Search code examples
securitygoogle-apps-scriptgoogle-sheetsweb-applicationsgodot4

Can I restrict the access of my Google Apps Script Web App to a single Google Spreadsheet?

I'm following this tutorial to connect a Godot program to a single specific Google Sheet.

However, when I reach the point of deploying the Web App, I'm asked to authorise the app to access my account - with a warning from Google that this will let the Web App alter ANY data in my Google account.

I would prefer to give this web app as little access to my account as absolutely possible - indeed, my intention was for the app to only be able to access a single Sheet.

Does anybody know how to deploy an Apps Script program while restricting access to a single Google Spreadsheet?

Solution

  • When the script deployed as "Web app" is bound to the spreadsheet, you can use the jsdoc @OnlyCurrentDoc to limit the permissions to 1 spreadsheet. You can also manually adjust the permissions/oauth scopes in the manifest.