> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Google Cloud Data OAuth 2.0 connector profile – StackOne setup guide > Set up the OAuth 2.0 connector profile for Google Cloud Data in StackOne. One-time admin setup required before your users can link Google Cloud Data accounts via Hub. Cloud SQL Admin and Pub/Sub Admin roles (or Owner) on the target GCP project are required to complete this setup.
Select Actions to adjust the guide
Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.
Action
Scope(s)
Loading actions...
Dynamic Guide URL
Scopes Selected

          

            
Separator

Create or select a Google Cloud project

To use Cloud SQL Admin API and Cloud Pub/Sub API with OAuth 2.0, you need a Google Cloud project.

Sign in to your Google Cloud Console.

Google sign-in page for Google Cloud Platform with the Email or phone field and the Next button highlighted.

Select an existing project from the dropdown at the top of the page, or create a new one by clicking New Project and filling in the Project name, Organization, and Parent resource fields, then clicking Create.

Select a resource dialog listing the projects in the organization, with the New project button highlighted.

Enable the Cloud SQL Admin API and Cloud Pub/Sub API

Navigate to APIs & Services > Library, search for each API below, click on it, then click Enable. If it already shows Manage, the API is already enabled.

Cloud Pub/Sub requires billing to be enabled on the project. If billing is not active, requesting the `https://www.googleapis.com/auth/pubsub` scope can cause the connection to fail. Enable billing under Billing in the Console, or omit the pubsub scope if you only need Cloud SQL.

  • Cloud SQL Admin API
  • Cloud Pub/Sub API

Configure Google Auth Platform

Before creating OAuth credentials, ensure Google Auth Platform is configured.

In the Google Cloud Console, go to APIs & Services > OAuth consent screen. This will open the Google Auth Platform dashboard.

If you have already configured Auth Platform (the OAuth Overview page with usage metrics is shown), skip this step and navigate to the Branding page from the sidebar. Otherwise, you will see a Get started button — click it to begin the configuration process.

Fill in the required fields for your application.

  • App name: Enter a name for your application (e.g., StackOne GCP Data Integration).
  • User support email: Select an email for user inquiries.
  • Click Next to continue.
  • Note: If you already have an existing OAuth consent screen configuration, you can edit the details in this and the following steps.
Branding page of the Google Auth Platform with the App information section, highlighting the App name and User support email fields (email redacted).

Choose the appropriate user type for your application.

  • Internal: Only users within your Google Workspace organization can authorize (no app verification required).
  • External: Any Google account can authorize. You must publish the app (see the Publish the app step below) so refresh tokens do not expire after 7 days; production use may also require Google app verification.
  • Click Next to continue.
Audience page of the Google Auth Platform with the User type section highlighted, showing the current type and the Make internal button.

Provide email addresses for Google to notify you about any changes to your project. Click Next to continue.

Review your settings, agree to the Google API Services User Data Policy, and click Create to complete the setup.

For External apps, open the Audience page in Google Auth Platform and check the Publishing status. If it shows Testing, click Publish app and confirm. Apps left in Testing have their refresh tokens expire after 7 days, which causes connected accounts to error and require reconnection. Internal (Google Workspace) apps do not need this step.

Configure scopes

In Google Auth Platform, go to Data Access and click Add or Remove Scopes to configure the OAuth scopes your application needs.

Data Access page of the Google Auth Platform with the Add or remove scopes button highlighted above the list of configured scopes.
Enables actions: Acknowledge Pub/Sub Messages, Clone Cloud SQL Instance, Commit Pub/Sub Schema Revision, Create Cloud SQL Backup, Create Cloud SQL Database, Create Cloud SQL Instance, Create Cloud SQL User, Create Pub/Sub Schema, Create Pub/Sub Subscription, Create Pub/Sub Topic, Delete Cloud SQL Backup, Delete Cloud SQL Database, Delete Cloud SQL Instance, Delete Cloud SQL User, Delete Pub/Sub Schema, Delete Pub/Sub Subscription, Delete Pub/Sub Topic, Detach Pub/Sub Subscription, Failover Cloud SQL Instance, Get Cloud SQL Backup Run, Get Cloud SQL Database, Get Cloud SQL Instance, Get Cloud SQL User, Get Pub/Sub Schema, Get Pub/Sub Subscription, Get Pub/Sub Topic, List Cloud SQL Backup Runs, List Cloud SQL Databases, List Cloud SQL Instances, List Cloud SQL Operations, List Cloud SQL Users, List Pub/Sub Schemas, List Pub/Sub Subscriptions, List Pub/Sub Topics, List Topic Subscriptions, Modify Ack Deadline, Publish Pub/Sub Messages, Pull Pub/Sub Messages, Restart Cloud SQL Instance, Restore Cloud SQL Backup, Seek Pub/Sub Subscription, Start Cloud SQL Replica, Stop Cloud SQL Replica, Test Auth, Update Cloud SQL Database, Update Cloud SQL Instance, Update Cloud SQL User, Update Pub/Sub Subscription, Update Pub/Sub Topic, Validate Pub/Sub Schema

