What is the drive.file scope?

The drive.file scope is a Google OAuth permission that gives an app access only to the specific Google Drive files the user has opened or picked with that app, plus files the app itself created. An app with drive.file cannot list, read, or search the rest of your Drive. It is Google's recommended scope for Drive integrations, and the narrowest one that still lets an app read and modify files.

Google's scope tiers, in one minute

When a third-party app asks to connect to your Google account, what it can do is defined by OAuth scopes. Google classifies them in three tiers:

• Non-sensitive scopes grant narrow access. drive.file sits here: per-file, user-granted, invisible beyond what you hand over. The consent screen for it is correspondingly mild.
• Sensitive scopes grant broader access to user data and require extra app verification by Google.
• Restricted scopes are the broadest. The full drive scope — read and write access to all files in your Drive — is in this tier, and apps requesting it go through Google's most demanding review, including independent security assessment requirements.

In practice you can read an app's reach straight off its consent screen: "See and manage all of your Drive files" means the full scope; per-file wording means drive.file.

How per-file access works in practice

With drive.file, the handover happens through the Google Drive picker — the standard file-selection dialog. You pick three folders of scans; the app gains access to those, and only those. Files it creates (a sorted copy, an export) it can also touch. Everything else in your Drive doesn't exist as far as the app is concerned, even after you've used it for months.

This is why the scope matters as trust content, not just as a technical detail. An AI file organizer for Google Drive must, by definition, read your documents to classify them. The scope determines the blast radius of that trust: with drive.file you're trusting the app with the batch you picked, not with your tax returns, payslips, and ten years of photos. Sorters is built on drive.file for exactly this reason — it sorts the files you select in the picker and can't see anything else. We read your files to classify them. Nothing is kept after the file is sorted: no copies, no logs of content.

When apps legitimately need the full scope

The full drive scope isn't a red flag by itself — it's a trade-off. A duplicate finder has to compare every file against every other; a whole-Drive backup tool has to read everything; a storage analyzer has to list it all. None of those jobs are possible per-file. The question to ask is whether the app's job actually requires whole-Drive visibility. A tool that sorts the files you give it doesn't; a tool that scans for what you didn't give it does.

Related

See how to auto-sort files in Google Drive for what sorting under a per-file permission looks like in practice, and AI file organizer for what these tools do with the access once granted.