Google Drive

Sync Google Drive files into a knowledge base via OAuth 2.0 or a Google Cloud service account.

Google Drive supports two types of Connection — Google OAuth 2.0 and Google Cloud service account. Create the appropriate Connection before adding the integration. The full walkthrough for adding and syncing sources is in Data Sources.

Google OAuth 2.0

On Connections, click Add new connection, choose Google as the Type, and select these scopes:

Drive files (read-only) — always
Directory groups (read-only) — when permission syncing is Enabled
Group members (read-only) — when permission syncing is Enabled

Click Create, then Authorize to complete the Google consent flow. See OAuth Connections for the authorize step and token refresh behavior.

For Shared Drives, grant the account that authorizes the Connection read access at the Shared Drive level — not to a sub-folder inside it. The integration user must have read access to every Shared Drive you want indexed.

The account that authorizes the Google OAuth 2.0 Connection must be a Google Workspace admin.

For maintenance purposes, use a dedicated user for this Connection so it is not tied to a human account.

Google Cloud service account

A Google Workspace is required. Service accounts use domain-wide delegation to access Drive on behalf of a Workspace user — set up the account in Google Cloud and Google Admin, then create a Google Cloud Connection in Dynamiq with the downloaded key.

If you prefer OAuth with an individual account instead, use Google OAuth 2.0 above.

Set up in Google Cloud

Create a project and enable APIs

Create a Google Cloud project, then enable these APIs for that project:

In the Google Cloud console, open APIs & services → Enabled APIs and services, click + Enable APIs and services, search for each API, and click Enable.

Create a service account and download a key

On the Service Accounts page, click Create service account and complete step 1 (you can skip steps 2 and 3). Open the new account, go to Keys, click Add key, and download the JSON key — you upload this when creating the Dynamiq Connection.

Google organizations created after April 2024 may block service account key creation by default. If key creation is disabled, open the Disable service account key creation org policy, click Manage, choose Override parent's policy, set the rule to Not enforced, and click Set policy.

Domain-wide delegation

Grant the service account read-only access to Google Drive through your Workspace admin console:

Copy the service account's Unique ID (client ID) from Google Cloud.
In the Domain-wide delegation page of the Google Admin console, click Add new.
Paste the Unique ID into Client ID.
Paste these OAuth scopes into the scopes field:

https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly

The admin.directory.* scopes are only needed when permission syncing is Enabled.

Create the Connection

On Connections, click Add new connection, choose Google Cloud as the Type, and fill in the service account JSON key fields (project_id, private_key, client_email, and the rest). See Create a Connection for the field reference.

The Connection also needs the email of a Workspace user the service account impersonates. Use a dedicated account (for example, drive-sync@your-domain.com).

This must NOT be the service account email.

That user must have:

Access to Drive and Docs in Google Workspace
Admin console privileges → Services → Drive and Docs → Settings
Admin API privileges → Users → Read
Admin API privileges → Groups → Read
Admin API privileges → Organization Units → Read

An existing admin or a new account created for this purpose both work. Assign custom admin roles under Account → Admin roles in the Google Admin console.

For Shared Drives, add the impersonated user as a member with read access at the Shared Drive level — not to a sub-folder inside it.

Permission syncing

When you add a Google Drive integration, permission syncing can be Enabled or Disabled:

Disabled — everyone who can query the knowledge base sees every synced file.
Enabled — Dynamiq syncs each file's Google Drive permissions during source sync and enforces them at retrieval time. A user only gets chunks from files they can access in Google Drive.

When permission syncing is Enabled, use group-related scopes: Directory groups (read-only) and Group members (read-only) on a Google OAuth 2.0 Connection, or the admin.directory.group.readonly and admin.directory.group.member.readonly scopes in domain-wide delegation for a Google Cloud service account.

On this page