Overview#

This guide walks through creating your own Google Drive OAuth client for rclone. The official rclone Google Drive docs strongly recommend using your own client ID instead of the shared default so you control the project, consent screen, and API quota for your setup. If you want the rclone-specific background first, see making your own client ID.

The flow is mostly CLI-driven, but a few steps still must be completed in the Google Cloud web console.

Prerequisites#

WARNING

The Google account you use to create the OAuth client in Google Cloud does not have to be the same account you later use with rclone. You can create the client in one account and authenticate rclone against another Google Drive account when you configure the remote.

1
which gcloud
2
which rclone

1
# Sign in to gcloud
2
gcloud auth login
3

4
# Verify authentication
5
gcloud auth list

CLI Setup Process#

1
# Create a unique project ID using timestamp
2
PROJECT_ID="rclone-drive-$(date +%s)"
3
echo "Creating project: $PROJECT_ID"
4

5
# Create new project
6
gcloud projects create $PROJECT_ID --name="Rclone Google Drive"
7

8
# Set as active project
9
gcloud config set project $PROJECT_ID

1
# Enable Drive API for the project
2
gcloud services enable drive.googleapis.com
3

4
# Verify it's enabled
5
gcloud services list --enabled | grep drive
6
# You should see a line mentioning drive.googleapis.com and the Google Drive API

1
# Start rclone interactive configuration
2
rclone config
3

4
# Follow the prompts:
5
# n                          # New remote
6
# gdrive                     # Name it "gdrive" (or your choice)
7
# drive                      # Type number for "Google Drive"
8
# <paste CLIENT_ID>          # Your client ID from Step 4
9
# <paste CLIENT_SECRET>      # Your client secret from Step 4
10
# 1                          # Scope: Full access to all files
11
# <Enter>                    # Leave root_folder_id blank
12
# <Enter>                    # Leave service_account_file blank
13
# n                          # No advanced config
14
# y                          # Use web browser to authenticate
15
#                            # Browser opens - sign in with the Google Drive account you want to access
16
# y                          # Confirm the configuration looks good
17
# q                          # Quit config

1
# Set your credentials as environment variables first
2
export CLIENT_ID="your-client-id.apps.googleusercontent.com"
3
export CLIENT_SECRET="your-client-secret"
4

5
# Create rclone remote non-interactively
6
rclone config create gdrive drive \
7
  client_id "$CLIENT_ID" \
8
  client_secret "$CLIENT_SECRET" \
9
  scope "drive"
10

11
# Then manually authorize (will open browser)
12
rclone config reconnect gdrive:

1
# On your local machine with a browser:
2
rclone authorize "drive" "$CLIENT_ID" "$CLIENT_SECRET"
3

4
# Copy the token output, then on your headless server:
5
rclone config
6
# Follow prompts, and when asked for the token, paste it

Verification#

Test the remote after setup with a few low-risk checks:

1
# Confirm the remote can list top-level directories
2
rclone lsd gdrive:
3

4
# Confirm Drive account information is reachable
5
rclone about gdrive:
6

7
# Sample the first level of files without walking the whole Drive
8
rclone ls gdrive: --max-depth 1 | head -10

If those succeed, the remote is usually configured correctly. If you also want a write test, upload a temporary file to a throwaway folder and remove it afterward.

Publishing the App (Optional)#

For the first authentication, Google may show an unverified-app warning because this is your own OAuth client and not a broadly verified public app. The exact warning text can change, but the important point is that this is expected for a personal setup.

If you keep the app as External and leave it in Testing:

WARNING

Testing mode vs. production:

• Google limits External apps in Testing to listed test users.
• For apps requesting Drive scopes, the authorization expires after 7 days.
• If you requested offline access, the refresh token expires on the same schedule, so you should expect to re-authenticate.
• Google documents this behavior in its general OAuth 2.0 guidance, where Testing-mode external apps receive refresh tokens that expire in 7 days unless they request only basic OpenID profile scopes.

If you want longer-lived authorizations for normal use, return to the web console and move the app toward production status. Google’s consent-screen and audience guidance is documented in Configure OAuth consent. Whether you also need Google verification depends on the scopes you request and how widely you intend to distribute the app.

Troubleshooting#

If setup does not work the first time, these commands usually narrow it down quickly:

1
# Show the current remote configuration
2
rclone config show
3

4
# Re-run the browser authorization flow
5
rclone config reconnect gdrive:
6

7
# Retry with debug logging if authentication succeeds but operations fail
8
rclone ls gdrive: --log-level DEBUG
9

10
# Confirm the Drive API is enabled for the project
11
gcloud services list --enabled --project="$PROJECT_ID" | grep drive

Common fixes:

• Access denied or app not available: make sure the app is configured on the OAuth consent screen and your Google account is added as a test user when the app is still in Testing.
• Invalid client or unauthorized_client: re-check the Client ID and Client Secret copied from the Google Cloud credentials page.
• Expired or revoked token: run rclone config reconnect gdrive: and complete the sign-in flow again.
• No browser available: use the headless-server flow from the configuration section and paste the generated token manually.

If the remote still fails, it is often faster to delete just the rclone remote and re-create it than to keep retrying a broken configuration.

Cleanup#

If you want to remove the setup later:

1
rclone config delete gdrive
2
gcloud projects delete "$PROJECT_ID"

If you may reuse the setup later, delete only the rclone remote and keep the Google Cloud project and OAuth client in place.