How to Integrate Lovable with Google Docs

Go to console.cloud.google.com and select or create a Google Cloud project. Navigate to APIs & Services → Library and enable two APIs: search for 'Google Docs API' and enable it, then search for 'Google Drive API' and enable it — the Drive API is needed to copy template documents and set sharing permissions. With both APIs enabled, navigate to APIs & Services → Credentials and click 'Create Credentials → Service account'. Name the service account (e.g., 'lovable-docs-generator'), give it a description, and click 'Done'. Do not assign a project-level role unless your Drive files are shared via Google Workspace domain. After creating the service account, click on it in the credentials list, go to the 'Keys' tab, click 'Add Key → Create new key', select JSON format, and download the key file. The JSON file contains a private_key (multi-line RSA private key), client_email (the service account's email address), and project_id. You need both the private_key and client_email for authentication. Now share your Google Doc template with the service account email — open the template document in Google Drive, click 'Share', enter the service account email (it looks like name@project-id.iam.gserviceaccount.com), and give it 'Viewer' or 'Editor' access. The service account can now copy this document and create new documents in drives it has access to.

In your Lovable project, open the Cloud tab by clicking '+' next to the Preview panel, then navigate to the Secrets section. Add two secrets for the Google service account authentication. Add GOOGLE_SERVICE_ACCOUNT_EMAIL with the service account email address from the JSON key file (the client_email value, which ends with .iam.gserviceaccount.com). Add GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY with the private key value from the JSON file (the private_key value — the entire string including the -----BEGIN RSA PRIVATE KEY----- header and -----END RSA PRIVATE KEY----- footer, with all \n characters preserved as literal backslash-n sequences). Do not add actual newlines — store the key as a single-line string with escaped newlines. Also add GOOGLE_DOCS_TEMPLATE_ID with the document ID of your Google Doc template (the alphanumeric string from the document URL between /d/ and /edit). These three secrets provide everything the Edge Function needs: the service account identity, its signing key for JWT creation, and the template to copy from. Lovable's SOC 2 Type II certified Cloud Secrets store protects the private key — arguably the most sensitive credential in this integration — from any exposure. Never paste the private key into Lovable's chat, which is visible in the prompt history.

Ask Lovable to create a Supabase Edge Function called google-docs-api that implements Google service account authentication using JWT. Service account authentication works by creating a JSON Web Token (JWT) signed with the service account's RSA private key, then exchanging it for an OAuth2 access token at Google's token endpoint. The JWT payload must include iss (the service account email), scope (space-separated list of required API scopes: https://www.googleapis.com/auth/documents and https://www.googleapis.com/auth/drive), aud (https://oauth2.googleapis.com/token), iat (current Unix timestamp), and exp (iat + 3600). Sign the JWT with the private key using RS256 algorithm. Exchange this JWT for an access token by POSTing to https://oauth2.googleapis.com/token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and the JWT as the assertion. Cache the resulting access token for 55 minutes. With the access token, the function can copy a template using POST to https://www.googleapis.com/drive/v3/files/{templateId}/copy and apply batch updates using POST to https://docs.googleapis.com/v1/documents/{docId}:batchUpdate. The batch update with replaceAllText requests replaces placeholder tokens throughout the document with actual values.

