Reduce permissions required by KeePassium for Google Drive

[GabrielSandor]

What can be improved?
I have a password vault stored in Google Drive which I access through KeePassium. When i connected KeePassium to it, it requested the full set of permissions on my Google Drive, which i'm a little uncomfortable with. There doesn't seem to be a choice in selecting a subset of them.

The solution you'd like
Would it be possible to limit the required permissions to just read and edit a file (the kdbx password vault)?

[keepassium]

Hmm, interesting, it seems this is actually possible now.

There are three relevant security scopes in Google Drive API:

• drive - full access to all the files. This is the one on your screenshot.
• drive.appfolder — fewer permissions, access restricted to app-specific folder. Added to KeePassium in 2025 (Security concern/risk: Keepassium requests too many privileges (full access) in OneDrive #285)
• drive.file — minimal permissions, access to a single, user-selected file.

That last one is interesting. Clearly, it is the most appropriate for KeePassium's use case, so it was the obvious candidate. Unfortunately, it was documented as "JavaScript API", required using a Google JS library and was limited to web apps. There was no way to use it in a native iOS app.

This was the case just a few months ago.

As I was looking for links to explain this and close the issue — well, it seems Google fixed this. Now there is a dedicated page on how to integrate Google Picker into mobile apps. No need for JavaScript or libraries, file picker is now part of the OAuth dialog.

Sounds great, will do!