Google Drive Storage Integration

🔒 Pro feature — requires the Pro plugin.

Store staff compliance documents and evidence files in your organisation’s own Google Drive instead of on the WordPress server.

What it is and who it’s for

By default, Attestation Core keeps every uploaded certificate, licence and evidence file in a private folder on your web server. That suits most sites. Some organisations would rather keep compliance files in Google Workspace: they already manage records there, their hosting has little disk space, or their auditors expect files in a Shared Drive.

The Google Drive integration adds Google Drive as a second storage backend. Staff still upload through the same staff portal pages and administrators still upload from the admin screens. The plugin sends each new file to Google Drive and remembers where it went. When someone opens the file later, the plugin fetches it from Drive and passes it to their browser. WordPress permissions still decide who can open which file.

This page is for site administrators who set up storage. Staff members don’t need to do anything differently.

Where to find it

Attestation Core → Settings → Storage. The top half of the tab is the free storage settings. The Google Drive (Pro) panel sits below them. You need the plugin’s manage settings permission, which administrators have by default.

In the free plugin (or when no Pro licence is active), the Storage tab says “Google Shared Drive storage is available in Attestation Core Pro.” and offers only the private media directory.

How it works

• New uploads go to Google Drive only when Google Drive is your preferred backend and the connection status is Connected. Otherwise they go to local private storage.
• Existing files stay where they are. Switching backends doesn’t move anything. Files already stored locally keep opening from local storage, and files already in Drive keep opening from Drive, whichever backend is currently preferred.
• Per-person folders. Inside the folder you choose, the plugin creates one subfolder for each staff member, named with their first name, last name and profile number, for example Jane Smith (42). If the subfolder can’t be created (for example, a permissions problem on a Shared Drive), the file goes into your chosen folder instead so the upload isn’t blocked.
• Deleting a document in Attestation Core also deletes the matching file from Google Drive. This is best effort: if the file has already gone from Drive, the plugin carries on.
• File rules are the same on both backends: PDF, JPG, PNG, DOC and DOCX only, up to 25 MB, and the file’s content must match its extension.

Before you start

You need:

• A Google account with Google Drive. A Google Workspace account with a Shared Drive is recommended, so files belong to the organisation and not one person.
• A Google Cloud project with the Google Drive API enabled.
• An OAuth 2.0 client of type Web application, with its Client ID and Client secret.
• An administrator login to WordPress.

Setting it up

Step 1: Create Google Cloud credentials

1. Open Attestation Core → Settings → Storage and scroll to Google Drive (Pro). Copy the URL shown under Authorised redirect URI. It ends in admin-post.php?action=attestation_core_pro_gdrive_oauth_callback.
2. In the Google Cloud Console, create a project (or choose one) and enable the Google Drive API.
3. Go to APIs & Services → Credentials → Create credentials → OAuth client ID and choose Web application.
4. Paste the redirect URI from step 1 into Authorised redirect URIs, exactly as shown.
5. Copy the Client ID and Client secret that Google gives you.

Step 2: Choose the destination folder (optional)

Open the Drive folder where documents should go (for example, a folder inside your organisation’s Shared Drive). Copy the ID from the end of the folder’s web address: https://drive.google.com/drive/folders/THIS-PART.

If you leave the folder ID blank, files are placed in the top level of the connected Google account’s own Drive.

Step 3: Save your credentials

In the Step 1 — Google Cloud credentials form:

1. Paste the Client ID and Client secret.
2. Paste the Drive folder ID (optional).
3. Choose a Google Drive filename mode (see the settings table below).
4. Click Save credentials.

Step 4: Connect

1. Under Step 2 — Authorise access, click Connect Google Drive.
2. Google asks you to sign in. Use the account that has access to the destination folder, then approve the request.
3. You come back to the Storage tab with “Google Drive connected successfully.” and Connection status: ✓ Connected.

The plugin only asks for Google’s limited “files created or opened by this app” permission. It can’t browse the rest of your Drive.

Step 5: Choose Google Drive as the preferred backend

New uploads go to Drive only when the Preferred backend on the Storage tab is set to Google Drive.

Known limitation in version 1.0.0: in this release, the Preferred backend list on the Storage tab shows only Private media directory (default). Google Drive isn’t offered there yet, so connecting Drive alone doesn’t send new uploads to Drive. Contact Dantian Health support if you need Google Drive switched on for your site before the selector is added.

Step 6: Test

Upload a test document to a test staff profile. In Google Drive, check that a subfolder named after that person has appeared in your chosen folder and that the file is inside it. Then open the document from Attestation Core to confirm the download works.