Add the required Google Cloud Platform scopes for your integration.

In the Update selected scopes side panel that opens, check the required scopes from the list.

Update selected scopes side panel with the scope table highlighted, showing the Cloud SQL and Pub/Sub scopes checked.

If a required scope is not shown in the list, use the Manually add scopes section.

  • Enter the full scope URL in the input field.
  • Click Add to table.

Confirm and persist your scope configuration.

  • Click Update to apply the selected scopes. The side panel will close.
  • On the Data Access page, click Save to persist the scope configuration.

Create OAuth 2.0 client credentials

Set up OAuth client credentials to authenticate with Cloud SQL Admin API and Cloud Pub/Sub API. If you already have an existing OAuth 2.0 client, you can reuse it by adding the StackOne redirect URI and generating a new secret.

Credentials page under APIs & Services with the + Create credentials button highlighted.

In the Google Cloud Console, go to APIs & Services > Credentials. The + Create credentials menu shown here is where both options below start.

Create credentials menu open on the Credentials page with the OAuth client ID option highlighted.

Skip this step if you are using an existing client.

  • Click + Create Credentials and select OAuth client ID.
  • Select Web application as the application type.
  • Enter a Name for your OAuth client (e.g., StackOne Cloud Data Integration).
  • Under Authorized redirect URIs, click Add URI and enter `https://api.stackone.com/connect/oauth2/googleclouddata/callback`.
  • Click Create. A dialog will display your Client ID and Client Secret — copy and store them securely.
Create OAuth client ID form with Application type set to Web application, a Name filled in, the StackOne callback URL under Authorized redirect URIs, and the Create button highlighted.

Skip this step if you created a new client above.

  • Click on your existing OAuth 2.0 client ID from the list.
  • Under Authorized redirect URIs, click Add URI, enter `https://api.stackone.com/connect/oauth2/googleclouddata/callback`, and click Save.
  • Under Client secrets, click + Add secret to generate a new secret. Copy it and store it securely — it will not be shown again.
  • Your Client ID is shown on the same page under Additional information.
Existing OAuth client page highlighting the Authorized redirect URIs field, the Save button, the Client ID under Additional information (redacted) and the Add secret button under Client secrets.

Google Cloud session control and token expiry

Google Workspace administrators can enforce a Google Cloud session control window of 1 to 24 hours that applies to Google Cloud OAuth scopes. While it is enforced, the refresh token for this connection stops working once the window elapses, and the connected account keeps failing until a user re-authenticates interactively.

  • Symptom — the connected account periodically fails with a `refresh token expired` error even though the credentials and the OAuth client are unchanged.
  • Cause — Google Cloud session control requires interactive re-authentication for Google Cloud scopes. Google scopes outside Google Cloud (for example Sheets, Drive or Directory) are not affected.
  • Fix — in the Google Admin console, go to Security > Access and data control > Google Cloud session control and select Session never expires, or add this OAuth app to the trusted (exempted) apps list. Without one of these, periodic re-linking of the account is expected.
## Creating the StackOne Connector Profile To create the Connector Profile in StackOne for Google Cloud Data: Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)
  • Click + Connector Profile
  • Search for and select Google Cloud Data
  • Select Type as OAuth 2.0
  • Fill out the fields using details retrieved from your provider:
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • (Optional) Select Actions to be enabled for this Connector Profile
  • Click Create profile
 Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Google Cloud Data. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.