How to Enable Google's Agentic OAuth Setting for Workspace MCP Before the November Deadline

Introduction

Google has added a new classification to OAuth: an “agentic” flag that marks an OAuth 2.0 client as belonging to an AI agent. This matters right now because Google Workspace remote MCP servers will refuse requests authorized with clients that lack the flag starting November 11, 2026. If you connect Gmail, Drive, Docs, Sheets, Slides, Calendar, Chat, People, or Classroom MCP servers to Claude, Antigravity, or any other agent, you need to check this setting before the deadline. This tutorial walks through the exact Cloud Console steps, based on Google’s official configuration guide, and shows how to verify and fix your clients.

Quick answer

In Google Cloud Console, open Google Auth Platform, then Clients, create a Web application OAuth client, tick Use this client for an AI-powered agent, and click Create. Swap the new client ID into your MCP config before November 11, 2026.

Evidence

The timeline is tight and well sourced. ASTIG’s October 2026 reporting sets three dates: developers could manually enable the agentic toggle starting October 12, 2026; Google Workspace MCP servers will actively reject requests from clients lacking the agentic tag on November 11, 2026; and on November 12, 2026 the agentic configuration becomes permanent for existing clients, after which changing status requires creating a brand-new OAuth client ID. You have days, not months, to act.

The surface area you must tag is large. Google’s configuration guide lists nine dedicated Workspace MCP servers, one per product: Gmail, Drive, Docs, Sheets, Slides, Calendar, Chat, People, and Classroom. Each sits behind its own *.mcp.googleapis.com endpoint (for example https://gmailmcp.googleapis.com/mcp/v1). Setting them up also requires enabling nine Google APIs plus nine MCP services in your Cloud project, so this is a project-wide credential change, not a single toggle you flip casually.

Google’s own support documentation states the consequence in one sentence: “Some Google MCP endpoints, such as Workspace tools, will only accept calls authorized with an agentic client ID.” (Manage OAuth Clients). The same page gives the best practice that shapes everything below: keep separate OAuth client IDs for human-driven sessions and for agent workflows, because mixing them breaks clean monitoring and granular access policy.

For the full setup walkthrough this article is based on, Google also ships a codelab that builds a Workspace AI agent with ADK and MCP, which creates two separate client IDs, one for local development and one for the deployed agent. The pattern below follows that same separation.

Prerequisites

• A Google Cloud project with billing enabled, and a Google account that can edit it.
• Membership in the Google Workspace Developer Preview Program (the official guide requires it).
• The gcloud CLI installed and initialized, for enabling APIs.
• An MCP client such as Antigravity or Claude with custom connectors.
• Basic comfort with OAuth concepts: client ID, client secret, redirect URI, scopes.

If you are new to MCP servers in general, read our MCP server tutorial first for the protocol basics, and the Claude Code MCP setup guide if Claude Code is your client.

Step-by-step guide

All Cloud Console steps below follow Google’s official Workspace MCP configuration guide, which documents the exact click paths and settings.

Step 1: Enable the nine APIs and nine MCP services

In your terminal, with gcloud initialized, enable the product APIs:

gcloud services enable gmail.googleapis.com \
  drive.googleapis.com \
  docs.googleapis.com \
  sheets.googleapis.com \
  slides.googleapis.com \
  calendar-json.googleapis.com \
  chat.googleapis.com \
  people.googleapis.com \
  classroom.googleapis.com --project=YOUR_PROJECT_ID

Then enable the MCP services themselves:

gcloud services enable gmailmcp.googleapis.com \
  drivemcp.googleapis.com \
  docsmcp.googleapis.com \
  sheetsmcp.googleapis.com \
  slidesmcp.googleapis.com \
  calendarmcp.googleapis.com \
  chatmcp.googleapis.com \
  people.googleapis.com \
  classroommcp.googleapis.com --project=YOUR_PROJECT_ID

Replace YOUR_PROJECT_ID with your actual project ID. Both commands should exit silently with no error output, which means success. If you only need a subset of products, you can enable just those pairs, but enable the API and its MCP service together.