Settings

Setting (UI label)	What it does	Default	Allowed values
Preferred backend	Where new uploads are stored	Private media directory	Private media directory (Google Drive isn’t selectable in 1.0.0; see Step 5)
Active backend (read-only)	Shows the backend that new uploads are actually using right now: private-media or google-drive	private-media	Read-only
Authorised redirect URI (read-only)	The address you paste into Google Cloud Console	Your site’s callback address	Read-only
Client ID	Your OAuth client’s ID	Blank	Text
Client secret	Your OAuth client’s secret. It is never shown again after saving. Leave it blank to keep the saved value.	Blank	Text
Drive folder ID	The folder that receives the per-person subfolders	Blank (top level of the connected account’s Drive)	A Drive folder ID
Google Drive filename mode	How files are named in Drive. Anonymized (recommended) gives each file a random name such as attestation-core-k3J9x2Lm0QaB.pdf. Readable uses the person’s name with the document type and expiry date (documents) or the activity title and date (evidence).	Anonymized	Anonymized, Readable
Connection status	Connected or Not connected. Shows Connect Google Drive or Disconnect Google Drive.	Not connected	Read-only

Credentials in wp-config.php. For extra protection, your host or developer can define ATTESTATION_CORE_GDRIVE_CLIENT_ID and ATTESTATION_CORE_GDRIVE_CLIENT_SECRET in wp-config.php. The fields then become read-only with a 🔒 note, and the values aren’t stored in the database.

Encryption at rest. The client secret and the Google access and refresh tokens are encrypted before they are saved. By default, the encryption key is generated and kept in the database. The Encryption at rest row on the Storage tab recommends defining ATTESTATION_CORE_PRO_SECRET_KEY in wp-config.php so the key is kept outside the database. That row disappears once the constant is set.

When Drive is unavailable

If Google Drive is your preferred backend but isn’t connected (for example, someone clicked Disconnect, or the stored tokens were cleared), the plugin doesn’t stop uploads. New uploads are saved to local private storage, and every user with the manage settings permission sees this warning on every admin screen:

Attestation Core: Google Drive is selected as your document storage backend, but it is not connected. New uploads are being saved to local private storage until you reconnect Drive. Review storage settings

The warning clears as soon as Drive reconnects or you choose a different backend. Files saved locally during the outage stay local. They aren’t moved to Drive later.

If Drive is connected but Google refuses an upload (for example, a network error or a full Drive), the upload fails and the person sees an error. Ask them to try again later.

Permissions

• Only users with the manage settings permission (administrators by default) can save credentials, connect or disconnect Drive.
• The OAuth return step checks that the same WordPress user who started the connection is the one who finishes it.
• Staff never see Google Drive. They open files through the plugin’s protected download links, and WordPress decides whether they may open each file.

Data that leaves your site

When Google Drive storage is in use, the following is sent to Google:

• File contents of every new document and evidence upload.
• File names: random in Anonymized mode. In Readable mode they include the person’s name, the document type or activity title, and dates.
• Folder names: each person’s first and last name and profile number, in both filename modes, because these name the per-person subfolders.
• Authentication traffic: your Client ID and secret, and the access and refresh tokens, sent to Google’s sign-in service when connecting and when tokens are refreshed.

Downloads go through your site: the plugin asks Google for the file and passes it to the user. Record Google Drive as a data processor in your privacy policy, and use a Workspace account and Shared Drive that your organisation controls. Google’s privacy policy: https://policies.google.com/privacy.

Disconnecting and licence changes

• Disconnect Google Drive clears the stored tokens and marks the connection as Not connected. Your Client ID, secret and folder ID are kept so you can reconnect quickly. To withdraw access completely, also remove the app from the Google account’s security settings.
• Files already in Drive stay in Drive. Disconnecting or uninstalling the plugin doesn’t delete them.
• Deleting the Attestation Core plugin always removes the saved Google Drive credentials and tokens, whatever the Erase all data on uninstall setting. To use Drive again after reinstalling, enter the credentials and connect again.
• The plugin can only fetch Drive-stored files while Pro is active and licensed. If the licence lapses beyond its 7-day grace period, new uploads go to local storage, and files already in Drive stay in your Drive but can’t be opened from inside Attestation Core until you reactivate.

Troubleshooting

Problem	Likely cause and fix
“Google API client ID is not configured.” when you click Connect	Save the Client ID (Step 3) before clicking Connect Google Drive.
“Google Drive access was denied.”	Someone clicked Cancel on Google’s consent screen. Click Connect Google Drive again and approve.
“OAuth state verification failed. Please try connecting again.” or “OAuth session mismatch…”	The connection link expired or another user finished the sign-in. Start again from the Storage tab, logged in as the same administrator throughout.
Google shows a redirect_uri_mismatch error	The redirect URI in Google Cloud Console doesn’t exactly match the one on the Storage tab (check http/https and www). Copy it again.
Files land in the main folder instead of a per-person subfolder	Google refused the subfolder lookup or creation (common with Shared Drive permissions). Check the connecting account can create folders in the destination folder.
Warning banner says uploads are going to local storage	Drive is selected but not connected. Reconnect from the Storage tab.

Worked example

Northside Allied Health Clinic runs Google Workspace and keeps HR records in a Shared Drive called People & Compliance. The practice manager makes a folder there called Attestation Core uploads and copies its ID. In Google Cloud Console she creates a Web-application OAuth client, pastes the redirect URI from the Storage tab, and saves the Client ID and secret in the plugin. She leaves Anonymized filenames on, because file names in Drive are visible to everyone with access to the Shared Drive. She clicks Connect Google Drive and signs in with the shared compliance@ account. After Google Drive becomes the preferred backend for the site, a physiotherapist uploads her First Aid certificate through My Documents. A folder Priya Natarajan (17) appears in the Shared Drive with a randomly named PDF inside. The practice manager opens it from the Documents screen as usual.

Related: Document management · Settings reference