One Connection to Your Spreadsheets for Every Automation

Context

Every small business automation eventually touches a spreadsheet. It is where the lead list lives, where the schedule lives, where the numbers someone actually looks at live.

The usual result is that each script grows its own copy of the same 60 lines: a service account file, a credentials path, a token refresh, a retry, and a slightly different way of opening a worksheet. Five automations means five copies, five places a credential can leak, and five things to fix when Google changes something.

That duplication is not a tidiness problem. It is a security surface and a maintenance bill.

The approach

One service owns the credential; consumers own none. Spreadsheet access was extracted into a standalone server that any project connects to over HTTP. Consumer projects hold no service-account JSON, no token cache and no refresh logic.

A multi-tier credential strategy, so it works in every environment it has to. The server resolves credentials in order — an explicit service-account path, a standard environment variable, then Application Default Credentials from the local toolchain. A developer machine, a scheduled task and a cloud runtime each find what they need without a different code path.

A health endpoint that costs nothing. Checking the server is alive does not consume a Google API call. That matters more than it sounds: monitoring that burns quota is monitoring you switch off, and monitoring you switch off is how outages get discovered by customers.

Built on the Model Context Protocol, which means the same service is usable both by ordinary scripts and directly by AI assistants — without building a second interface for either.

Why this pattern generalises

The specific integration is Google Sheets. The pattern is the useful part, and it applies to any credentialed third-party service a business depends on:

• Credentials live in one place. Rotating a key is one change, not a search across repositories hoping you found every copy.
• Integration becomes connection. A new automation needing spreadsheet access asks the service; it does not re-solve authentication.
• Failure has one address. When the API changes, one server is wrong, not five scripts that each drifted differently.

Result

Projects that need spreadsheet access connect to one server rather than carrying their own authentication. Credentials sit in a single location with a documented resolution order that works unchanged from a laptop to a scheduled task to a cloud container.

For a small business, the value is plain: the second integration costs a fraction of the first, and the day you have to rotate a credential is an afternoon rather than an audit.