如需定义授予应用的访问权限级别，您需要确定并声明授权范围。授权范围是一个 OAuth 2.0 URI 字符串，其中包含 Google Workspace 应用名称、应用访问的数据类型以及访问权限级别。范围是您的应用对使用 Google Workspace 数据（包括用户的 Google 账号数据）的请求。
[null,null,["最后更新时间 (UTC)：2025-08-29。"],[],[],null,["# Choose Google Drive Labels API scopes\n\nThis document contains Drive Labels API-specific authorization and\nauthentication information. Before reading this document, be sure to read the\nGoogle Workspace's general authentication and authorization information at\n[Learn about authentication and authorization](/workspace/guides/auth-overview).\n\nConfigure OAuth 2.0 for authorization\n-------------------------------------\n\n[Configure the OAuth consent screen and choose scopes](/workspace/guides/configure-oauth-consent)\nto define what information is displayed to users and app reviewers, and register\nyour app so that you can publish it later.\n\nGoogle Drive Labels API scopes\n------------------------------\n\nTo define the level of access granted to your app, you need to identify and\ndeclare *authorization scopes*. An authorization scope is an OAuth 2.0 URI string\nthat contains the Google Workspace app name, what kind of data it accesses, and\nthe level of access. Scopes are your app's requests to work with Google Workspace data, including\nusers' Google Account data.\n\n\nWhen your app is installed, a user is asked to validate the scopes used\nby the app. Generally, you should choose the most narrowly focused scope\npossible and avoid requesting scopes that your app doesn't require. Users more\nreadily grant access to limited, clearly described scopes.\n\nWhen possible, we recommend using non-sensitive scopes as it grants per-file\naccess scope and narrows access to specific functionality needed by an app.\n\n\u003cbr /\u003e\n\n| If your public application uses scopes that permit access to certain user data, it must complete a verification process. If you see **unverified\n| app** on the screen when testing your application, you must submit a verification request to remove it. Find out more about [unverified apps](https://support.google.com/cloud/answer/7454865) and get answers to [frequently asked questions about app verification](https://support.google.com/cloud/answer/9110914) in the Help Center.\n\nThe following OAuth 2.0 scopes can be used to read, search, and modify label\nmetadata applied Drive items:\n\n| Scope | Meaning |\n|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|\n| - `https://www.googleapis.com/auth/drive` - `https://www.googleapis.com/auth/drive.file` - `https://www.googleapis.com/auth/drive.metadata` | Read, search, and modify label metadata applied to Drive items. |\n| - `https://www.googleapis.com/auth/drive.readonly` - `https://www.googleapis.com/auth/drive.metadata.readonly` | Read and search label metadata applied to Drive items authorized for the application. |\n\nFor more information, see [Drive API OAuth 2.0\nScopes](/identity/protocols/oauth2/scopes#drive)\nand [Drive API-specific\nauthorization](/workspace/drive/api/guides/api-specific-auth).\n\n### Scopes for labels\n\nThe following OAuth scopes can be used to view and manage labels:\n\n| Scope | Meaning |\n|---------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `https://www.googleapis.com/auth/drive.labels` | View, use, and manage Drive labels. - This scope allows user access, and is required for write operations when `use_admin_access` is not set. - Write operations with this scope are valid for labels with the `SHARED` [label type](/workspace/drive/labels/guides/overview#label-type). |\n| `https://www.googleapis.com/auth/drive.labels.readonly` | View and use Drive labels. - This scope allows user access, and is required for read operations when `use_admin_access` is not set. |\n| `https://www.googleapis.com/auth/drive.admin.labels` | View, edit, create, and delete all Drive labels in your organization, and view your organization's label-related administration policies. - This scope allows admin access, and is required for write operations when `use_admin_access` is set. This scope also grants read access. - Write operations with this scope are valid for labels with the `SHARED` or `ADMIN` [label type](/workspace/drive/labels/guides/overview#label-type). |\n| `https://www.googleapis.com/auth/drive.admin.labels.readonly` | View all Drive labels and label-related administration policies in your organization. - This scope allows admin access, and is required for read operations when `use_admin_access` is set. |\n\nAdministrator access\n--------------------\n\n| **Note:** The `EDITOR` [`LabelRole`](/workspace/drive/labels/reference/rest/v2/labels.permissions#labelrole) can't be used with `ADMIN` labels. Administrator privileges are required to manage `ADMIN` labels.\n\nTo manage `ADMIN` labels, you must specify:\n\n- `useAdminAccess` is `true` to use the user's administrator credentials.\n- Account administrators with the [Manage Labels](https://support.google.com/a/answer/1219251#drive_and_docs) privilege.\n\n### `useAdminAccess`\n\nAdministrators must set the `useAdminAccess` parameter to invoke their admin\nprivileges. Setting `useAdminAccess` allows viewing and editing of any label\nowned by a customer. This includes both `ADMIN` and `SHARED` Labels.\n\nWhen `useAdminAccess` is not set, write requests are allowed only for labels\nwith both a `SHARED` [`label type`](/workspace/drive/labels/guides/overview#label-type)\nand for users with the appropriate `EDITOR` role for this label.\n\nFor more information, see [Create access\ncredentials](/workspace/guides/create-credentials)."]]
