Skip to main content

Set up the official Google MCP servers

The official Google Drive, Google Calendar, and Gmail MCP servers give AI agents access to a user's Drive files, calendar events, and Gmail messages under that user's own Google identity. This guide covers setting the OAuth consent screen to internal use, creating an OAuth client in Google Cloud, and connecting each server to MintMCP.

MintMCP also offers a bundled Google Workspace connector that uses MintMCP's own shared OAuth apps instead of a client you create yourself: see Next steps if you want that path instead.

Prerequisites​

  • A MintMCP admin account
  • A Google Workspace organization, since an Internal OAuth consent screen only works for a Cloud project owned by a Workspace (or Cloud Identity) organization, not a personal Google account
  • A Google Cloud project with permission to enable APIs and create OAuth credentials

Enable the Google APIs​

  1. Go to console.cloud.google.com and select or create a project owned by your Workspace organization.
  2. Go to APIs & Services → Library and enable the API for each server you're connecting: Google Drive API, Google Calendar API, Gmail API.

The Gmail and Calendar scopes these servers use are Google restricted and sensitive scopes. An externally published app needs a CASA security assessment to use them; an Internal user type skips it and limits sign-in to your Workspace organization.

  1. Go to console.cloud.google.com/auth/audience for your project.
  2. Set User type to Internal and fill in the required fields: App name (for example, MintMCP Google), User support email, and Developer contact information.
  3. Go to console.cloud.google.com/auth/scopes and click Add or remove scopes.
  4. Add the scopes listed under each server's tab below, then click Update and Save. Only scopes for APIs you've already enabled appear in the picker.

Create the OAuth client​

The OAuth client gives MintMCP a Client ID and secret to broker each user's Google sign-in. Create one Web application client and point its redirect URI at MintMCP's callback. All three servers can share this same client.

  1. Go to console.cloud.google.com/auth/clients and click Create client.

  2. Set Application type to Web application and give it a name (for example, MintMCP Google). The name only identifies the client in the console.

    Create OAuth client ID form with application type set to Web application and a name field

  3. Under Authorized redirect URIs, click Add URI and enter MintMCP's callback URL:

    https://app.mintmcp.com/oauth/callback
    Authorized redirect URIs field set to the MintMCP OAuth callback URL

  4. Click Create. Google shows the Client ID and Client secret once; copy both now because you can't view the secret again after closing the dialog.

    OAuth client created dialog showing the Client ID and Client secret

Reopen the client anytime from the Clients list to edit its redirect URIs or rotate the secret.

OAuth client detail page showing Client ID, redirect URIs, and the client secret with rotation options

Add the servers to MintMCP​

Each server is a separate connector, marked Recommended, in the MintMCP store. Install the ones your organization needs and paste the same Client ID and Client Secret into each.

  1. In MintMCP, go to MCP store → Manage store.
  2. Find the Google Drive connector, marked Recommended, and click to install it.
  3. Enter the Client ID and Client Secret from the OAuth client you created.
  4. Click Install.

Add these scopes to the OAuth consent screen's Data Access page:

ScopeAccess granted
openidOpenID Connect authentication
.../userinfo.emailView user email address
.../drive.readonlySearch and read Drive files
.../drive.fileView and manage files created or opened with this app

All scopes above use the https://www.googleapis.com/auth/ prefix.

The first time a user calls a tool on a given server, MintMCP directs them to sign in with Google and consent to that server's scopes. MintMCP stores and refreshes their token automatically on every subsequent call.

Security considerations​

  • Each user authenticates individually through OAuth, so tool calls run under that user's own Drive, Calendar, or Gmail access.
  • The gmail.modify and calendar scopes grant write access: email sending and label changes, and calendar and event creation, updates, and deletion. Install only the servers your organization needs.
  • The Internal user type restricts sign-in to accounts in your Workspace organization and skips Google's restricted-scope verification review.
  • Keep the client secret secure: anyone with it can impersonate the app and request access to users' Drive, Calendar, or Gmail data.

Troubleshooting​

  • Sign-in fails with redirect_uri_mismatch. The redirect URI on the Google Cloud OAuth client doesn't match MintMCP's callback. Open the OAuth client, confirm Authorized redirect URIs contains https://app.mintmcp.com/oauth/callback exactly, and save. Changes can take a few minutes to take effect.
  • Sign-in fails or the account can't complete consent. The Google account isn't a member of the Workspace organization that owns the Cloud project, since an Internal OAuth client only accepts sign-in from accounts in the same organization.
  • A scope doesn't appear in the Data Access picker. The API that owns that scope isn't enabled yet. Enable the matching API (Drive, Calendar, or Gmail) in APIs & Services → Library, then try adding the scope again.

Next steps​