mcp-google-sheets create_spreadsheet fails with 403 PERMISSION_DENIED when using a service account
Using the mcp-google-sheets MCP server (xing5/mcp-google-sheets) configured with a service account (Method A), the create_spreadsheet tool returns 403 Forbidden with reason PERMISSION_DENIED, while other operations on existing spreadsheets work. Google Sheets API and Drive API are both enabled in Cloud Console, and a normal Google account can create files in the shared Drive folder. Why does spreadsheet creation fail and how was it fixed?
Originally asked on GitHub: https://github.com/xing5/mcp-google-sheets/issues/22
4 answers
Status: explained by the maintainer, and the reporter resolved it by switching from service-account auth to the OAuth2-generated credentials.json; the issue was closed as completed.
The maintainer explained that create_spreadsheet performs two separate API calls: it creates the spreadsheet via the Sheets API (server.py:716-719), then moves it into the target folder via the Drive API (server.py:724-745). Each call needs its own scope:
- Creating the spreadsheet requires https://www.googleapis.com/auth/spreadsheets (opens external site).
- Moving the newly created file into a folder requires https://www.googleapis.com/auth/drive.file (opens external site), which lets the service account manage files it has opened or created.
The reporter found that with the service account, even direct file creation through the Drive API failed and the service account's storage quota appeared to be 0. After switching to the OAuth2-generated credentials.json, everything went smooth.
Did this work for you?What @lockon-n tried on GitHub (Worked)
Switched from the service account to the OAuth2-generated credentials.json for the MCP server configuration; the reporter said everything went smooth after the change.
Source: https://github.com/xing5/mcp-google-sheets/issues/22#issuecomment-3047204211 (opens external site)
Did this work for you?What @xing5 tried on GitHub (Outcome unclear)
Maintainer explained that create_spreadsheet needs the spreadsheets scope to create the file and the drive.file scope to move it into the target folder.
Source: https://github.com/xing5/mcp-google-sheets/issues/22#issuecomment-3043776805 (opens external site)
Did this work for you?What a GitHub user tried on GitHub (Didn't work)
Configured the server with a service account (Method A), enabled Google Sheets API and Google Drive API, and shared the Drive folder to a normal Google account that could create files in the browser; the 403 PERMISSION_DENIED on create_spreadsheet persisted.
Source: https://github.com/xing5/mcp-google-sheets/issues/22 (opens external site)
Did this work for you?
Related questions
- mcp-google-sheets: 400 Invalid schema for function 'update_cells' (array schema missing items)
- Can I use mcp-google-sheets with Gemini, or does it only work with Claude?
- Cursor shows "0 tools enabled" for mcp-google-sheets even though the SSE server runs on port 8000
- mcp-google-sheets: 'file_cache is only supported with oauth2client<4.0.0' — is it stuck?
- mcp-google-sheets: 403 storage/quota error when creating a spreadsheet with a service account