Use Google Drive API v3 permissions.create to programmatically share files and folders with users, groups, or domains. The key gotcha: always pass supportsAllDrives=true for Shared Drives or you get 404s. The drive.file scope only sees app-created files — you need the Restricted drive scope to share files the user already owns. Watch for the separate sharingRateLimitExceeded 403 error that has a stricter limit than the standard quota.
| Fact | Value |
|---|---|
| Platform | Google Drive |
| Rate limits | 1,000,000 quota units/min per project (new model, May 2026); 325,000 per… |
| Difficulty | Intermediate |
| Time required | 45–90 minutes |
| Last updated | May 2026 |
API Quick Reference
1,000,000 quota units/min per project (new model, May 2026); 325,000 per user/min
REST only
Google Drive API v3 — File Permissions
Google Drive API v3 provides programmatic control over file sharing through the permissions resource. You can grant access to individual users (by email), groups, domains, or make files publicly accessible. The API supports roles including owner, organizer, fileOrganizer, writer, commenter, and reader. Files created by your app use the Non-sensitive drive.file scope, but managing files the user already owns requires the Restricted drive scope which needs a CASA security audit. Shared Drives require the supportsAllDrives=true query parameter on every single request — omitting it returns 404 as if the file doesn't exist.
https://www.googleapis.com/drive/v3Authentication
Key endpoints
Grant access to a file or folder. The core sharing endpoint. For Shared Drives, always append ?supportsAllDrives=true.
List files matching a query. Use to find files before sharing or to verify what the app can see. With drive.file scope, only returns files your app created.
List all existing permissions on a file or folder. Use before creating a permission to avoid duplicates, or to audit current access.
Revoke access for a specific permission. You need the permission ID from permissions.list, not the email address.
Move a file to a folder by updating its parents. Used to organize files after creation before sharing.
Step-by-step automation
Step 1: Set Up Authentication
Configure OAuth 2.0 credentials and initialize the Drive API client. Choose drive.file scope if your app creates the files, or drive scope if sharing pre-existing user files.
1# First, exchange auth code for tokens (one-time setup)2curl -X POST https://oauth2.googleapis.com/token \3 -H 'Content-Type: application/x-www-form-urlencoded' \4 -d 'code=AUTH_CODE&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&redirect_uri=YOUR_REDIRECT_URI&grant_type=authorization_code'56# Response contains access_token and refresh_token7# Store the refresh_token securely for future useStep 2: Find Files to Share
List files matching your criteria before sharing. With drive.file scope you only see app-created files. With drive scope you can search all files.
1# List files in a specific folder2curl -H 'Authorization: Bearer ACCESS_TOKEN' \3 'https://www.googleapis.com/drive/v3/files?q=%27FOLDER_ID%27+in+parents+and+trashed%3Dfalse&fields=files(id%2Cname%2CmimeType)&pageSize=100'45# List all PDFs owned by the user6curl -H 'Authorization: Bearer ACCESS_TOKEN' \7 'https://www.googleapis.com/drive/v3/files?q=mimeType%3D%27application%2Fpdf%27+and+%27me%27+in+owners+and+trashed%3Dfalse&fields=files(id%2Cname)&pageSize=100'Step 3: Create Permission with Retry Logic
Share a file with a specific user. Implement retry logic specifically for sharingRateLimitExceeded — this 403 error has a stricter limit than the standard quota and requires a delay before retrying.
1# Share a file with a user as writer2curl -X POST \3 -H 'Authorization: Bearer ACCESS_TOKEN' \4 -H 'Content-Type: application/json' \5 'https://www.googleapis.com/drive/v3/files/FILE_ID/permissions?supportsAllDrives=true&sendNotificationEmail=true' \6 -d '{7 "role": "writer",8 "type": "user",9 "emailAddress": "alice@example.com"10 }'1112# Make a folder readable by anyone with the link13curl -X POST \14 -H 'Authorization: Bearer ACCESS_TOKEN' \15 -H 'Content-Type: application/json' \16 'https://www.googleapis.com/drive/v3/files/FOLDER_ID/permissions?supportsAllDrives=true' \17 -d '{18 "role": "reader",19 "type": "anyone"20 }'Step 4: Bulk Share a Folder for New Team Members
Automate onboarding by sharing a set of folders with a new user. Add a delay between permission creates to respect the stricter sharing rate limit.
