google-oauth-n8n

Google OAuth — n8n Credentials Reference

Maps Google Cloud OAuth clients to n8n credentials and the workflows that use them. Last updated: 2026-08-25 (#6654 — Drive cred blast-radius + expired-vs-rotated diagnostic).

---

Accounts & Projects

radieu@gmail.com — Project N8N-documentsProcessing

GCP project ID: n8n-documentsprocessing

OAuth Client	Client ID prefix	Purpose
n8n-rkm-local-docker	616687203473-ggg4...	Local dev only — not used in production
p24-n8n-bms-4	616687203473-a8ic...	bms-4 n8n main client (renamed from p24-n8n-hostinger-2y)
N8N-Gdrive-P24	616687203473-vrfp...	Google Drive + Sheets workflows

Both p24-n8n-bms-4 and N8N-Gdrive-P24 have registered:

• JavaScript origin: https://n8n.bms-4.infra.zintegrowana.online
• Redirect URI: https://n8n.bms-4.infra.zintegrowana.online/rest/oauth2-credential/callback

n8n credentials (bms-4) using this account:

Credential name	n8n ID	Type	Used by workflows
Gmail account - radieu@gmail.com	P1dYU1OR6Z1qQ0Zu	gmailOAuth2	invoices registration 2 pinbox
Google Drive account	RKpUbgQMTZtErvur	googleDriveOAuth2Api	W4 Direct API Ingestion (MUjApqruo6H88ebw, ACTIVE — eco-trans Rechnungen/Gutschrifts intake), atrax/kravag scheduled fleet updates (CCx9UMdphmGficDX), Tronik GPS Kierowcy (AEMvkxDCUsvVMFYU), Tronik GPS Serwisant mobilny (W50qRbJs9xrGotaX), + inactive 4VMkyPGVKo67YnQp/Imgxpl5hYgjSaqd5 — 27 nodes / 4 ACTIVE workflows (widest-blast Drive cred; second Drive cred ncPPb4MlTIUeeTGw is unrelated)
Google Sheets account	Hw0yWyWfKHTEwaIW	googleSheetsOAuth2Api	atrax/kravag, interrcars, Update Fleet From Driver Reports
Google Calendar account	WkDtkOZCeCUOkO7j	googleCalendarOAuth2Api	—
YouTube account	LJEBoS3T9q9QRkwD	youTubeOAuth2Api	—

---

ecotrans.automation@gmail.com — Project et-n8n-automation

GCP project ID: et-n8n-automation

OAuth Client	Client ID prefix	Purpose
n8n-ecotrans-automation-gmail-web-client	1096943796691-kg2...	Gmail triggers for Tronik GPS workflows
Klient na komputerze 1	1096943796691-8cm...	Desktop client — unused in current workflows

n8n-ecotrans-automation-gmail-web-client has registered:

• Redirect URI: https://n8n.bms-4.infra.zintegrowana.online/rest/oauth2-credential/callback

n8n credentials (bms-4) using this account:

Credential name	n8n ID	Type	Used by workflows
Gmail ecotrans.automation@gmail.com	tD8Cz6GiF3zmrtki	gmailOAuth2	Tronik GPS - Kierowcy, Tronik GPS - Serwisant mobilny

Re-authorization was required during bms-4 migration (2026-06-15) — new client secret created, credential reconnected.

---

Re-authorization Procedure

If a Google credential on bms-4 shows 'undefined' errors in n8n logs:

1. Open https://n8n.bms-4.infra.zintegrowana.online → Credentials
2. Find the failing credential → Edit
3. Check the Client ID to identify which GCP project/client it uses (table above)
4. If client secret is needed: GCP Console → project → Klienty → client → Add secret (old secrets can’t be viewed)
5. Paste new secret into n8n credential → Save → Reconnect

Two failure modes — do NOT paste a new client secret unless you actually need to

The n8n error “credential needs to be reconnected … the connected account has revoked access, the refresh token expired, or the account password or permissions changed” has two distinct causes, and they need different fixes. Identify which one you have before touching the client secret:

Symptom	Cause	Fix
Cred worked for weeks, then all executions started failing on the first Drive node	Expired / revoked refresh token (most common)	Reconnect only — do NOT change the client secret. Step 5 above collapses to just Save → Reconnect.
Fails immediately after re-connect with invalid_client / unauthorized_client	The GCP OAuth client’s secret was rotated and n8n still holds the old one	Add a new secret to that specific client in GCP Console, paste it into the cred, then Reconnect.

A client-secret rotation only affects the n8n cred if it rotated the SAME GCP OAuth client the cred uses. These clients are project-scoped and independent — a rotation in one project cannot break a cred bound to a different client. In particular:

• Google Drive account (RKpUbgQMTZtErvur) is bound to the N8N-Gdrive-P24 client (616687203473-vrfp…, project n8n-documentsprocessing, radieu@gmail.com).
• The repo’s GOOGLE_DRIVE_CLIENT_SECRET (secrets/whatsup.env.sops) belongs to a different client — the p24-wa-a processor gdrive Desktop client in the whatsup/p24-wa-a GCP project (#2128) — used by the wa-db-processor installed-app flow, not by any n8n credential.
• Therefore a rotation of GOOGLE_DRIVE_CLIENT_SECRET (e.g. 2026-08-18) is a red herring for RKpUbgQMTZtErvur — that cred’s failure is an expired/revoked refresh token, so the fix is a plain Reconnect. Only fall back to the client-secret path if the Reconnect itself returns invalid_client (which would mean the N8N-Gdrive-P24 secret was separately rotated).

Ref incident: #6654 (W4 Direct API Ingestion 100% error, 2026-08-23 → client-reported).

---

Planned: Document Processing Migration to bms-4

Document processing workflows are currently running on a separate cloud instance. Migration target: bms-4 n8n (n8n.bms-4.infra.zintegrowana.online).

When migrating:

• All redirect URIs are already registered in both GCP projects — no Google Console changes needed
• Identify which GCP client the document processing credentials use (check Client ID in n8n UI)
• Re-authorize credentials through bms-4 n8n UI after migration
• Relevant GCP project for document processing: likely N8N-documentsProcessing (radieu@gmail.com)