To get a Google OAuth client ID and secret, open the Google Cloud console, go to Google Auth Platform, set up the consent screen, then create a client under Clients. Google shows the client ID and secret right after you create it. Copy the secret then, because you will only see it in full once.
I wrote this guide because every one of my Google MCP servers asks for these two values, and the console moved things around in the last year. The steps below match the console as of November 2026.
What a Google OAuth client ID is
An OAuth client ID tells Google which app is asking for access to a user’s account. The client secret is the password that proves the request really comes from that app. Together they let an app send you to Google’s sign-in page, where you approve what it may do, such as read your Gmail or your Analytics data. The app never sees your Google password.
Before you start
- You need a Google account.
- You need a Google Cloud project. Create one at console.cloud.google.com if you do not have one. It is free.
- Turn on the API you need in that project. Go to APIs and Services, then Library, search for it (for example “Gmail API”) and click Enable.
Step 1: Set up the consent screen
The consent screen is what users see when your app asks for access. In the console menu, open Google Auth Platform. If the project has never used it, click Get started and fill in:
- App name and a support email.
- Audience: choose Internal if you have a Google Workspace organization and only its members will sign in. Choose External for everyone else, including personal Gmail accounts.
- Contact information: an email address for Google’s notices.
Agree to the user data policy and click Create.
Step 2: Add yourself as a test user
A new External app starts in Testing status. Only test users can sign in to it, up to 100 of them. Open Audience, find Test users, click Add users and enter your own Google address. If you skip this, Google blocks your own sign-in with an “access denied” error.
Step 3: Create the client
- Open Clients and click Create Client.
- Pick the Application type. Use Desktop app for tools that run on your own computer, which includes my MCP servers and most command-line tools. Use Web application for a website login, and add your Authorized redirect URIs.
- Give it a name, which only you can see.
- Click Create.
Google now shows your Client ID and Client secret. Copy both, or click Download JSON. Google says you can view and download the full secret only once, at the time of creation. Later the console shows only its last four characters.
Step 4: Use the values
Paste the client ID and secret where your app asks for them. In my MCP servers, the setup wizard asks for both, then opens Google’s sign-in page in your browser. Sign in with the account you added as a test user and approve the access.
The first time, Google shows a warning that the app is unverified. That is expected for your own Testing app. Click Continue.
Is there a Gmail API key?
Not in the way most people mean. Google API keys only work for public data, like a public map or a public YouTube video. Gmail holds private data, so the Gmail API needs OAuth: the client ID and secret from this guide, plus your sign-in. The same is true for Google Drive, Calendar, Sheets, Docs and Google Analytics.
If you are connecting Gmail to n8n, Make or a script, the steps above are what you need. For my Gmail MCP server, turn on the Gmail API before you start and use the Desktop app type.
Common problems and how to fix them
“Access blocked” or “access denied” when signing in
Your account is not on the test user list, or you signed in with a different account. Add the exact address under Audience, Test users.
You have to sign in again every week
Google’s documentation says that an External app in Testing status gets refresh tokens that expire after 7 days, unless it only asks for basic profile access. To stop it, open Audience and click Publish app. Apps that ask for sensitive scopes may then need Google’s verification before strangers can use them, but for your own account the weekly sign-in stops.
“redirect_uri_mismatch”
You picked Web application, and the address your app sends does not match an authorized redirect URI. Add the exact address, or create a Desktop app client if the tool runs on your computer.
You lost the client secret
Open the client and add a new secret, then delete the old one once nothing uses it. Google does not show the old secret again.
The client disappeared
Google deletes OAuth clients that have been inactive for six months, and emails the owner 30 days before. Deleted clients can usually be restored for at least 30 days.
Common questions
Where do I find my Google client ID?
In the Google Cloud console, open Google Auth Platform, then Clients. The client ID is shown in the list. The full secret is not shown again after creation.
Is a Google OAuth client ID free?
Yes. Creating a project and a client costs nothing. Some APIs you call with it have their own pricing or quotas.
Should I choose Desktop app or Web application?
Desktop app for anything that runs on your own computer, such as an MCP server, a script or a command-line tool. Web application for a site where visitors sign in with Google.
Can I use one client ID for several apps?
You can, but Google recommends a separate client for each platform your app runs on. Separate clients also make it easier to rotate one secret without breaking everything else.