Browse docs

Personal drives

Your personal Google Drive or OneDrive.

Who can see it Partial
Works with Personal Google Drive · Personal OneDrive
Set up in console

What it scans

Files in your personal Google My Drive or personal Microsoft OneDrive. Google Docs/Slides export as text; Sheets export as CSV. An optional folder narrows the scan. Work/school accounts use the Workspace or Microsoft 365 guides.

What you need

Your own agent, personal provider account and OAuth app you control. Myrikeep does not register the app or receive its credentials. Both request account-wide read-only permissions. A folder limits scanning but does not narrow the OAuth grant.

Alternative: a folder you already sync

App passwords do not work for Google Drive or OneDrive files; those services only accept a sign-in (OAuth). If you already sync your drive to a computer or NAS (Google Drive for desktop, the OneDrive app, rclone, Synology Cloud Sync, TrueNAS cloud sync), you can skip the OAuth app: mount that synced folder into the agent read-only and add a Local/NFS mount connection for it (see Local, NFS and SMB mounts).

Synced folder OAuth sign-in (below)
Finds sensitive files Yes Yes
Shows public links and outside sharing No (a local copy has no sharing information) Yes
Setup Mount a folder Create your own OAuth app once, sign in on the agent

Step 1: Create your Google app

  1. Open Google Cloud Console, select the project menu, then New project. Give it a name you recognize.
  2. In APIs & Services → Library, find Google Drive API and enable it.
  3. Open Google Auth Platform (older consoles call it OAuth consent screen). Set the app name, your support email and developer contact email. Select External audience. While the publishing status is Testing, add your own Google account under Test users. Under Data Access, add https://www.googleapis.com/auth/drive.readonly.
  4. For your ongoing personal use, change the audience's publishing status to In production, then sign in again to obtain a new refresh token. This avoids the Testing-mode seven-day limit; tokens can still expire or be revoked.
  5. A personal-use app with fewer than 100 users can be used without verification. Expect Google's Google hasn't verified this app warning because you have not submitted your own app for review. Check that the displayed app is yours, then use Advanced → Go to your app if offered. Do not publish this client for general distribution. Myrikeep requires no Google verification process.
  6. Under Clients → Create client (or Credentials → Create credentials → OAuth client ID), choose Desktop app. Copy its client ID and client secret into a local file as below. If you download JSON, extract these two fields from its installed object; do not paste the whole download.

Official references: enable APIs, desktop OAuth and PKCE, refresh token expiration, personal-use verification exemption, Drive read-only scope.

Step 2: Create your Microsoft app

  1. Open Microsoft Entra admin center. Select Entra ID → App registrations → New registration. Registration uses an Entra directory; you may need to set one up first. Microsoft's current quickstart requires an Azure account with an active subscription and links to a free-account signup. You do not need a paid Entra feature for this flow; free-account eligibility and directory creation can vary by account.
  2. Enter a name and choose Personal Microsoft accounts only under supported account types. Register, then copy Application (client) ID from Overview.
  3. Under Authentication → Advanced settings, set Allow public client flows to Yes and save. Device authorization is a public-client flow; no client secret or redirect URI is needed.
  4. Under API permissions → Add a permission → Microsoft Graph → Delegated permissions, add Files.Read.All. Remove unneeded default permissions such as User.Read. Do not add application permissions or write permissions. The agent also requests offline_access so it can refresh your sign-in.
  5. Make the local client file described below, containing only client_id.

Official references: register an app and account types, public client configuration, device authorization, Files.Read.All.

Step 3: Prepare credentials and sign in

Create and mount the client files and catalog in Secret file below first. Keep the existing writable agent state volume for refresh tokens.

Replace <agent> with the running container's name. The distributed image's actual binary is datagate-crawler:

sh
docker exec -it <agent> datagate-crawler signin PERSONAL_GOOGLE
docker exec -it <agent> datagate-crawler signin PERSONAL_MICROSOFT

For a source-runtime image, use docker exec -it <agent> python -m crawler signin PERSONAL_GOOGLE (or PERSONAL_MICROSOFT). For a local checkout:

sh
python -m crawler signin PERSONAL_GOOGLE
python -m crawler signin PERSONAL_MICROSOFT

Google: open the printed authorization URL in any browser and approve read-only Drive access. Copy the full redirected http://127.0.0.1:<port>/... address back into the terminal. Input is hidden. On another computer, or outside the container, the final page may say it cannot connect: copy that address anyway. The CLI validates its origin and state; it does not fetch your pasted URL. A bare authorization code also works through the same session's PKCE verifier, but the full URL includes the state check and is preferred. This uses a Desktop loopback redirect, not Google's retired out-of-band redirect.

Microsoft: open the printed verification URL, enter the short code, and sign in to your personal Microsoft account. The CLI waits for authorization, then saves the refresh token. It uses the consumers authority; work/school sign-in is not the purpose of this connector.

Step 4: Connect and scan

In Connections, select Google Drive (personal account) or OneDrive (personal Microsoft account), assign your agent, choose Local credential catalog, and enter PERSONAL_GOOGLE or PERSONAL_MICROSOFT as the credential name. Google accepts an optional folder ID from its folder URL, or root (the default). OneDrive accepts an optional path under root, such as Documents/Taxes, without a leading slash or ...

