Google Cloud setup
Create an OAuth 2.0 Web application, enable the Google Sheets API and Google Drive API, and add the exact TALA Flow callback URL configured by the deployment.
OneTALA environment
Configure the client ID, client secret, and redirect URI as protected environment variables. The redirect URI must match the Google Cloud console exactly, including scheme, host, path, and trailing-slash behaviour.
Security
Limit OAuth consent and scopes to the intended use case, revoke unused connections, and do not place the client secret in frontend JavaScript.