docs(auth-providers): add the Drive picker's JavaScript origin to Google setup

[samkujovich]

Summary

A customer using their own Google OAuth client couldn't grant Arcade access to a Drive folder. The Google Drive file picker link opened Google's popup, and Google rejected it with Error 401: invalid_client (no registered origin).

The picker page runs on https://cloud.arcade.dev and starts Google sign-in in the browser with the provider's client ID. Google only allows that when the page's origin is listed under the client's Authorized JavaScript origins. Arcade's own Google app already lists it. The Google auth provider page only tells custom-client users to add the redirect URI, so they never add the origin. We hit the same error on our staging app and fixed it the same way.

Changes

• app/en/references/auth-providers/google/page.mdx: adds a step under "Create a Google app" to add https://cloud.arcade.dev to Authorized JavaScript origins. It says which MCP servers need it, shows the error you get without it, and tells self-hosted users to use the origin of their arcade.coordinatorUrl Helm value instead.

Design decisions

• Self-hosted origin comes from arcade.coordinatorUrl. The worker builds the picker link from Engine's external coordinator URL, which the chart sets from arcade.coordinatorUrl (or <protocol>://<coordinator hostname>/api/v1). So a self-hosted picker runs on the customer's coordinator host. This follows the code path and hasn't been tried on a real self-hosted install, so a deploy reviewer should confirm it.
• Step in the existing list, not a callout. People follow that list while setting up the client in Google Cloud console, so the origin step sits next to the redirect URI step.
• No Google Picker API step. Google's Picker docs list enabling the Picker API as a prerequisite, but our staging fix only needed the origin. I left it out until we confirm it's required for a custom client.

Test plan

• Vale style review on this PR passes or its suggestions are addressed
• Preview deploy renders the new bullet correctly in the "Create a Google app" list
• Customer adds the origin to their client and the picker link opens without invalid_client

Refs: TOO-2585

---

🤖 Generated with Claude Code; author is accountable for every line.

---

Note

Low Risk
Documentation-only change to Google OAuth setup; no runtime or auth code paths are modified.

Overview
Documents a missing Google Cloud OAuth step for customers who bring their own Google client: add https://cloud.arcade.dev to Authorized JavaScript origins, alongside the existing redirect URI step.

The new bullet explains that Drive, Docs, Sheets, Slides, and Forms MCP servers use Arcade’s hosted Drive file picker on that origin, and that omitting it causes Error 401: invalid_client. Self-hosted installs are told to register the coordinator origin (scheme + host) from their Helm configuration instead of the cloud URL.

^{Reviewed by Cursor Bugbot for commit 98f30fe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 15, 2026 11:45pm UTC