the default Drive scopes and
      `drive.labels.readonly`
    * The same scopes are present on the server's **Scopes** field

    Then reconnect the service account. Existing grants do not receive new
    scopes automatically.
  </Accordion>

  <Accordion title="Label manager shows permission denied or a redirect loop">
    You are not authorized for [Label
    manager](https://admin.google.com/ac/dc/labels). Ask a Google Workspace
    super admin to grant **Manage Classification Labels**, then retry. The
    URL is correct even when Google redirects to `/permissiondenied`.
  </Accordion>

  <Accordion title="No error appears, but the live label list is empty">
    Confirm that the labels are published, enabled for Drive, and visible to the
    Google Workspace user connected through Barndoor's organization-level
    service account connection. An empty list usually means the API and OAuth
    grant are working but that user cannot see any eligible labels.
  </Accordion>

  <Accordion title="update_file_labels returns appNotAuthorizedToFile">
    The default `drive.file` scope can write only files this OAuth app created
    or that the user opened with it. Switching from `drive.labels.readonly` to
    `drive.labels` does not change that. Apply the label in the Drive UI, or
    accept that Barndoor cannot stamp an existing Doc with the default Drive
    scopes.
  </Accordion>
</AccordionGroup>

## Limitations

* Barndoor discovers existing labels but does not create or publish the label
  taxonomy. There is no `create_label` tool on the Google Drive connector.
* Reading labels on an existing file works. Applying them often does not:
  `update_file_labels` returns `appNotAuthorizedToFile` for files this OAuth
  app did not create, even if you requested `drive.labels` instead of
  `drive.labels.readonly`. The default `drive.file` scope cannot stamp the
  customer's existing corpus.
* Organizations that do not need Drive label discovery should continue using
  Barndoor's stored public OAuth credentials.