google-workspace

Google Workspace API SOP

Read and write Google Docs, Sheets, and Drive files using the Google REST APIs. Covers OAuth setup, credential management, and concrete operations for each service.

When to Use

• User wants to read content from a Google Doc
• User wants to append rows to a Google Sheet
• User wants to list or upload files in Google Drive
• User wants to export a Google Doc as PDF or DOCX
• User wants to share a Drive file

---

Part 1 — Auth Setup

Google APIs require OAuth 2.0. Two paths:

Path A — Service Account (recommended for automation)

1. Go to Google Cloud Console → select or create a project
2. Enable APIs: Google Docs API, Google Sheets API, Google Drive API
3. IAM & Admin → Service Accounts → Create Service Account
4. Generate a JSON key → download as service-account.json
5. Share target Docs/Sheets/Drive folders with the service account email (found in the JSON file)

export GOOGLE_SERVICE_ACCOUNT_JSON="$HOME/.cowrangler/service-account.json"

# Install: pip install google-auth google-auth-httplib2 google-api-python-client
from google.oauth2 import service_account
from googleapiclient.discovery import build

SCOPES = [
    "https://www.googleapis.com/auth/documents",
    "https://www.googleapis.com/auth/spreadsheets",
    "https://www.googleapis.com/auth/drive",
]

creds = service_account.Credentials.from_service_account_file(
    "service-account.json", scopes=SCOPES
)

docs_service   = build("docs", "v1", credentials=creds)
sheets_service = build("sheets", "v4", credentials=creds)
drive_service  = build("drive", "v3", credentials=creds)

Path B — OAuth 2.0 for User Accounts (interactive)

1. Cloud Console → APIs & Services → Credentials → Create OAuth client ID → Desktop app
2. Download client_secret.json

from google_auth_oauthlib.flow import InstalledAppFlow
from google.auth.transport.requests import Request
import pickle, os

SCOPES = [
    "https://www.googleapis.com/auth/documents",
    "https://www.googleapis.com/auth/spreadsheets",
    "https://www.googleapis.com/auth/drive",
]

creds = None
if os.path.exists("token.pickle"):
    with open("token.pickle", "rb") as f:
        creds = pickle.load(f)

if not creds or not creds.valid:
    if creds and creds.expired and creds.refresh_token:
        creds.refresh(Request())
    else:
        flow = InstalledAppFlow.from_client_secrets_file("client_secret.json", SCOPES)
        creds = flow.run_local_server(port=0)
    with open("token.pickle", "wb") as f:
        pickle.dump(creds, f)

docs_service   = build("docs", "v1", credentials=creds)
sheets_service = build("sheets", "v4", credentials=creds)
drive_service  = build("drive", "v3", credentials=creds)