The Docs API sits on the same Google Cloud OAuth stack as Drive. Service accounts work for org-owned templates; end-user OAuth is needed when you mutate a person’s private doc or shared drive they administer.

  • Request `documents` readonly vs readwrite scopes deliberately; justify each to security review.
  • Store refresh tokens encrypted; rotate client secrets with a break-glass procedure.
  • Log Doc IDs and revision metadata for audits—not full body content unless required.

Pair Docs automation with SQL or NoSQL persistence so generated links and template IDs are not orphaned in config files.