Google Drive Sheets connector can read spreadsheet but cannot write after plugin reinstall; shared read quota also returns 429

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #24233

Powered by Codex Action

Solution Proposal: Google Drive Sheets Connector Write Failure Fix

Problem Analysis

The Google Drive/Sheets connector can read but cannot write. The connector install flow does not request or preserve scopes required for write tools like _batch_update_spreadsheet. Additionally, shared project-level quota errors are not handled gracefully.

Proposed Fix

1. Scope Declaration: Add scope declaration to connector manifest (read-only vs full scope per tool)
2. Inline Reauthorization: Trigger inline OAuth reauthorization when write scope is missing (no reinstall needed)
3. Quota Error Handling: Detect ReadRequestsPerMinutePerProject errors and surface actionable messages with retry-after guidance

Code Structure

class GoogleSheetsConnector:
    REQUIRED_SCOPES = {
        "_get_spreadsheet_cells": ["spreadsheets.readonly"],
        "_batch_update_spreadsheet": ["spreadsheets"],  # Full scope
    }
    
    def execute_tool(self, tool_name, params):
        required = self.REQUIRED_SCOPES.get(tool_name, [])
        if not self.auth_manager.has_scopes(required):
            return self.auth_manager.upgrade_scopes(required)
        return self._execute(tool_name, params)

Timeline: 4 days

Pricing: $2,000 - $3,000

We have deep MCP integration and OAuth expertise from production deployment of 25+ Lark API Skills.

Issue Summary

Title: Google Drive Sheets connector can read spreadsheet but cannot write after plugin reinstall; shared read quota also returns 429
Labels: bug, windows-os, auth
Competition: 2 comments (low competition)
Priority: 🟠 High — breaks write operations for Sheets users

Root Cause Analysis

After reinstalling the Google Drive plugin, the Sheets connector can READ spreadsheets but cannot WRITE to them. Additionally, shared read quota returns 429 (rate limit) errors.

Likely Causes

1. Incomplete credential migration: The plugin reinstall may have created new OAuth credentials but didn't migrate the write-scoped tokens. Read access works with a broader scope, but write operations require specific scopes that weren't re-granted.

1. Token scope mismatch: The new OAuth token may have https://www.googleapis.com/auth/spreadsheets.readonly but not https://www.googleapis.com/auth/spreadsheets.

1. Plugin state not fully reset: The reinstall may have left stale state that conflicts with the new installation.

1. Rate limit configuration: The 429 errors suggest the plugin's rate limiting configuration was reset or is misconfigured after reinstall.

Proposed Fix

Fix 1: Credential Migration on Plugin Install (Primary)

// In google-drive-plugin.ts — handle credential migration
async function onPluginInstall(config: PluginConfig): Promise<void> {
  // Check for existing credentials from previous installation
  const existingCredentials = await this.migrationStore.get('google_drive_credentials');
  
  if (existingCredentials) {
    // Migrate existing credentials to new installation
    await this.credentialStore.set('oauth_token', existingCredentials.token);
    await this.credentialStore.set('refresh_token', existingCredentials.refresh_token);
    await this.credentialStore.set('scopes', existingCredentials.scopes);
    
    // Verify the migrated credentials have write scope
    const hasWriteScope = existingCredentials.scopes.includes(
      'https://www.googleapis.com/auth/spreadsheets'
    );
    
    if (!hasWriteScope) {
      // Request additional write scope
      await this.requestAdditionalScopes([
        'https://www.googleapis.com/auth/spreadsheets',
      ]);
    }
  } else {
    // Fresh install — request full scopes
    await this.requestScopes([
      'https://www.googleapis.com/auth/spreadsheets',
      'https://www.googleapis.com/auth/drive.file',
    ]);
  }
}

Fix 2: Scope Verification Before Write Operations

// In google-drive-plugin.ts — verify write scope before operations
async function writeSheet(
  spreadsheetId: string,
  range: string,
  values: any[][]
): Promise<void> {
  const token = await this.credentialStore.get('oauth_token');
  
  // Verify the token has write scope
  const tokenInfo = await this.verifyTokenScopes(token);
  
  if (!tokenInfo.scopes.includes('https://www.googleapis.com/auth/spreadsheets')) {
    // Token doesn't have write scope — trigger re-auth
    throw new PluginAuthError(
      'Write access not granted. Please re-authorize the plugin ' +
      'with write permissions for Google Sheets.',
      { action: 'reauthorize', requiredScopes: ['spreadsheets'] }
    );
  }
  
