# Google Drive (/search/google-drive) Google Drive Search finds files your account can access, including Google Docs, Sheets, and Slides. **Member accounts** uses your grant; **Service account** adds user, folder, and file-type restrictions. Both modes require your personal Drive connection. ## Connect and search [#connect-and-search] 1. An admin adds **Google Drive** in **Settings → Sources** and chooses **Member accounts**, or configures the service source below. 2. Each teammate selects **Integrations → Google Drive → Connect** and authorizes their account. 3. Search a known file, read the result, and follow its source link. Member mode has no organization folder, file-type, or user selection. Native Drive queries can narrow a search. For example, `name contains 'Roadmap' and 'person@example.com' in owners` finds candidate files by name and owner. ## Readable content and limits [#readable-content-and-limits] | File type | Read behavior | | - | - | | Google Docs and Slides | Text export | | Google Sheets | Formatted values from up to 20 sheets, 1,000 rows, and 52 columns per sheet | | Supported text and JSON | Direct content read | | Text-bearing PDF and DOCX | Download and complete text extraction within the limits below | | Other binary formats | Metadata and a source link | PDF/DOCX reads require the member's download permission. Downloads are capped at 4 MiB and extracted text at 1 MiB. PDFs are limited to 100 pages. DOCX archives are limited to 10 MiB total expanded data and 4 MiB per entry. Password-protected, malformed, mismatched, or oversized files fail explicitly. Image-only scans need OCR; live Search does not perform it. A file read also retrieves comments and replies through the reader's connection. It preserves authors, creation/update times, quoted file context, resolved state, resolve/reopen actions, and comment IDs. Deleted comments and replies are omitted. Discussion reads cover up to three pages of 20 comments and their reply lists, capped at 120,000 characters and the provider response-size limit. Failures or reached limits add an incomplete-coverage notice without discarding readable file content. Follow returned document offsets for more windows; open Drive for remaining history. Comments enrich a file read rather than forming a global search index. First find the file by name, owner, folder, or content. A phrase appearing only in comments cannot reliably discover every matching file. ## Set up a central service account [#set-up-a-central-service-account] 1. Enable **Google Drive API** and **Admin SDK API** in Google Cloud. Enable **Google Sheets API** in the member OAuth project for Sheet reads. Create a service account and download its JSON key. 2. Authorize domain-wide delegation in Workspace Admin for the key's numeric client ID. The shared service-credential configuration declares: ```text https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/admin.directory.domain.readonly ``` 3. In **Settings → Sources → Google Drive**, choose **Service account → Add connection** and add or select the credential. 4. Set **Delegated administrator** to an active Workspace administrator with Directory access. Optionally choose **Users**, folders, and a file type. Save and select this service source. 5. Each reader still connects Drive personally in **Integrations**. The live verifier checks active Directory users and delegated Drive metadata. It does not run group/domain permission indexing; keep the scopes declared by the shared credential configuration when using that credential. The folder picker uses the source credential; the paired folder-ID field is also available. Selected folders and accessible descendants define the boundary. Empty folders remove that restriction, not provider access checks. ## Service-source access [#service-source-access] Sim searches with your OAuth grant and verifies each candidate against current source visibility, folder ancestry, shared-drive identity, and file type. Your account must also read the file. Reads repeat the source checks. With an explicit **Users** list, source verification tries up to six selected users through delegation. Without a list, it checks the connected member's active identity in the same Workspace customer and delegates to that user. For an external reader who cannot be delegated, it can use the verified source administrator and report incomplete coverage. It does not enumerate every employee's private Drive. Personal files outside the configured boundary are excluded. Folder traversal, paging, and verification budgets are bounded. Google search freshness, export limits, and sharing settings still apply; link sharing alone does not authorize a result. ## One service account for Drive, Gmail, and Calendar [#one-service-account-for-drive-gmail-and-calendar] One JSON key can serve all three sources. Enable Drive, Gmail, Calendar, and Admin SDK APIs; enable Sheets API in the member OAuth project for Sheet reads. Authorize the union of the shared credential's configured delegation scopes: ```text https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/gmail.readonly https://www.googleapis.com/auth/calendar.events.readonly https://www.googleapis.com/auth/calendar.readonly https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/admin.directory.domain.readonly ``` Use comma-separated values in Workspace Admin. Each source needs its own configuration, and each member connects each Google service separately. Delegation does not replace personal grants. ## Meet transcripts and notes [#meet-transcripts-and-notes] Meet stores generated transcripts and smart notes as Google Docs in the organizer's Drive. Search them when shared with you, including documents retained beyond Meet's conference API window. For example: ```text fullText contains 'rollback' and mimeType = 'application/vnd.google-apps.document' ``` Drive dates mean file modification time. Use [Google Meet](/search/google-meet) for recent transcripts with meeting dates and [Google Calendar](/search/google-calendar) for scheduled events. Transcription or note-taking must have been enabled during the meeting; Search cannot reconstruct missing artifacts. ## Troubleshooting [#troubleshooting] | Problem | Check | | - | - | | Delegation rejected | Check numeric client ID, key, approved scopes, and pending Workspace approval. | | Directory identity unavailable | Check administrator access and active primary users in the same customer. | | Readable file excluded | Check folders, Users, file type, and delegated source access. | | Incomplete coverage | Narrow folders or query; missing files are not proof of absence. | | PDF/DOCX text unavailable | Check download permission, size, password protection, format, and extractable text. For scans, provide a searchable copy or open the original. | | Sheet read fails | Check Sheets API enablement in the project used by the member OAuth grant. | ## Self-hosted member OAuth [#self-hosted-member-oauth] Follow [Google OAuth setup](/platform/self-hosting/integrations-oauth#google) for the shared client, consent, full Drive member scopes, `GOOGLE_CLIENT_ID`, and `GOOGLE_CLIENT_SECRET`. Enable **Google Drive API** and **Google Sheets API** for these reads. Match `NEXT_PUBLIC_APP_URL` to the callback origin and register: ```text https:///api/auth/oauth2/callback/google-drive ``` The personal grant includes `drive` and `drive.file` for workflow actions and is separate from service delegation. It remains required in service mode. One client can register each enabled Google callback. After changing client/scopes, update saved organization provider configuration and reconnect affected members. ## Related docs [#related-docs] * [Gmail](/search/gmail) * [Google Calendar](/search/google-calendar) * [Google Sheets API setup](https://developers.google.com/workspace/sheets/api/quickstart/nodejs#enable_the_api)