Quite a few users have faced the following issue with their Google services integration with n8n (I was among them too).
The Problem
I’m currently running n8n locally and trying to connect to my google calendar. I set it up and it was working perfectly fine a few days ago however I’ve tried again the last couple days and I keep running into this n8n error for google sheet node: The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. – Other_Procedure_182
Not only do you face the “Google hasn’t verified this app” issue (you can bypass it by clicking Advanced and then clicking “Go to <your app here> (unsafe)”)…
You’ll also find the authorization token keeps expiring every 7 days. It’s quite annoying and disruptive to your flows!
This issue occurs because your n8n “app” in the Google Cloud Console is in Testing mode.
The Trap
However, if you switch it to Production, it won’t help either. The token will still expire every 7 days.
Additionally, you will have to pass Google’s app verification (see the Verification Center).
I tried that – that’s a rather painful process. To be verified by Google, your “app” should comply with a number of requirements:
- must have a logo
- must have a homepage
- must have a policy link
- must have justification of why you need selected scopes
- must have a Youtube video demonstrating how you’ll use the data from these scopes
I did all that. But I got stuck with defining the appropriate scopes. Since my n8n flow is using Google Drive and Google Sheets, Google considers these APIs to have the “sensitive” scopes. Figuring out the appropriate ones was a pain in the a$$.
I didn’t succeed. But I didn’t have to…
The Real Fix
OAuth is meant for apps that users interact with. But n8n flows are automated so they’re more like backend services. That’s why a Google Service Account is a better fit.
That was the mental mistake I made – I hadn’t considered the difference between user-facing apps and backend services, i.e. n8n flows.
All you have to do is to replace the individual Google OAuth-based app Accounts (Gmail, Google Drive, Google Sheet, etc.) with a single unified Google Service Account. This way your flow won’t need Google’s verification anymore.
I won’t go into the full step-by-step setup of the Google: Service Account – just follow the steps. It’s a very well written tutorial.
Briefly, it provides a comprehensive guide on configuring Google Service Account credentials to authenticate Google services within n8n workflows. The process involves creating a Google Cloud project, enabling the necessary APIs, setting up a Service Account, and integrating its credentials into n8n. The guide emphasizes verifying node compatibility with Service Accounts and offers troubleshooting tips for common issues, such as accessing Google Drive files and enabling domain-wide delegation. Additionally, it includes a video tutorial to assist users through the setup process.
What a relief! Happy automating!