OAuth2 for Google in n8n: One Client ID for Every Service, No Errors

Using Google Calendar, Drive, or YouTube yourself and connecting them to an automation are not the same thing. In the first case, you just log into your account. In the second, a third-party app (your n8n instance) needs Google's permission to act on your behalf: creating events, reading files, publishing videos, pulling metrics from an ad account. And Google, with dozens of different services, handles this differently from everyone else: through a separate Google Cloud Console with its own projects, APIs, consent screens, and keys.

This is exactly where most people get stuck. Not because it's difficult, but because Google's interface doesn't explain why each step exists, and errors like "redirect_uri_mismatch" or "Google hasn't verified this app" look like a dead end. Yet behind each one is one specific cause that takes a minute to fix once you know where to look.

This guide will walk you from an empty account to working connections in n8n: a Google Cloud project, enabling the APIs you need, the consent screen, gathering redirect URIs from n8n, creating a Client ID and Client Secret, and connecting Calendar, Drive, YouTube, Ads, Tasks, Sheets, and Docs — all with one set of keys. Plus the common errors, and one detail about test mode that makes connections "mysteriously" break a week later.

What OAuth2 Is, and Why Google Does It Differently

OAuth2 is a protocol that lets you give an app access to your data in a service without handing over your password. You log into Google yourself, approve a list of permissions, and the app receives a token — a key you can revoke at any time without changing your password. For automations, this is the only correct way to do it: n8n acts on your behalf without ever knowing your password.

Google Cloud Console is the hub where all of this gets configured. If an advertising analogy helps, it's a bit like Meta's Business Manager, but for APIs and technical settings: it's where projects live, where you enable APIs inside those projects, create keys, and describe how your app will present itself to users on the consent screen.

A single Client ID and Client Secret pair can be used for several Google services at once, as long as you add all the redirect URIs correctly. You don't need a separate project for every integration.

What You'll Need

• A Google account — to access Google Cloud Console. A regular Gmail account or a Google Workspace account both work.
• Access to n8n — cloud or self-hosted. This guide was written for version 1.88 and later; the interface in newer versions might differ in small details, but the logic stays the same.
• For a self-hosted install, working https. Google only accepts redirect URIs over a secure protocol.
• A basic understanding of what an API is and at least minimal familiarity with n8n's interface.
• A text file where you'll record redirect URIs and keys. Not in a chat, not in a screenshot — in a file kept somewhere safe.

Which APIs to Enable for Which Services

Only enable what you actually plan to use: every enabled API adds permissions that will later show up on the consent screen. You can always enable another API later.

Step by Step

Step 1. A Project in Google Cloud Console

1. Open Google Cloud Console and complete the simple signup if this is your first time here.
2. At the top, click the project dropdown and select New Project.
3. Enter a name. I recommend naming it after your website's domain or the project you're building the automation for — six months from now you'll have several projects, and "Project 1" won't tell you anything.
4. Click Create and make sure the new project is selected in that same dropdown at the top. This is the most common small mistake: doing all the following steps inside a different project.

Step 2. Enabling APIs

1. In the left menu, go to APIs & Services → Library.
2. Search for each API from the table above, open it, and click Enable.
3. If the account is brand new, the console might first ask you to activate API access with a single button — click it and then repeat the enabling step.
4. You'll see a success notification after each one. Check the enabled APIs section to confirm every one you need is on the list.

Step 3. The OAuth Consent Screen

This is the page a user sees when an app requests access. Google won't issue keys without it, so this step is mandatory, even if you're the only user.

1. In APIs & Services, open OAuth consent screen. In newer versions of the console, this section might have a different name or live under a separate authentication settings menu — search for "consent" or "OAuth."
2. Choose the user type. Internal — if you have Google Workspace and access is only needed by people in your organization: no verification, no test-mode restrictions. External — for a regular Gmail account, or if people outside your organization will connect.
3. Click Create and fill in the required fields: App name (for example, "n8n Integration"), User support email, and Developer contact email — use your own address for both.
4. Under Authorized domains, add a domain: n8n.cloud for the cloud version, or your own domain if n8n runs on your own server.
5. Click Save and Continue. You can skip the Scopes page — n8n will request the necessary access scopes on its own during authorization.
6. Click Save and Continue again until you reach the Summary page, review it, and click Back to Dashboard.

If you chose External, your app starts out in testing status. In test mode, add yourself (and anyone else who'll be connecting their accounts) to the list of test users — otherwise Google won't even let them reach the login screen. More on the consequences of test mode in the errors section below.

Step 4. Redirect URIs from n8n

Google needs to know where to send the user back after they log in. These addresses are generated by n8n, and each credential type has its own.

1. In n8n, open Credentials and click Create New.
2. Select the type for the service you need: Google Calendar OAuth2, Google Drive OAuth2, YouTube OAuth2, Google Ads OAuth2, and so on.
3. In the form, find the OAuth Redirect URL field and copy its value into your text file. Repeat for every service — the addresses may differ.
4. Don't save these forms yet — you don't have the keys yet. We'll come back to them in step 6.

Google Meet doesn't need its own credentials: meeting links are created through Google Calendar OAuth2, since Meet integrates through Calendar.

Step 5. Creating an OAuth Client ID

Now let's create the keys n8n will use to present itself to Google as a trusted app.

1. In Google Cloud Console, go to APIs & Services → Credentials.
2. Click + CREATE CREDENTIALS → OAuth client ID.
3. Set the application type to Web application.
4. Enter a name, for example "n8n Integration Client."
5. Under Authorized redirect URIs, add every address from step 4 — one per line, with no extra slashes or spaces.
6. Click Create. Google will show you a Client ID and Client Secret — copy both into your file. You can view the secret again later, but it's better to save it right away.

