Google documents setup

Status: proposal — owner setup for Documents (app v2026.10.14, feature off until done). Steps 11–13 (server files) Claude does once you send the IDs; never paste the client secret into chat — use the ! command Claude gives you.

Do this after the Documents code passes the normal release gates. Nothing below has been applied to production.

  1. Sign in to Google Cloud Console with your EmbeddedEra Workspace administrator account. Select your organization, then New project → EmbeddedEra Documents.
  2. Open APIs & Services → Library. Enable Google Drive API and Google Picker API.
  3. Open Google Auth Platform → Branding. Enter EmbeddedEra Documents, your support email and developer contact email.
  4. Open Audience and choose Internal. Keep this app inside your Workspace organization.
  5. Open Data Access → Add or remove scopes. Add only https://www.googleapis.com/auth/drive.file.
  6. Open Clients → Create client → Web application. Set the JavaScript origin to https://home.embeddedera.com and the redirect URI to exactly https://home.embeddedera.com/app/api/google/callback. Save the client ID and client secret.
  7. Open APIs & Services → Credentials → Create credentials → API key. Restrict it to Websites, allow https://home.embeddedera.com/*, and restrict the API to Google Picker API. Copy the key. Copy the Cloud project's project number from the project dashboard (this is the Picker app ID).
  8. In Google Drive, open Shared drives → New, name it EmbeddedEra Working, and add both owners as managers. Give other people only the access they need.
  9. Inside that drive create Templates and Documents folders. Open Documents and copy the folder ID from its URL, after /folders/.
  10. In Templates create five starter files: Work instruction (Doc), Work instruction slides (Slides), Proposal (Doc), Quote (Sheet), and Blank document (Doc). Optionally add Blank spreadsheet (Sheet) for the sixth template key. Copy each file's ID from between /d/ and the next / in its URL.
  11. On Plex append to ~/.config/google/env (do not overwrite: it also holds GOOGLE_API_KEY for PageSpeed in search-report; overwriting it on 2026-10-04 stopped PageSpeed tracking), owned by your account with permission 0600 (parent directory 0700). Enter: 
    GOOGLE_OAUTH_CLIENT_ID=your-client-id
GOOGLE_OAUTH_CLIENT_SECRET=your-client-secret
GOOGLE_PICKER_API_KEY=your-restricted-picker-key
GOOGLE_PICKER_APP_ID=your-project-number
  12. Add those credentials to a restricted Vaultwarden item called EmbeddedEra Documents OAuth. The app reuses SECRET_KEY_FERNET when present; otherwise its first connection creates ~/.config/assistant/google-documents.key with permission 0600. Back up the active encryption key in Vaultwarden too; restoring tokens requires that same key.
  13. Add the following to ~/.config/assistant/env, substituting the IDs. Ask the normal release operator to enable the feature with the approved app release: 
    DOCUMENTS_GOOGLE=1
GOOGLE_DOCS_FOLDER=documents-folder-id
GOOGLE_TEMPLATES={"work_instruction_doc":"file-id","work_instruction_slides":"file-id","proposal_doc":"file-id","quote_sheet":"file-id","blank_doc":"file-id"}
    Optional sixth JSON key: blank_sheet. Instead of JSON, use GOOGLE_TEMPLATE_WORK_INSTRUCTION_DOC, GOOGLE_TEMPLATE_WORK_INSTRUCTION_SLIDES, GOOGLE_TEMPLATE_PROPOSAL_DOC, GOOGLE_TEMPLATE_QUOTE_SHEET, GOOGLE_TEMPLATE_BLANK_DOC, and GOOGLE_TEMPLATE_BLANK_SHEET.
  14. Each owner opens Home on desktop → avatar → My account → Connect Google, choosing the same Google account used for Home. On a part's Documents → New document sheet use Authorize template to select each configured template and Authorize destination folder to select Documents. Repeat for each user: drive.file requires individual selection; entering an ID or selecting a folder does not grant access to all files inside it. If Workspace blocks consent, allow this specific OAuth client in Admin → Security → API controls.
  15. On a pilot object use New document, Open in Google, edit, return to Home, then Publish PDF. Review the image/page count, add a comment, and confirm. Check the numbered PDF and ERP attachment, download, and preview a print. Repeat the Google handoff on iPhone and Android. Link document accepts pasted URLs only for files already available to this app; use desktop Picker first if access is denied.

Published PDFs live under ~/.local/state/assistant/documents/; back up this directory together with the app database and encryption key. The feature is off by default. A PDF publication is a numbered snapshot, not a controlled work-instruction approval or a build revision assignment.

Reference: Google web OAuth, drive.file and Picker, Shared Drive support. Sheets uses the default PDF layout: the Drive export API exposes no fit-to-width option and limits exports to 10 MB. - 2026-10-04: Documents switched ON (DOCUMENTS_GOOGLE=1): ~/.config/google/env saved by owner (0600; Picker app id corrected to the project number from the client id), folder + 6 template IDs in assistant env, service restarted, config check OK. Next: owner Connect Google + authorize templates/folder on desktop, first publish test. - 2026-10-04: Templates filled by Claude via the app's Google connection: Work instruction (doc, owner's file) rewritten; the other 5 (WI slides, Proposal, Quote sheet w/ formulas, Blank doc, Blank sheet) created by the app in Documents/_Templates (folder 1F29bKtbJkETXomtjntaPkd_eMTRQFUGh) because drive.file only sees picked/app-created files and multi-select picking didn't show files; GOOGLE_TEMPLATES now points at them. Owner's 5 placeholder files in Shared Drive Templates are unused. Note: another person (Yara) will need to pick each template once via the guided Allow access. - 2026-10-04: Cloud project 197835953119 APIs verified enabled: Drive, Picker, Docs, Sheets, Slides, Drive Activity, Calendar, Gmail, Workspace Events (Forms API still disabled). App token scope remains drive.file only; each new API needs its own scope + owner approval when built.