Step 2: Configure the Chat app (Chat MCP server only)

If you plan to use the Chat MCP server, Google requires a Chat app in the project:

1. In the Cloud Console, search for Google Chat API, then click Google Chat API > Manage > Configuration.
2. Set App name to Chat MCP.
3. Set Avatar URL to https://developers.google.com/chat/images/quickstart-app-avatar.png.
4. Set Description to Chat MCP server.
5. Under Functionality, toggle Enable interactive features off.
6. Under Logs, select Log errors to Logging.
7. Click Save.

Skip this step if you do not use the Chat server.

Step 3: Configure the OAuth consent screen

Google requires the consent screen before you can create an OAuth client ID:

1. Go to Google Auth Platform > Branding (or APIs & Services > OAuth consent screen if Google Auth Platform is not visible).
2. If not configured yet, click Get Started. Under App Information, type Workspace MCP Servers as the app name and select your email as the user support email.
3. Under Audience, select Internal. If Internal is unavailable for your project, select External and later add your own account under Audience > Test users.
4. Under Contact Information, enter an email address where you can be notified about changes to the project, then click Create.
5. Go to Data Access > Add or Remove Scopes, and under Manually add scopes paste the scopes for the servers you want. The core set for the most used servers is:

https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/gmail.compose
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/drive.file
https://www.googleapis.com/auth/calendar.calendarlist.readonly
https://www.googleapis.com/auth/calendar.events.freebusy
https://www.googleapis.com/auth/calendar.events.readonly
https://www.googleapis.com/auth/chat.messages.readonly
https://www.googleapis.com/auth/chat.spaces.readonly

6. Click Add to Table, then Update, then Save on the Data Access page.

A full configuration covering every product uses 21 distinct scopes across Gmail, Drive, Docs, Sheets, Slides, Calendar, Chat, and People, according to a community setup walkthrough published in October 2026. Add only what your agent needs; fewer scopes means a smoother verification story.

Step 4: Create the agentic OAuth client ID

This is the step the November deadline is about:

1. In the Cloud Console, go to Google Auth Platform > Clients > Create Client.
2. Select Web application as the application type.
3. Enter a descriptive Name, for example workspace-mcp-agent.
4. In the Authorized redirect URIs section, click + Add URI and add the redirect URI your MCP client needs. Examples from published guides:
   • Antigravity: https://antigravity.google/oauth-callback
   • Claude Code local flow: http://localhost:8765/callback
   • claude.ai or Claude Desktop custom connectors: https://claude.ai/api/mcp/auth_callback
5. Select Use this client for an AI-powered agent. This is the agentic flag.
6. Click Create and copy your Client ID and Client Secret into a password manager. Treat the secret like a password.

That checkbox is the whole point of this tutorial. Without it, Workspace MCP servers will reject your calls after November 11, 2026.

Step 5: Tag existing clients before November 12, 2026

If you already have OAuth clients wired to Workspace MCP servers, you do not have to create new ones yet:

1. Go to Google Auth Platform > Clients and open the existing client.
2. Look for the Use this client for an AI-powered agent checkbox. It has been rolling out to consoles since October 12, 2026.
3. Select it and save.

Do this before November 12, 2026. After that date the marking becomes permanent and you will have to create a brand-new OAuth client ID and rotate credentials everywhere instead of flipping a switch.

While you are here, apply the separation rule from the official docs: keep a standard client for human-driven web or mobile flows and this agentic client only for agent and MCP traffic.

