Google Sheets

GOOGLE WORKSPACE · FILES & DOCS

Read ranges, append rows, and update cells in their spreadsheets.

Connect Google Sheets with Fabriq Developer

Your user consents at Google Sheets. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.

provider “sheets”

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="sheets")   # consent at Google Sheets
return redirect(url)

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting Google Sheets in practice

Sheets allows only 60 read and 60 write requests per minute per user — one of the tightest per-user ceilings in Google Workspace, and five times lower than the 300-per-minute project quota it sits inside. A request that takes more than 180 seconds of processing time is also cut off with a timeout, so a single huge write fails rather than running long.

Scopes that draw scrutiny

https://www.googleapis.com/auth/spreadsheets Sensitive. "See, edit, create, and delete all your Google Sheets spreadsheets."
https://www.googleapis.com/auth/spreadsheets.readonly Sensitive. "See all your Google Sheets spreadsheets", so read-only still means every spreadsheet.
https://www.googleapis.com/auth/drive Restricted. Full Drive access, which Sheets accepts and which triggers restricted-scope verification.
https://www.googleapis.com/auth/drive.readonly Restricted. See and download all Drive files.
https://www.googleapis.com/auth/drive.file Non-sensitive and the recommended option, but scoped to the specific files the user uses with the app, so it cannot discover a sheet by name.

Rate limits

Read requests: 300 per minute per project, 60 per minute per user per project.
Write requests: 300 per minute per project, 60 per minute per user per project.
No daily request limit as long as you stay inside the per-minute quotas.
Requests exceeding 180 seconds of processing time return a timeout error.
No hard payload size limit, but Google recommends a 2 MB maximum payload.

Who has to approve

A Workspace admin decides per app, in Admin console API controls, whether it is Trusted, Limited, allowed specific Google data, or Blocked, and an app that has not been configured shows up in an "Apps pending review" list for the admin to approve or dismiss.

Worth knowing

60 requests per minute per user is the limit that matters: five users on one project share nothing, but one user driving an agent is throttled long before the project quota is touched.
The batch methods are the only realistic way to stay inside that: many cell edits in one batchUpdate count as a single write request.
Because there is no daily quota, an overrunning integration is never locked out for the day — it simply oscillates against the per-minute wall, which is easy to mistake for flakiness.
drive.file is the only non-sensitive scope here, and it cannot see a spreadsheet the app did not create or the user did not explicitly pick.

Checked against Sheets API usage limits (2026-09-29), Sheets API OAuth scopes (2026-09-29), Workspace app access control (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

google_sheets_add_sheetWRITE

Add a new sheet/tab to a spreadsheet. IMPORTANT: You must first call google_sheets_list to get the spreadsheet_id.

spreadsheets

google_sheets_append_rowsWRITE

Append rows of data to the end of a sheet. IMPORTANT: You must first call google_sheets_list to get the spreadsheet_id.

spreadsheets

google_sheets_clear_rangeWRITE

Clear all values from a specific range in a spreadsheet (keeps formatting). IMPORTANT: You must first call google_sheets_list to get the spreadsheet_id.

spreadsheets

google_sheets_createWRITE

Create a new Google Sheets spreadsheet. Returns the spreadsheet ID and URL.

spreadsheets

google_sheets_delete_sheetWRITE

Delete a sheet/tab from a spreadsheet. WARNING: This cannot be undone. IMPORTANT: You must first call google_sheets_get to get the sheet_id.

spreadsheets

google_sheets_getREAD

Get metadata and sheet names for a Google Sheets spreadsheet. IMPORTANT: You must first call google_sheets_list to get the spreadsheet_id.

spreadsheets.readonly

google_sheets_listREAD

List Google Sheets spreadsheets. Returns spreadsheet IDs, names, and links.

drive.readonly

google_sheets_read_rangeREAD

Read data from a specific range in a Google Sheets spreadsheet. Returns the cell values as a 2D array. IMPORTANT: You must first call google_sheets_list to get the spreadsheet_id.

spreadsheets.readonly

google_sheets_write_rangeWRITE

Write data to a specific range in a Google Sheets spreadsheet. IMPORTANT: You must first call google_sheets_list to get the spreadsheet_id and google_sheets_get to verify sheet names.

spreadsheets