Crossdrive — Setup
Everything that can be checked automatically passes.
- passCROSSDRIVE_BASE_URL is set — public https URL of this deployment, no trailing slash (on Vercel it defaults to the production domain)
- passCROSSDRIVE_JWT_SECRET is set — 32+ random bytes, base64; signs every OAuth artefact
- passCROSSDRIVE_ENC_KEY is set — exactly 32 random bytes, base64; encrypts stored refresh tokens
- passCROSSDRIVE_ALLOWED_EMAILS is set — comma-separated Google e-mails allowed to sign in
- passGOOGLE_CLIENT_ID is set — Google OAuth web client
- passGOOGLE_CLIENT_SECRET is set — Google OAuth web client
- passBLOB_READ_WRITE_TOKEN is set — set by attaching a private Vercel Blob store
- checkCROSSDRIVE_STATIC_TOKENS is set — Optional: optional full-access bearer tokens for clients without OAuth
- checkCROSSDRIVE_READONLY_TOKENS is set — Optional: optional read-only bearer tokens
- passCROSSDRIVE_JWT_SECRET decodes to at least 32 bytes
- passCROSSDRIVE_ENC_KEY decodes to exactly 32 bytes
- passBlob store attached (accounts persist)
- passGoogle OAuth client configured
- passCROSSDRIVE_BASE_URL matches the address you opened this page on
- passAt least one allowed sign-in e-mail
- passAt least one account connected (on /connect)
- checkGoogle OAuth consent screen is published to Production (or Internal for a Workspace-only setup) — In Testing mode Google expires refresh tokens after 7 days and every account has to be reconnected.
- checkBoth redirect URIs below are listed under the OAuth client's Authorized redirect URIs
Google Cloud redirect URIs
Paste both into the OAuth client (type: Web application) under Authorized redirect URIs:
https://drive.compasscto.com/oauth/google-callbackhttps://drive.compasscto.com/api/google/callback
Next, on /connect: sign in to manage this instance, then connect each cloud account under a label (signing in alone connects nothing). MCP clients connect to https://drive.compasscto.com/api/mcp.