Step 6: Wire the client into your MCP client and authenticate

For Antigravity, open or create ~/.gemini/config/mcp_config.json and add the servers you need with your new credentials:

{
  "mcpServers": {
    "gmail": {
      "serverUrl": "https://gmailmcp.googleapis.com/mcp/v1",
      "oauth": {
        "clientId": "YOUR_CLIENT_ID",
        "clientSecret": "YOUR_CLIENT_SECRET"
      }
    },
    "drive": {
      "serverUrl": "https://drivemcp.googleapis.com/mcp/v1",
      "oauth": {
        "clientId": "YOUR_CLIENT_ID",
        "clientSecret": "YOUR_CLIENT_SECRET"
      }
    },
    "calendar": {
      "serverUrl": "https://calendarmcp.googleapis.com/mcp/v1",
      "oauth": {
        "clientId": "YOUR_CLIENT_ID",
        "clientSecret": "YOUR_CLIENT_SECRET"
      }
    }
  }
}

Then authenticate each server through your client’s settings: sign in with your Google account, copy the authorization code, paste it into the prompt, and confirm. In Antigravity IDE the servers show an Authenticate button under Customizations > Installed MCP Servers; in Antigravity CLI the /mcp panel shows Authed next to working servers.

Step 7: Verify a tool call goes through

Ask your agent a simple cross-product question, for example “What meetings do I have tomorrow, and is there a related email thread?” If the agent lists tools from the Workspace servers and returns real data, the agentic client works. If you see an error stating the client is not marked as an AI agent, the flag did not take effect: double check that the client ID in your config is the agentic one and that you saved the checkbox before the lock.

For agent workflows that need tool use inside automation, see our n8n AI agent tutorial for how agentic tool calling composes with workflow orchestration.

Troubleshooting

The agentic checkbox is missing on my existing client

The toggle started rolling out on October 12, 2026, so some consoles lag. First, make sure the MCP APIs are enabled in the project, because a project with no agent services can hide agent-specific controls. If the box still does not appear, do not wait: create a fresh client through Clients > Create Client (the flag is reliably present in the creation flow) and rotate your MCP config to the new credentials. Report the missing checkbox only if both paths lack it.

After November 11, tool calls fail with “not marked as an AI agent”

This is the documented rejection behavior. The fix is mechanical: confirm the client ID in your MCP config matches the agentic client you created in Step 4 (not the old standard one), re-run authentication for each server, and retry the tool call. Also check that your MCP client actually sends the OAuth token on tools/call; some clients cache the previous session, so restart the client before concluding the fix failed.

After November 12 the marking is locked and I need to change it

Per the reported timeline, the agentic configuration becomes permanent for existing clients on November 12, 2026. You cannot untag or retag after that. The fix is to create a brand-new OAuth client ID with the correct marking, update every mcp_config.json and environment variable that referenced the old one, re-authenticate all servers, and only then delete or disable the old client. Keep the old client until the new one passes a real tool call.

Tokens expire after seven days on an External consent screen

Google’s testing policy gives external apps in Testing refresh tokens that expire after seven days. If your MCP sessions die weekly, the cause is usually this, not the agentic flag. Prefer the Internal audience (the official guide’s recommendation) when your organization allows it, add test users for External projects, or complete OAuth app verification to escape testing mode.

The Chat MCP server returns authorization errors

The Chat server additionally requires the Chat app configuration from Step 2. An agentic client alone is not enough: with no Chat app configured, the server has nothing to authorize against. Revisit the Chat app settings, confirm interactive features are off and logs are set to Log errors to Logging, then re-authenticate the chat server entry.

Conclusion

The November 2026 deadline makes the agentic OAuth flag a mandatory maintenance task, not an optional optimization: tag your clients by November 11, expect the marking to lock on November 12, and keep standard and agentic clients separate as Google recommends. The steps above, enable the nine APIs and MCP services, configure the consent screen, create a Web application client with Use this client for an AI-powered agent selected, and wire it into your MCP client, get a Workspace agent from blocked to working. Next, continue with our MCP server tutorial to build your own MCP server on this same pattern.

Frequently asked questions