Kastel publishes no shared Google application: the application is yours, in Internal mode inside your own Workspace, and you are the one who revokes it. If asked who accesses your email or your files, the answer is: nobody - access goes through an application you own.
Create a Google Cloud project
Google Cloud Console, project selector, "New project". Any project in your organization works; a recognizable name like kastel-connectors helps you find it again.
Configure the consent screen
- User type: Internal. The choice that matters. An Internal app is usable only by your own Workspace accounts, and Google requires no review or third-party security audit for it. An "External" app with these scopes would drag you through Google's restricted-scope verification - unnecessary here.
- Scopes: read-only, and nothing else.
drive.readonly(andgmail.readonlyif you also use Gmail on self-host). Never a write scope, whichever connector it serves.
Enable the APIs
API Library: enable "Google Drive API" (and "Gmail API" if relevant) for the project.
Create the OAuth client
Credentials > Create credentials > OAuth client ID, type "Web application". The redirect URI depends on your mode:
| Mode | Redirect URI |
|---|---|
| Managed | The one shown in your console's enterprise Sources - copy it exactly, character for character |
| Self-host | http://127.0.0.1:8765/connect/gdrive/callback and, if you also use Gmail, http://127.0.0.1:8765/connect/gmail/callback (the local listeners of the connect command), or the addresses you configured |
Then copy the client ID (it ends in .apps.googleusercontent.com) and the client secret.
Hand the pair to Kastel
| Mode | Where |
|---|---|
| Managed | Paste the client ID and secret into enterprise Sources. Kastel verifies them live against Google before accepting them, encrypts them inside your instance, and never shows the secret again. |
| Self-host | Environment variables, named in kastel.config.yaml - never the value itself in that file (client_id_env, client_secret_env). |
Your admin can cut access at any moment, without contacting anyone: Google Admin console > Security > API controls > App access control, or deleting the client ID in Google Cloud - every token the app minted dies with it. Each person can also revoke their own grant at myaccount.google.com/permissions.