Google Docs

Sign in to console.cloud.google.com with an account that can select a Google Cloud project, enable APIs, configure the Google Auth platform, and create OAuth credentials. Google does not document a Google Docs MCP-specific paid plan or license requirement, but the Docs MCP server is available only through the Google Workspace Developer Preview Program, so the project must be registered in it. Enabling APIs requires serviceusage.services.enable; Service Usage Admin provides this permission. Granting MCP Tool User (roles/mcp.toolUser) requires IAM administration access on the project. Each account that will connect needs that role and access to the Google Docs it will use. Obtain the approved support and contact addresses before you begin. If your organization restricts high-risk Drive and Docs scopes or unconfigured apps, you also need a Google Workspace administrator with the Service Settings administrator privilege.

Join the Google Workspace Developer Preview Program

Open developers.google.com/workspace/preview.
Review the Developer Preview Program Terms with the application or security owner.
Click Apply to join the Developer Preview Program.
In the application form, enter the requested Google Workspace account and Google Cloud project information.
Agree to the terms only with organizational approval.
Submit the form with the visible or equivalent submission control.
Wait for Google’s project-registration confirmation at the submitted email address. Google says this should complete within a couple of days.

Use the registered project for every Google Cloud step that follows.

Enable the Docs MCP APIs

In the toolbar, open the resource selector.
Select the Google Cloud project registered in the Developer Preview Program.
Open APIs & Services > Library.
Open Google Docs API.
Click Enable.
Return to Library.
Open Google Docs MCP API.
Click Enable.

If Enable is unavailable, ask the project administrator for serviceusage.services.enable.

Grant the MCP Tool User role

Open console.cloud.google.com/iam-admin/iam.
Select the same project.
Click Grant access.
In New principals, enter the Google Account email of a user who will connect from the Speakeasy AI Control Plane.
Click Select a role.
Search for MCP Tool User.
Select MCP Tool User.
Click Save.
Repeat these steps for every connecting user.

Open Google Auth platform > Branding.

Google says an OAuth consent screen cannot be removed after it is configured. Confirm the approved app name, support address, contact address, and audience before you click Get Started.

If the page says Google Auth Platform not configured yet:

Click Get Started.
Under App Information, enter Docs MCP Server in App name.
Choose the approved User support email.
Click Next.
Under Audience, select Internal when it is available for your Google Workspace organization; otherwise select External.
Click Next.
Under Contact Information, enter the approved monitored address in Email address.
Click Next.
Under Finish, review the Google API Services User Data Policy.
With organizational approval, select I agree to the Google API Services: User Data Policy.
Click Continue.
Click Create.

If the Google Auth platform is already configured, review the equivalent settings on Branding, Audience, and Data Access.

Add the required access:

Open Data Access.
Click Add or Remove Scopes.

Under Manually add scopes, paste these four values:

https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/drive.file
https://www.googleapis.com/auth/documents.readonly
https://www.googleapis.com/auth/documents

Click Add to Table.
Click Update.
Click Save.

If Audience is External and the app is in Testing, add every account that will make the first connection:

Open Audience.
Under Test users, click Add users.
Enter the connecting accounts.
Click Save.

Testing supports at most 100 test users, and each authorization expires after seven days.

Create the OAuth client

Open Google Auth platform > Clients.
Click Create client.
Set Application type to Web application.
In Name, enter a recognizable name such as Speakeasy AI Control Plane.
Under Authorized redirect URIs, click + Add URI.

In URIs, enter this value:

https://ai.speakeasy.com/mcp/remote_login_callback

Prepare secure password storage before the next action. Google says the client secret in the next dialog can be copied only once.

Click Create.

Keep OAuth 2.0 client created open.

Copy the client credentials

In OAuth 2.0 client created, copy Client ID to secure storage.
Under Client secrets, copy Client secret.
Store the secret as a password alongside the Client ID.

If you lost the one-time secret, delete it and create a new secret before continuing.

If your organization restricts high-risk Drive and Docs scopes or blocks unconfigured apps, continue to Allow the OAuth client in restricted organizations. Otherwise, continue to Speakeasy setup.

Allow the OAuth client in restricted organizations

Complete this step only when your organization’s Workspace API controls restrict high-risk Drive and Docs scopes or block unconfigured apps.

Sign in to admin.google.com with Service Settings administrator access.
Open Security > Access and data control > API controls.
Click Manage App Access.
Under Configured apps, click Configure new app.
Enter the Client ID copied in Copy the client credentials.
Click Search.
Select the matching app.
Select the organizational units whose users will connect.
Click Continue.
Choose the access approved by the security owner:
- Trusted
- Specific Google data, with the Docs MCP scopes and any Google sign-in scopes the app requests
Click Continue.
Review the settings.
Click Finish.

Changes can take up to 24 hours, though they usually apply sooner. Continue to Speakeasy setup.

Add the server in Speakeasy

In the Speakeasy AI Control Plane sidebar, under MCP Gateway, select MCP.
Click Add new to open Add MCP server.
Choose Hosted remotely.
On New remote MCP server, paste this URL into MCP server URL:
```
https://docsmcp.googleapis.com/mcp/v1
```
Leave User session issuer at its default.
Click Verify connectivity.
Under Identity, select User Identity. The page preselects No Identity for this server, so change it.
If Guardrails appears, leave it off.
Click Save.

Speakeasy saves the server as Disabled and says to finish setup in Settings > Identity. This is expected; the next section completes it.

Connect your credentials

Open the server’s Settings and find the Identity section.
Confirm that User Identity is selected.
In Choose an identity provider, confirm that the preselected provider is Google (https://accounts.google.com/). If another provider is shown, open the picker, search in Search identity providers…, and choose the Google provider. A provider badged Will be created is created when you save.
Choose Manual.
In Client ID, paste the Client ID from Copy the client credentials.
In Client secret, paste the Client secret from the same section. Google requires it even though the field says “Optional”.
Open Advanced. In Scope, enter this value on one line:
```
https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/documents.readonly https://www.googleapis.com/auth/documents
```
Do not leave Scope blank. A blank value requests every scope the server advertises, including full Drive access, which the consent screen does not grant.
Click Save.
Open Settings > Danger Zone > Server Availability and turn on Enable MCP server so it shows Enabled.

When a person first uses the server, Google’s browser authorization prompt appears. They must sign in with an account granted MCP Tool User. If the app’s audience is External and in Testing, the account must also be listed under Test users.

This guide covers setup only. For anything beyond it — billing, tool behavior, limits — see Google’s Docs MCP documentation.