infiniflow/ragflow · error · RuntimeError

Google rejected one or more of the requested OAuth scopes. F

Error message

Google rejected one or more of the requested OAuth scopes.
Fix options:
  1. In Google Cloud Console, open APIs & Services > OAuth consent screen and add the missing scopes      (Drive metadata + Admin Directory read scopes), then re-run the flow.
  2. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a comma-separated list of scopes you are allowed to request.

What it means

Error "Google rejected one or more of the requested OAuth scopes. Fix options: 1. In Google Cloud Console, open APIs & Services > OAuth consent screen and add the missing scopes (Drive metadata + Admin Directory read scopes), then re-run the flow. 2. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a comma-separated list of scopes you are allowed to request." thrown in infiniflow/ragflow.

Source

Thrown at common/data_source/google_util/oauth_flow.py:94

            timeout_secs,
            timeout_message,
        )
    except OSError as exc:
        allow_console = os.environ.get("GOOGLE_OAUTH_ALLOW_CONSOLE_FALLBACK", "true").lower() != "false"
        if not allow_console:
            raise
        print(f"Local server flow failed ({exc}). Falling back to console-based auth.")
        creds = _run_with_timeout(flow.run_console, timeout_secs, timeout_message)
    except Warning as warning:
        warning_msg = str(warning)
        if "Scope has changed" in warning_msg:
            instructions = [
                "Google rejected one or more of the requested OAuth scopes.",
                "Fix options:",
                "  1. In Google Cloud Console, open APIs & Services > OAuth consent screen and add the missing scopes      (Drive metadata + Admin Directory read scopes), then re-run the flow.",
                "  2. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a comma-separated list of scopes you are allowed to request.",
            ]
            raise RuntimeError("\n".join(instructions)) from warning
        raise

    token_dict: dict[str, Any] = json.loads(creds.to_json())

    print("\nGoogle OAuth flow completed successfully.")
    print("Copy the JSON blob below into GOOGLE_DRIVE_OAUTH_CREDENTIALS_JSON_STR to reuse these tokens without re-authenticating:\n")
    print(json.dumps(token_dict, indent=2))
    print()

    return token_dict


def ensure_oauth_token_dict(credentials: dict[str, Any], source: DocumentSource) -> dict[str, Any]:
    """Return a dict that contains OAuth tokens, running the flow if only a client config is provided."""
    if "refresh_token" in credentials and "token" in credentials:
        return credentials

    client_config: dict[str, Any] | None = None

View on GitHub (pinned to 554fb1133a)

Solutions

1. Add the missing scopes in the OAuth consent screen configuration, then re-run the flow.
2. Set GOOGLE_OAUTH_SCOPE_OVERRIDE to a permitted scope list.

Example fix

export GOOGLE_OAUTH_SCOPE_OVERRIDE=drive.readonly,admin.directory.readonly

When it happens

Trigger: Thrown at common/data_source/google_util/oauth_flow.py:94 when the library encounters an invalid state.

Common situations: Google rejects requested scopes that are not registered in the consent screen; registering or overriding the scopes prevents this error.

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/663298f5c5f91b96. Report an issue: GitHub.