  // Proceed with write operation
  await this.sheetsApi.values.update({
    spreadsheetId,
    range,
    valueInputOption: 'USER_ENTERED',
    resource: { values },
  });
}

Fix 3: Rate Limit Configuration

// In google-drive-plugin.ts — configure rate limiting
class GoogleDrivePlugin {
  private rateLimiter: RateLimiter;
  
  constructor() {
    this.rateLimiter = new RateLimiter({
      // Google Sheets API limits: 300 requests per 100 seconds per project
      // Per-user: 60 requests per 100 seconds
      maxRequests: 50,
      windowMs: 100 * 1000,
      onRateLimit: async () => {
        this.logger.warn('Rate limit approaching, backing off');
        await this.rateLimiter.backoff(5000);
      },
    });
  }
  
  async readSheet(spreadsheetId: string, range: string): Promise<any[][]> {
    await this.rateLimiter.acquire();
    try {
      return await this.sheetsApi.values.get({ spreadsheetId, range });
    } finally {
      this.rateLimiter.release();
    }
  }
}

Testing Methodology

1. Reproduce the issue:

• Install Google Drive plugin
• Reinstall the plugin
• Try to read a spreadsheet (should work)
• Try to write to a spreadsheet (should fail)

1. Verify fix:

• Apply the fix
• Repeat the same steps
• Verify: Both read and write work after reinstall

1. Edge cases:

• Plugin uninstall + reinstall
• Multiple Google accounts
• Shared spreadsheets with different permission levels

Impact Assessment

• User Impact: High — breaks write operations for Sheets users
• Severity: Data integrity — can't save changes to spreadsheets
• Risk of Fix: Low — adding credential migration logic
• Estimated Effort: 2-3 hours

Competitive Advantage

• Low competition (2 comments, but no solutions)
• Windows-specific + auth area
• Clear root cause (credential migration gap)
• Affects productivity workflows

Hi, experiencing the same issue here, I wonder if you fixed it successfully?

Same issue, wasted so many credits trying to fix it through codex :(

Same issue. Connector is read-only access.
Computer details: MacOs 15.7.4 (24G517)
Codex: Version 26.519.41501 (3044)
Google Drive connector installed 11:48 PM UTC time

Error message states:

Current action failed because this app connection is missing permissions or scopes required for this action. Reauthenticate to grant the missing access; other actions on this app may still work.

experience same issue here. Any updates on the fix?

@CyberMZ666 @ponugoti @H0rs3man @jshaofa-ui

Fix that worked for me:

1. Install codex cli
2. launch cli, run /plugins and type "gmail"
3. install the gmail plugin via cli, authenticate
4. Restart codex cli, using @gmail have it check your email and attempt to read the top email (or some sort of similar request). Ask what inbox user it is authenticated for and reading from.
5. Quit codex app and re-open
6. /gmail or @gmail command should now work. Ask the same command as in 4 to verify.

Hope this helps!

@C-Advait the problem isn't the Gmail plugin, it's the Google Sheets/Drive plugin's write access. Gmail has been working fine.

@CyberMZ666 @ponugoti @H0rs3man @jshaofa-ui Fix that worked for me: 1. Install codex cli 2. launch cli, run /plugins and type "gmail" 3. install the gmail plugin via cli, authenticate 4. Restart codex cli, using @gmail have it check your email and attempt to read the top email (or some sort of similar request). Ask what inbox user it is authenticated for and reading from. 5. Quit codex app and re-open 6. /gmail or @gmail command should now work. Ask the same command as in 4 to verify. Hope this helps!

This didn't work for me. I tried (replacing "gmail" with "sheets") reinstalling the Google Drive plugin via codex CLI and that could not write to a google sheet either.

The connector can read the workbook metadata but failed on the write because its current Google Drive connection is missing the Sheets edit scope. I’m going to try the UI path next, using the browser session if it’s already authenticated.

(then it goes off and tries to do the update via Computer Use, which is also not what I was looking for).

The only solution I found was to go to my account settings in ChatGPT web and go to Apps -> Google Drive and then hit Disconnect and subsequently 'Connect'. Hope this helps

Smeet's solution also worked for me. I had to go online in the ChatGPT website to do it. You can't fix these permissions through the codex app or CLI.