1# Batch sharing script — share multiple folders with one user2# Note: no native batch for permissions, do sequential with delays3for FOLDER_ID in 'folder1' 'folder2' 'folder3'; do4 curl -X POST \5 -H 'Authorization: Bearer ACCESS_TOKEN' \6 -H 'Content-Type: application/json' \7 "https://www.googleapis.com/drive/v3/files/${FOLDER_ID}/permissions?supportsAllDrives=true&sendNotificationEmail=false" \8 -d '{"role": "writer", "type": "user", "emailAddress": "newteammember@example.com"}'9 sleep 2 # Respect sharing rate limit10doneStep 5: Revoke Access When User Leaves
Remove a specific user's access to files by finding their permission IDs and deleting them. You need the permissionId (not email) for the delete call.
1# First list permissions to find the permission ID for alice@example.com2curl -H 'Authorization: Bearer ACCESS_TOKEN' \3 'https://www.googleapis.com/drive/v3/files/FILE_ID/permissions?supportsAllDrives=true&fields=permissions(id%2CemailAddress%2Crole)'45# Then delete using the permission ID (not the email address)6curl -X DELETE \7 -H 'Authorization: Bearer ACCESS_TOKEN' \8 'https://www.googleapis.com/drive/v3/files/FILE_ID/permissions/PERMISSION_ID?supportsAllDrives=true'Complete working code
Complete automated client portal setup: creates a folder, uploads a welcome document, shares it with a new client, and logs the action. Includes retry logic for sharing rate limits.
Error handling
You're creating permissions too quickly. This is a separate, stricter rate limit that applies specifically to sharing operations — it is NOT the same as the standard quota rateLimitExceeded.
You're accessing a file in a Shared Drive without passing supportsAllDrives=true. The Drive API pretends the file doesn't exist rather than returning a permission error.
Your app is using drive.file scope but trying to share a file it didn't create. The drive.file scope is per-file and only covers files your app created or the user explicitly opened via the Picker.
The permission body has an invalid combination. Common causes: setting role=owner without transferOwnership=true, using type=anyone with a role above reader/commenter (domain policy may restrict this), or providing an emailAddress when type=domain.
The Google account has run out of Drive storage. Free accounts get 15 GB shared across Gmail, Drive, and Photos.
Rate limits & throttling
Security checklist
- Never use drive scope in production unless you have completed the OAuth verification and CASA security audit — use drive.file for app-created files
- Never share files with role=anyone unless you explicitly intend public access — verify the type field before every permissions.create call
- Validate email addresses before sharing — sharing with a typo'd email silently creates a permission that can be claimed by whoever registers that email
- For Workspace accounts, check if your admin has disabled external sharing before attempting to share with external emails — the API will return 403 with a domain policy reason
- Store OAuth tokens encrypted at rest — token files contain refresh tokens that provide permanent access until revoked
- Audit permissions periodically: use permissions.list to check what access exists and revoke any permissions that are no longer needed
- For Service Account + DWD automation, restrict the Service Account to the minimum required scope in the Admin Console
- Log all sharing actions with timestamps and user emails for compliance and audit trails
Automation use cases
No-code alternatives
Don't want to write code? These platforms can automate the same workflows visually.
Zapier
Google Drive integration supports creating permissions via 'Create Permission' action. Connect to any trigger (new Typeform submission, new Salesforce contact) to automate sharing. No code required but limited to simpler permission patterns.
Make (Integromat)
Offers Google Drive 'Share a File/Folder' module. Supports multi-step scenarios: watch for trigger, create folder, share it, log to Airtable. More flexible than Zapier for complex workflows.
n8n
Google Drive node supports permissions. Being self-hosted and code-capable, you can add custom retry logic in Function nodes. Best no-code option for handling edge cases.