Step 6. Connecting in n8n

For every service:

1. Go back to n8n, to the credential form for that service type.
2. Paste in the Client ID and Client Secret from step 5 — the same ones for every service.
3. Click Sign in with Google, choose your account, and approve the permissions.
4. Save the credential. Give it a clear name — "Google Calendar — work account" — so you're not guessing what it is a month from now.

Step 7. Using It in a Workflow

1. Create a new workflow and add a node for the service you need: Google Calendar, Google Drive, Google Ads, YouTube, and so on.
2. In the node's settings, select the credential you created in step 6.
3. Configure the action. For example, for Google Calendar — creating an event with a Meet link; for Drive — uploading a file to a specific folder; for YouTube — adding a video to a playlist; for Ads — pulling campaign metrics.
4. Run a test execution and check the node's output: if data comes back, the connection works.

Common Errors and How to Fix Them

• "Google hasn't verified this app." The app is in test mode or hasn't gone through verification. That's completely normal for your own personal use: click Advanced → Go to [app name] (unsafe) and continue. The word "unsafe" here just means Google hasn't reviewed your app — not that it's actually dangerous.
• Redirect URI mismatch (redirect_uri_mismatch). The address from n8n either wasn't added to the Client ID, or was added incorrectly — an extra slash, http instead of https, a different domain. Copy the address from the field in n8n again and compare it character by character.
• The API isn't enabled. The node returns an access error even though authorization went through. Check in the console that the required API is enabled in the exact same project where you created the Client ID.
• A self-hosted install without https. Google won't accept a redirect URI over http. Set up a certificate, or use a platform that issues https automatically.
• Wrong account. In step 6, you picked your personal Gmail, but the calendar you need lives in a Workspace account. Reconnect the credential using the right account.
• The connection breaks after a week. The sneakiest one. For External apps in testing status, Google's own documentation says it issues refresh tokens with a limited lifespan — roughly a week. After that, n8n asks you to log in again. The fix: move the app to production status on the consent screen page (for personal use, this is possible without full verification, though the "unverified" warning stays), or, if you have Workspace, switch to the Internal type, which doesn't have this restriction.

Security, and What's Next

The Client ID and Client Secret are the keys to your data. Keep them only in n8n and in your own file — never send them over a messenger or paste them into a screenshot. If a secret leaks, you can regenerate it in the console, and the old one will stop working immediately. Periodically check your Google account's security settings for the list of apps with access, and remove any you no longer use.

Once your connection works, here are the most useful first scenarios: a new form submission creates a Calendar event with a Meet link and sends an email to the client; a new file in Drive triggers a message to the team's messenger; a daily Google Ads report gets posted to Telegram; a new YouTube video gets automatically added to the right playlist with an announcement in your channel. Each of these is three or four nodes, and building them is exactly how you'll learn everything else.

And if you want more than just connecting Google — if you want to understand which processes in your business are worth automating first, and in what order — book a 60-minute consultation: you'll walk away with a 30-day plan where every integration has a reason behind it.

The Short Version

• OAuth2 gives n8n access to Google services without your password; you can revoke the token at any time.
• One Client ID and Client Secret work across every Google service — the key is adding all the redirect URIs from n8n.
• The order is: project → enable APIs → consent screen → gather addresses from n8n → create a Client ID → connect it in n8n → test it in a workflow.
• Google Meet connects through Google Calendar OAuth2; it doesn't need its own keys.
• A self-hosted n8n install has to run over https, or Google won't accept its redirect URI.
• For External apps in test mode, tokens have a limited lifespan — move to production, or choose Internal if you're on Workspace.
• Keep your keys only in n8n and in your own file; if one leaks, regenerate it in the console.

Frequently Asked Questions

Do I need a separate Google Cloud project for every service?

No. One project, one Client ID, and one Client Secret can serve Calendar, Drive, Sheets, Docs, Tasks, YouTube, and Ads at the same time. You just need to enable the relevant APIs in that project and add the redirect URI for each n8n credential type to the Client ID.

Why does Google say the app isn't verified, and is that dangerous?

Google shows that warning for any app that hasn't gone through its verification process — and for your own automation, you don't need to go through it. You created this app yourself, and you're the one granting it access to your own account. Click Advanced and continue; there's no danger here.

Why does n8n ask me to log into Google again after a week?

Most likely, your External app is still in testing status, and in that status, Google issues refresh tokens with a limited lifespan. Move the app to production status on the consent screen page, or, if you have Google Workspace, recreate the consent screen with the Internal type instead.

Can I use the same keys in a different n8n installation?

Yes, as long as you add that installation's redirect URIs to the Client ID: every n8n instance has its own domain, and therefore its own addresses. You'll still need to recreate the actual credentials in the new installation, since they're encrypted with that instance's own key.

What should I do if the Client Secret ends up in the wrong hands?

In Google Cloud Console, on the Credentials page, open your OAuth client and regenerate the secret — the old one stops working immediately. Then update the secret in every n8n credential and reconnect them.

About the author

Ihor Nikolenko

Founder of DigitTime, author of the D.N.A. Launch Model

In professional digital since 2008: digital marketing and launches. The visionary behind the NEO platform, the Evolve.Place academy and DigitTime Projects. Writes about what he has tested on his own projects, not retold cases of others.

Telegram YouTube Instagram LinkedIn Website

All articles by the author →