Ingesting from Google Drive

RAGfly can read documents straight from Google Drive — no local sync, no downloads, no copying folders to disk.

This guide is for the workspace administrator who enables the connector once. After that, every user in the group just picks a folder and RAGfly indexes it.

One-time setup, ~10 minutes. You do it once per RAGfly group. Your users never see any of this.

What you get

• Files are read directly from Drive's API, including files that live only in the cloud and were never downloaded to a computer.
• Google Docs, Sheets and Slides work too. They have no bytes on disk; RAGfly exports them on the fly to extract their text.
• Shared drives are supported.

Privacy: the file never leaves your browser

This is the same guarantee as loading from a local folder, and it is not negotiable:

1. Bytes are downloaded from Drive into your browser's memory (RAM).
2. Text extraction runs in your browser.
3. Only encrypted text is uploaded to RAGfly.

The original file is never stored by RAGfly and never travels to RAGfly Cloud. RAGfly requests the drive.readonly scope: it can read, never modify or delete.

Before you start

You need:

• A Google Cloud account (free) — https://console.cloud.google.com
• Administrator access to your RAGfly group (to edit Group Parameters)
• The domain where you use RAGfly: https://app.ragfly.ai (or your own)

Part 1 — Create the credentials in Google Cloud

You will create two things: an OAuth Client ID (asks the user for permission) and an API Key (powers the folder picker). You need both.

1.1 Create or pick a project

Go to https://console.cloud.google.com and create a project (e.g. "RAGfly Connector"), or select an existing one. Everything below happens inside it.

1.2 Enable the two APIs

Go to APIs & Services → Library and enable:

• Google Drive API — reads folders and files
• Google Picker API — the window where the user picks a folder

Search each by name and click Enable.

1.3 Configure the consent screen

Go to APIs & Services → OAuth consent screen. This is what your users see when they authorize RAGfly.

• User type: choose Internal if everyone belongs to your Google Workspace organization (simplest — no verification needed). Choose External otherwise.
• Fill in app name, support email and developer email.
• Scopes: add https://www.googleapis.com/auth/drive.readonly (read-only).
• If you chose External, add your users under Test users while the app is unpublished.

1.4 Create the OAuth Client ID

Go to APIs & Services → Credentials → Create credentials → OAuth client ID.

• Application type: Web application

• Name: anything (e.g. "RAGfly Web")

• Authorized JavaScript origins: add the origin where you use RAGfly:

  https://app.ragfly.ai
  

  Add one line per environment you use. Origin only — no trailing slash, no path. If you also use a test or internal environment, add those too.

• Authorized redirect URIs: leave empty. RAGfly uses Google's token model, which returns the token to the page itself.

Click Create and copy the Client ID (ends in .apps.googleusercontent.com).

⚠️ Miss this step and users get Error 400: origin_mismatch when they try to authorize. See Troubleshooting.

1.5 Create the API Key

Still under Credentials → Create credentials → API key. Copy the key, then click Edit API key to restrict it (never leave a key unrestricted):

• Application restrictions → Websites: add your domain with a wildcard path:

  https://app.ragfly.ai/*
  

  Note the /* — unlike the OAuth origin, this one does take a path pattern.

• API restrictions → Restrict key: select Google Picker API.

Click Save.

⏱️ Google takes a few minutes to apply these changes (sometimes longer). If something still fails right after saving, wait and retry before debugging.

Part 2 — Enable the connector in RAGfly

Sign in to RAGfly as a group administrator and go to Group Parameters.

2.1 Load the credentials

Under Ingestion connectors, paste what you copied:

These are normally stored as a group override: each customer can use its own Google project, and credentials are shown masked. A RAGfly platform operator can instead set a general value inherited by groups; a non-empty group value takes precedence over that default.

2.2 Confirm the source is enabled

There is no Google Drive feature flag. The connector appears when:

• the Google Drive ingestion source is enabled for the group, and
• both credentials above are available (from the group override or a general inherited value).

New groups normally receive the source already enabled. If it is absent after you save the credentials and reload, ask your RAGfly platform operator to enable the Google Drive source for the group.

Part 3 — Using it (this is what your users do)

In Documents → Feed documents:

1. In Select source, choose Google Drive. A status badge shows whether you are connected.
2. Click Connect folder…. Google asks you to authorize (read-only), then opens the picker showing your Drive in the cloud.
3. Pick a folder. The badge turns to Connected.
4. Continue as usual: Load directories, then Vectorize.

Switching Google accounts: use Switch account. This forgets the current authorization and lets you pick a different account — the linked folder is cleared, since it belonged to the previous account.

The status badge

Troubleshooting

Error 400: origin_mismatch

The domain you are using is not listed in the OAuth Client's Authorized JavaScript origins (step 1.4). Add it exactly as the browser shows it, with https:// and no trailing slash.

The picker doesn't open, or fails right after authorizing

The API key is rejecting the domain. Check the website restrictions in step 1.5 — the entry needs the /* suffix. Remember Google takes a few minutes to apply changes.

The connector doesn't appear at all in the source selector

The Google Drive source must be enabled for the group and both credentials must be available. First reload the page after saving. If it is still absent, ask your RAGfly platform operator to enable the source or verify its inherited credentials; there is no feature flag to switch on.

"This app is blocked" / verification warning

Your consent screen is External and unpublished. Either add the user under Test users, or switch to Internal if everyone is in your Workspace organization.

Some files are skipped

RAGfly ingests documents it can extract text from. Files with no extractable text (images without OCR, unsupported binaries) are reported as such in the pipeline, not silently dropped.

Frequently asked

Does RAGfly store my files? No. Bytes are read into your browser, text is extracted there, and only encrypted text is uploaded. The original file never reaches RAGfly Cloud.

Can RAGfly modify or delete my Drive? No. The requested scope is drive.readonly.

Do I need Google Drive installed on my computer? No. Everything goes through Drive's API — that's the point. Files that only exist in the cloud work fine.

Can each user connect their own Drive? Yes. Credentials are per group (the app), but each user authorizes their own Google account and picks their own folder.

Do I have to repeat this per environment? The credentials are per group. If you use more than one RAGfly environment, add each origin in step 1.4 and each website in step 1.5.