{"record":{"id":"663298f5c5f91b96","repo":"infiniflow/ragflow","slug":"google-rejected-one-or-more-of-the-requested-oauth","errorCode":null,"errorMessage":"Google rejected one or more of the requested OAuth scopes.\nFix options:\n  1. In Google Cloud Console, open APIs & Services > OAuth consent screen and add the missing scopes      (Drive metadata + Admin Directory read scopes), then re-run the flow.\n  2. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a comma-separated list of scopes you are allowed to request.","messagePattern":"Google rejected one or more of the requested OAuth scopes\\.\nFix options:\n  1\\. In Google Cloud Console, open APIs & Services > OAuth consent screen and add the missing scopes      \\(Drive metadata \\+ Admin Directory read scopes\\), then re-run the flow\\.\n  2\\. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a comma-separated list of scopes you are allowed to request\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"common/data_source/google_util/oauth_flow.py","lineNumber":94,"sourceCode":"            timeout_secs,\n            timeout_message,\n        )\n    except OSError as exc:\n        allow_console = os.environ.get(\"GOOGLE_OAUTH_ALLOW_CONSOLE_FALLBACK\", \"true\").lower() != \"false\"\n        if not allow_console:\n            raise\n        print(f\"Local server flow failed ({exc}). Falling back to console-based auth.\")\n        creds = _run_with_timeout(flow.run_console, timeout_secs, timeout_message)\n    except Warning as warning:\n        warning_msg = str(warning)\n        if \"Scope has changed\" in warning_msg:\n            instructions = [\n                \"Google rejected one or more of the requested OAuth scopes.\",\n                \"Fix options:\",\n                \"  1. In Google Cloud Console, open APIs & Services > OAuth consent screen and add the missing scopes      (Drive metadata + Admin Directory read scopes), then re-run the flow.\",\n                \"  2. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a comma-separated list of scopes you are allowed to request.\",\n            ]\n            raise RuntimeError(\"\\n\".join(instructions)) from warning\n        raise\n\n    token_dict: dict[str, Any] = json.loads(creds.to_json())\n\n    print(\"\\nGoogle OAuth flow completed successfully.\")\n    print(\"Copy the JSON blob below into GOOGLE_DRIVE_OAUTH_CREDENTIALS_JSON_STR to reuse these tokens without re-authenticating:\\n\")\n    print(json.dumps(token_dict, indent=2))\n    print()\n\n    return token_dict\n\n\ndef ensure_oauth_token_dict(credentials: dict[str, Any], source: DocumentSource) -> dict[str, Any]:\n    \"\"\"Return a dict that contains OAuth tokens, running the flow if only a client config is provided.\"\"\"\n    if \"refresh_token\" in credentials and \"token\" in credentials:\n        return credentials\n\n    client_config: dict[str, Any] | None = None","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/common/data_source/google_util/oauth_flow.py#L76-L112","documentation":"Error \"Google rejected one or more of the requested OAuth scopes.\nFix options:\n  1. In Google Cloud Console, open APIs & Services > OAuth consent screen and add the missing scopes      (Drive metadata + Admin Directory read scopes), then re-run the flow.\n  2. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a comma-separated list of scopes you are allowed to request.\" thrown in infiniflow/ragflow.","triggerScenarios":"Thrown at common/data_source/google_util/oauth_flow.py:94 when the library encounters an invalid state.","commonSituations":"Google rejects requested scopes that are not registered in the consent screen; registering or overriding the scopes prevents this error.","solutions":["Add the missing scopes in the OAuth consent screen configuration, then re-run the flow.","Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a permitted scope list."],"exampleFix":"export GOOGLE_OAUTH_SCOPE_OVERRIDE=drive.readonly,admin.directory.readonly","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}