Can google_workspace_mcp use per-client Google OAuth credentials with stateless-http?
I'm deploying taylorwilsdon/google_workspace_mcp with the 'stateless-http' transport and want each MCP client to authenticate with its own Google client ID/secret instead of sharing the server-level GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET. The maintainer mentioned external OAuth mode, but the docs still list OAuth credentials as required for token validation. Does the server support this per-client 'bring-your-own-client' flow?
Originally asked on GitHub: https://github.com/taylorwilsdon/google_workspace_mcp/issues/201
2 answers
Status: still open. As of the last comment in February 2026, per-client OAuth credentials are not implemented, and the maintainer said the feature is not on the immediate roadmap, though a PR would be welcome.
The issue was briefly closed because the maintainer thought external OAuth mode already covered the request, but the requester pointed out that external OAuth mode still requires GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET for token validation. The maintainer then clarified they had misunderstood 'clients' as MCP clients and acknowledged the request is for multiple Google OAuth clients per server instance.
Current behavior with the stateless-http transport: the server needs a client ID and secret from the environment, and dynamic client registration returns those credentials to the user. The requester noted that when ID/secret are not provided, the /.well-known/oauth-authorization-server endpoint is not served, so clients cannot discover the authorization endpoint on its non-default URL. Implementing the requested feature would require per-client credential storage and routing through the OAuth flow. The maintainer also warned that accepting arbitrary client credentials would turn the server into an open OAuth proxy and would be risky outside a trusted internal network.
No workaround is given in the thread. General advice: if you need this today, run separate server instances, each with its own GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET, since one instance shares a single OAuth client for all MCP clients.
Did this work for you?What @taylorwilsdon tried on GitHub (Didn't work)
The maintainer suggested that external OAuth mode already provides this and closed the issue, but the requester pointed out that the docs still require GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET for token validation, so it does not cover per-client credentials.
Did this work for you?
Related questions
- Google Tasks tool missing when running workspace-mcp via uvx
- google_workspace_mcp behind reverse proxy: redirect_uri_mismatch and env vars ignored
- google_workspace_mcp modify_event loses attendee responseStatus and event color even after fix on main?
- google_workspace_mcp get_gmail_attachment_content 500: serve_attachment() missing 'request'
- Google Sheets export_format=pdf returns XLSX from get_drive_file_download_url