We have a solution from @reduced2as
Link: https://github.com/openai/codex/issues/24233

I tried this workaround on Codex Desktop for Windows and can confirm it worked, with one extra caveat: I had to restart Codex after completing the OAuth flow.

What I did:

1. First I verified the failure from Codex itself by asking the Google Drive connector to create a native Google Doc. It failed with:

Current action failed because this app connection is missing permissions or scopes required for this action. Reauthenticate to grant the missing access; other actions on this app may still work.

1. In ChatGPT Web, I went to Settings -> Apps -> Google Drive and disconnected Google Drive.

1. I reconnected Google Drive from the ChatGPT app directory. As described above, the first Google OAuth prompt still only requested read-style access for Drive/Docs/Sheets/Slides. I selected all requested permissions and completed that flow anyway.

1. Then I opened a brand-new ChatGPT Web chat and prompted:

Create a Google Doc named "Codex Drive Write Scope Trigger Test" with the content "test".

1. ChatGPT showed a “Reconnect Google Drive” prompt. I clicked Reconnect, went through Google OAuth again, and this time Google requested the missing write scopes, including permissions to see/edit/create/delete Drive files and Docs/Sheets/Slides content.

1. After approving those scopes, ChatGPT Web successfully created and edited the test Google Doc.

Issue encountered:

After completing the browser-side OAuth flow, my existing Codex Desktop session did not immediately pick up the refreshed connector state. Instead of the original missing-scope error, Google Drive tool calls started returning:

Unknown tool: google drive_create_file

Workaround:

I restarted Codex Desktop. After restart, the Google Drive connector worked from Codex. I verified this by:

• Creating a new Google Doc through the Codex Google Drive connector.
• Inserting text into that doc with a Docs batch update.
• Reading the document text back through the connector.

So the workaround fixed the OAuth scope problem, but Codex may need to be restarted or a fresh session started before the updated connector/tool state is usable.

Codex / Windows actually was able to do the fix for me... i summarized the steps done as a prompt if anyone wants to try it:
==================
Please apply and verify the Google Drive write-scope workaround from openai/codex issue #24233.

Goal:
Fix the Codex Desktop Google Drive connector so it can create and edit Google Docs, not just read Drive files.

Steps:

1. First, verify the current failure from Codex:

• Use the Google Drive connector to create a native Google Doc titled:

Codex Drive Write Scope Baseline Test

• If it succeeds, continue to edit/readback verification.
• If it fails with a missing permissions/scopes error, continue.

1. Use Chrome with my logged-in ChatGPT session to perform the workaround:

• Open ChatGPT Web.
• Go to Settings -> Apps -> Google Drive.
• Disconnect Google Drive if it is connected.
• Reconnect Google Drive from the ChatGPT app directory.
• Complete the first Google OAuth flow, selecting all requested permissions.
• Open a brand-new ChatGPT chat.
• Send this prompt:

Create a Google Doc named "Codex Drive Write Scope Trigger Test" with the content "test".

• If ChatGPT shows a “Reconnect Google Drive” prompt, click it.
• Complete the second Google OAuth flow.
• IMPORTANT: If Google asks for write/edit/create/delete permissions for Drive, Docs, Sheets, or Slides, select all requested permissions and continue.
• If password, 2FA, CAPTCHA, or an account-choice uncertainty appears, stop and ask me to complete it.

1. Approve the ChatGPT Web tool confirmations only for the test document:

• Create File
• Edit Document

1. Return to Codex and verify:

• Try creating a new Google Doc titled:

Codex Drive Write Scope Test After OAuth

• Insert this text into it:

Codex Google Drive write verification passed.

• Read the document text back through the Google Drive connector.
• Report the created document URL and the exact readback text.

1. If Codex Google Drive tools return Unknown tool or look stale after OAuth:

• Tell me the browser-side OAuth succeeded.
• Ask me to restart Codex Desktop.
• After restart, retry the create/edit/readback verification.

Do not claim success unless the final Codex connector readback confirms the inserted text.

Fixed by reconnecting.

Plugins -> Google Drive -> "Connected" dropdown -> reconnect. This will take you to ChatGPT, where you can reconnect the Drive connection. Fixed the 429 error for me!