Google Docs

GOOGLE WORKSPACE · FILES & DOCS

Read and edit the documents that person can already open.

Connect Google Docs with Fabriq Developer

Your user consents at Google Docs. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.

provider “docs”

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="docs")   # consent at Google Docs
return redirect(url)

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting Google Docs in practice

The Docs API allows 600 write requests per minute per project but only 60 per user, so a single document-editing agent hits the per-user ceiling ten times sooner than the project one. Both documents and documents.readonly are sensitive scopes, and the only non-sensitive route to a document, drive.file, can see nothing the app did not create or the user did not explicitly pick.

Scopes that draw scrutiny

https://www.googleapis.com/auth/documents Sensitive. "See, edit, create, and delete all your Google Docs documents."
https://www.googleapis.com/auth/documents.readonly Sensitive. "See all your Google Docs documents" — read-only is still every document.
https://www.googleapis.com/auth/drive Restricted. Full Drive access, so choosing it to reach arbitrary documents pulls in restricted-scope verification.
https://www.googleapis.com/auth/drive.readonly Restricted. See and download all Drive files.
https://www.googleapis.com/auth/drive.file Non-sensitive and recommended, but limited to the specific files the user uses with this app, so it cannot find a document by name.

Rate limits

Read requests: 3,000 per minute per project, 300 per minute per user per project.
Write requests: 600 per minute per project, 60 per minute per user per project.
No daily cap is published; exceeding a quota returns 429: Too many requests.
The Docs MCP server enforces the same read and write quotas as the REST API.

Who has to approve

A Workspace admin sets each app to Trusted, Limited, specific Google data, or Blocked, with unconfigured apps appearing in an "Apps pending review" list. Google Drive and Docs are named among the products for which an admin can additionally restrict high-risk OAuth scopes, including full file access and document modification scopes.

Worth knowing

60 writes per minute per user is the binding limit, so an agent that applies edits one request at a time stalls; batchUpdate folds many changes into a single write request.
drive.file is the only non-sensitive path to document content and only ever sees files the app created or the user opened with it, so open-ended "find my doc" work needs a sensitive or restricted scope.
Google states that standard API use is free today but that exceeding quota is planned to incur charges to the Cloud billing account later in 2026.

Checked against Docs API usage limits (2026-09-29), Docs API OAuth scopes (2026-09-29), Workspace app access control (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

google_docs_createWRITE

Create a new Google Docs document. Returns the document ID and URL.

documents

google_docs_delete_contentWRITE

Delete content from a Google Doc between start and end indexes. IMPORTANT: You must first call google_docs_get to find the correct index positions.

documents

google_docs_getREAD

Get the content and metadata of a Google Doc. IMPORTANT: You must first call google_docs_list to get the document_id. Do NOT use placeholder values.

documents.readonly

google_docs_insert_imageWRITE

Insert an image into a Google Doc at a specific position. The image must be publicly accessible. IMPORTANT: You must first call google_docs_get to find the insertion index.

documents

google_docs_insert_tableWRITE

Insert a table into a Google Doc at a specific position. IMPORTANT: You must first call google_docs_get to find the insertion index.

documents

google_docs_insert_textWRITE

Insert text at a specific position in a Google Doc. IMPORTANT: You must first call google_docs_get to understand the document structure and find the insertion index.

documents

google_docs_listREAD

List Google Docs documents. Returns document IDs, names, and links.

drive.readonly

google_docs_replace_textWRITE

Find and replace text throughout a Google Doc. Replaces all occurrences of the search text.

documents