Best practices
- Always pass supportsAllDrives=true on every Drive API call that might involve Shared Drive files — make it a default parameter in your helper functions
- Separate sharing into smaller batches with delays instead of firing all permission creates concurrently — the sharingRateLimitExceeded limit hits before the main quota
- Use drive.file scope and create files through your app when possible — this avoids needing the Restricted drive scope and its OAuth audit requirements
- Prefer folder-level sharing over file-level sharing: share the parent folder once rather than each file individually, both for cleaner permissions and fewer API calls
- Store permission IDs (not emails) when you need to revoke later — the delete endpoint requires the ID, not the email address
- Include the fields parameter on all responses to avoid fetching unnecessary data and reduce quota consumption
- Implement idempotency: before sharing, check if the permission already exists with permissions.list to avoid duplicate permission errors and unnecessary API calls
- For DWD Service Accounts, add quotaUser parameter to distribute quota per impersonated user rather than burning all quota on the service account identity
Ask AI to help
Copy one of these prompts to get a personalized, working implementation.
I'm building a Google Drive file sharing automation using Drive API v3. I need to: (1) share a folder with multiple users, (2) handle the sharingRateLimitExceeded 403 error which is separate from the regular quota limit, (3) support both My Drive and Shared Drives with supportsAllDrives=true. Use Python with google-api-python-client. The scope is drive.file since my app creates the files. Include retry logic with exponential backoff.
Create a web UI for Google Drive file sharing automation. I need a form where I can enter: folder ID, email addresses (multiple), role (writer/reader/commenter), and click 'Share'. The backend should call Drive API v3 permissions.create with proper error handling for sharingRateLimitExceeded. Show progress for bulk sharing operations and log results to a table. Use Supabase to store sharing logs.
Frequently asked questions
Why do I get a 404 error when trying to share a file in a Shared Drive?
You're missing supportsAllDrives=true on the request. Shared Drive files return 404 (not a permission error) when this parameter is absent. Add supportsAllDrives=true to every Drive API call that might touch Shared Drive files — permissions.create, files.get, files.list, and files.update all need it.
What is the difference between sharingRateLimitExceeded and rateLimitExceeded?
These are two separate limits. rateLimitExceeded is the standard quota limit (1,000,000 units/min per project). sharingRateLimitExceeded is a stricter limit specifically for permission creation operations — it can trigger even when you have plenty of quota remaining. Handle them separately in your error logic, and use delays between sharing operations proactively, not just on error.
Can a service account share files without user impersonation?
Service accounts cannot own files on My Drive (they have no storage). They can create files on Shared Drives, and they can share those files. For My Drive operations, you must use Service Account + Domain-Wide Delegation to impersonate a real user. The service account then acts as that user and shares from the user's context.
What is the difference between drive.file scope and drive scope?
drive.file is Non-sensitive and only shows files your app created OR that the user explicitly opened via the Google Picker UI. It cannot list or access files the user already owns unless they opened them through your app. drive is Restricted and can see everything the user owns — but it requires OAuth verification and a CASA security audit, which is a multi-week process.
How do I share a folder so all files inside it are automatically shared too?
In Google Drive, permissions are inherited: sharing a folder gives access to all its current and future contents. Call permissions.create once on the folder with the desired role, and the grantee gets access to everything inside. You do NOT need to share each file individually. This is the recommended approach — both for cleaner permission management and fewer API calls.
Can RapidDev help set up a Google Drive sharing automation for my business?
Yes. If you need a complete onboarding automation — creating client folders, uploading documents, and sharing them automatically when a contract is signed — RapidDev can build this end-to-end. We handle the OAuth setup, Shared Drive configuration, and rate limit management so you don't have to.
How do I revoke access for a user who is leaving the company?
You cannot revoke by email directly. First call permissions.list on the file or folder to get the permission ID for that user's email address, then call permissions.delete with that permission ID. If you need to revoke access across many files, you'll need to iterate through all files, list permissions on each, find the matching permission by email, and delete it — there is no bulk revocation endpoint.
Need this automated?
Our team has built 600+ apps with API automations. We can build this for you.
Book a free consultation