1import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
2import { encode as base64url } from "https://deno.land/std@0.168.0/encoding/base64url.ts";
3
4const corsHeaders = {
5  "Access-Control-Allow-Origin": "*",
6  "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
7};
8
9let tokenCache: { token: string; expiry: number } | null = null;
10
11async function getAccessToken(): Promise<string> {
12  if (tokenCache && Date.now() < tokenCache.expiry) return tokenCache.token;
13
14  const email = Deno.env.get("GOOGLE_SERVICE_ACCOUNT_EMAIL")!;
15  const rawKey = Deno.env.get("GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY")!;
16  const privateKeyPem = rawKey.replace(/\\n/g, "\n");
17
18  const header = { alg: "RS256", typ: "JWT" };
19  const now = Math.floor(Date.now() / 1000);
20  const payload = {
21    iss: email,
22    scope: "https://www.googleapis.com/auth/documents https://www.googleapis.com/auth/drive",
23    aud: "https://oauth2.googleapis.com/token",
24    iat: now,
25    exp: now + 3600,
26  };
27
28  const enc = new TextEncoder();
29  const headerB64 = base64url(enc.encode(JSON.stringify(header)));
30  const payloadB64 = base64url(enc.encode(JSON.stringify(payload)));
31  const signingInput = `${headerB64}.${payloadB64}`;
32
33  // Import the RSA private key
34  const pemBody = privateKeyPem.replace(/-----BEGIN[^-]+-----/g, "").replace(/-----END[^-]+-----/g, "").replace(/\s/g, "");
35  const keyBytes = Uint8Array.from(atob(pemBody), c => c.charCodeAt(0));
36  const cryptoKey = await crypto.subtle.importKey(
37    "pkcs8", keyBytes.buffer,
38    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
39    false, ["sign"]
40  );
41
42  const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", cryptoKey, enc.encode(signingInput));
43  const sigB64 = base64url(new Uint8Array(signature));
44  const jwt = `${signingInput}.${sigB64}`;
45
46  const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
47    method: "POST",
48    headers: { "Content-Type": "application/x-www-form-urlencoded" },
49    body: new URLSearchParams({
50      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
51      assertion: jwt,
52    }),
53  });
54
55  const tokenData = await tokenRes.json();
56  if (!tokenData.access_token) throw new Error(tokenData.error_description || "Token exchange failed");
57
58  tokenCache = { token: tokenData.access_token, expiry: Date.now() + 55 * 60 * 1000 };
59  return tokenCache.token;
60}
61
62serve(async (req) => {
63  if (req.method === "OPTIONS") return new Response("ok", { headers: corsHeaders });
64
65  try {
66    const accessToken = await getAccessToken();
67    const templateId = Deno.env.get("GOOGLE_DOCS_TEMPLATE_ID");
68    const { command, title, documentId, replacements } = await req.json();
69
70    let result: unknown;
71
72    if (command === "copy_template") {
73      const copyRes = await fetch(
74        `https://www.googleapis.com/drive/v3/files/${templateId}/copy`,
75        {
76          method: "POST",
77          headers: { "Authorization": `Bearer ${accessToken}`, "Content-Type": "application/json" },
78          body: JSON.stringify({ name: title || "Generated Document" }),
79        }
80      );
81      result = await copyRes.json();
82    } else if (command === "batch_update" && documentId && replacements) {
83      const requests = Object.entries(replacements as Record<string, string>).map(([key, value]) => ({
84        replaceAllText: {
85          containsText: { text: `{{${key}}}`, matchCase: false },
86          replaceText: value,
87        },
88      }));
89      const updateRes = await fetch(
90        `https://docs.googleapis.com/v1/documents/${documentId}:batchUpdate`,
91        {
92          method: "POST",
93          headers: { "Authorization": `Bearer ${accessToken}`, "Content-Type": "application/json" },
94          body: JSON.stringify({ requests }),
95        }
96      );
97      result = await updateRes.json();
98    } else {
99      throw new Error("Unknown command or missing parameters");
100    }
101
102    return new Response(JSON.stringify(result), {
103      headers: { ...corsHeaders, "Content-Type": "application/json" },
104    });
105  } catch (error) {
106    return new Response(
107      JSON.stringify({ error: error.message }),
108      { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } }
109    );
110  }
111});

With the Edge Function working, ask Lovable to build a document generation form. The workflow is: user fills in a form → form submits to the Edge Function → function copies the template → function applies replaceAllText batch updates → function returns the Google Docs URL → application displays the link. The form fields should correspond to the placeholder tokens in your template. For an invoice template with {{client_name}}, {{invoice_date}}, {{total_amount}}, and {{line_items}}, the form needs corresponding inputs. When the form submits, first call the Edge Function with command 'copy_template' to get a new document ID, then immediately call again with command 'batch_update' passing the document ID and a replacements object mapping token names to values. The replacements object format is { client_name: 'Acme Corp', invoice_date: '2026-03-30', total_amount: '$1,500.00', line_items: 'Design services: $1,500.00' }. After successful generation, display the Google Docs URL as a link and save the document metadata to your Supabase table. Add a loading state between form submission and URL display since the document generation involves two API calls and may take a few seconds.