Connection settings table

Console field Example Required or optional
Connection name Personal taxes Required; unique in workspace
Type gdrive_personal or onedrive_personal Required
Google folder ID (Google) root or ID after /folders/ in its URL Optional; default My Drive root
Root folder path (OneDrive) Documents/Taxes Optional; relative to drive root, no leading slash or ..
Agent Home agent Required; same workspace
Credential mode Local credential catalog Required
Credential name PERSONAL_GOOGLE or PERSONAL_MICROSOFT Required; must match sign-in alias
Exclude patterns (View/edit) *.tmp Optional; one glob per line
Enabled (connection row) Enabled Disable to stop new scans

Secret file

On the agent host, create /srv/myrikeep/secrets and the files below. Replace placeholders locally. Make files owned by the agent UID (the image uses 10001) or root and readable by the agent, with mode 0400/0600, or 0440 with a dedicated group. Do not put secrets into the console or connection config.

/srv/myrikeep/secrets/personal-google.json:

json
{"client_id": "<YOUR_DESKTOP_CLIENT_ID>", "client_secret": "<YOUR_DESKTOP_CLIENT_SECRET>"}

/srv/myrikeep/secrets/personal-microsoft.json:

json
{"client_id": "<YOUR_APPLICATION_CLIENT_ID>"}

Merge entries into /srv/myrikeep/secrets/myrikeep-credentials.json:

json
{
  "version": 1,
  "credentials": {
    "PERSONAL_GOOGLE": {
      "type": "gdrive_personal",
      "source": {"kind": "file_json", "path": "/run/secrets/personal-google.json"}
    },
    "PERSONAL_MICROSOFT": {
      "type": "onedrive_personal",
      "source": {"kind": "file_json", "path": "/run/secrets/personal-microsoft.json"}
    }
  }
}

Include only the entries you use. Mount that directory read-only in the agent's Docker run command (recreate the container if adding a mount):

sh
--mount type=bind,src=/srv/myrikeep/secrets,dst=/run/secrets,readonly

Keep the existing writable state volume at /var/lib/myrikeep. Refresh tokens are written there, one oauth-<CREDENTIAL_NAME>.json file per name, with mode 0600 and atomic replacement on rotation. They are never written into the secret mount, logged or uploaded. Access tokens exist only in memory. Protect and retain the state volume; losing it requires sign-in again. A source checkout can set DG_AGENT_STATE_DIR to a private writable directory. Use the same directory for sign-in and the running agent.

Scope, exclusions and schedules

Google scans My Drive descendants, excluding Shared with me, shared drives and shortcuts. A folder must have a verifiable parent chain to My Drive. OneDrive scans the signed-in user's /me/drive beneath the configured path. Globs such as *.tmp, ~$* or *.bak in Connections → View/edit match item names, not full folder paths. Case matters. See Getting started for schedule cadence. Do not run two agents against the same token state volume.

"Who can see it" support

Both inspect sharing permissions for public links and outside grants. Google owner-complete narrow evidence may be restricted. OneDrive permission views remain partial; no broad signal means unknown rather than restricted. No group membership expansion occurs. Both use modification time for age review. Google viewed-by-me timestamps describe only that caller. A synced folder has no cloud sharing evidence. See Who can see it.

Troubleshooting

State or error What to do
unknown Check fresh heartbeat, assignment and current connection revision.
missing / credential_missing Check catalog alias/type and secret mount. Outages can prevent presence checks without deleting a usable refresh token.
Invalid / credential_config_invalid Use exact client fields, permitted file modes and mounted path. Extract Google's two fields from installed.
signin_required / Sign-in required Run sign-in again after revoked/expired/missing refresh tokens, changed OAuth apps or lost state volume.
present Token readiness passed; selected folder and file permissions still need a scan.
Google Testing token expires after seven days Switch your own app to In production, then sign in again. Tokens can still expire or be revoked.
Unverified app warning Verify the displayed app is your own before continuing.
Redirect page cannot connect Copy its complete loopback URL into the same running CLI session, as in Step 3.
source_error / access denied / item gone Inspect local diagnostics; check folder ID/path, read permission and API enablement. Google needs a My Drive parent chain.
Sharing access_denied / unknown Review read-only metadata permission and rescan; missing evidence never proves restriction.
Paused / Migration paused / Disabled Resume agent, assign and save valid connection, or enable it.

To disconnect, revoke your app's consent in the provider account and disable the console connection. Reconnecting then requires a new sign-in.

Limits

No writes, app-password authentication, group expansion or all-account search. Google excludes shared drives, Shared with me and shortcuts. OneDrive skips cross-drive/package items. Walks have item, depth, response and time budgets. Classification uses bounded samples/exports. Common text, PDF text and modern Office have parsers; other formats use strings-only checks. Text in images and scanned PDFs needs OCR, an optional premium feature a workspace owner enables; it runs inside your agent with the OCR agent image. Inspect Coverage for skips. API/auth hosts are fixed; bearer tokens are not forwarded to redirected download hosts. Processing and optional AI assist follow the security explanation.