Google Cloud Storage

The Google Cloud Storage node moves files between your workflow's storage and Google Cloud Storage (GCS) buckets. Cloud Storage is Google Cloud's object store for unstructured data — documents, exports, images, backups, and any other file-based payload. Use this node to upload a file produced earlier in a workflow into a bucket, or to retrieve an existing object from a bucket so a downstream node can act on it.

Overview

The Google Cloud Storage node is essential when you need to:

• Upload files to a bucket - Push a file from workflow storage into a Google Cloud Storage bucket, optionally inside a folder prefix
• Retrieve files from a bucket - Download an existing object from a bucket into workflow storage for downstream processing
• Archive workflow output - Persist documents, exports, or generated artifacts to durable cloud object storage
• Bridge GCS with other systems - Stage a downloaded object for delivery over FTP/AS2/email, or load an uploaded object into another service

Configuration

Authentication

How the node authenticates to Google Cloud Storage. This selection also determines which credential the node requires.

Option	Value	Credential used
OAuth2 (default)	oAuth2	Google Cloud Storage OAuth2 API
Service Account	serviceAccount	Google API

Resource

The resource to operate on.

• Files (files, default) - The only resource. All actions operate on objects (files) within a bucket.

Action

The operation to perform. Shown for the Files resource.

Option	Value	Description
Upload a file (default)	uploadFile	Upload a file to Google Cloud
Get a file	getFile	Retrieve a file from Google Cloud

Bucket ID (both actions)

The Google Cloud Storage bucket to upload to or read from. Supports expressions.

Folder (Action = Upload a file)

An optional folder/path prefix within the bucket to place the uploaded object under. Supports expressions. When left empty, the file is written at the root of the bucket. A trailing slash is added automatically, so both reports and reports/ behave the same.

File (Action = Upload a file)

The path, in workflow storage, of the file to upload. Required. Supports expressions — typically the output of an upstream node that produced or downloaded the file. The object is stored in the bucket under the file's base name (combined with Folder when set).

Object ID (Action = Get a file)

The Google Cloud Storage object ID (the object's full key within the bucket) to retrieve. Required. Supports expressions.

Credential

The node requires one of two credentials, depending on the Authentication setting.

OAuth2 — Google Cloud Storage OAuth2 API (googleCloudStorageOAuth2)

Used when Authentication is OAuth2. This credential is an OAuth2 client; it carries a fixed Cloud Storage scope and inherits the standard Google OAuth2 endpoints, so you only supply the client credentials:

Field	Required	Description
Client ID	Yes	OAuth2 client ID from your Google Cloud project.
Client Secret	Yes	OAuth2 client secret.
Scope	No (preset)	Hidden/preset to the Cloud Storage scopes (devstorage.full_control, devstorage.read_write, devstorage.read_only, and cloud-platform).

The authorization URL (https://accounts.google.com/o/oauth2/v2/auth), token URL (https://oauth2.googleapis.com/token), and offline/consent query parameters are preset by the credential, so the standard Google consent flow issues a refresh token the node uses to obtain access tokens.

Service Account — Google API (googleApi)

Used when Authentication is Service Account:

Field	Required	Description
Service Account Email	Yes	The service account's email address.
Private Key	Yes	The service account's private key.
Impersonate a User	No	When enabled, the service account impersonates a user via domain-wide delegation.
Email	No	The user email to impersonate (used when Impersonate a User is enabled).

The node looks up the configured credential by ID at run time for the tenant; if no credential is configured or the lookup fails, the run errors before any Cloud Storage call is made.

Output

Get a file

The node downloads the object from the bucket and writes it into workflow storage under the object's base file name, then returns the storage path string of the written file. Downstream nodes reference this path to read the retrieved file:

"<execution>/<task>/<fileName>"

Upload a file

The node reads the source file from workflow storage and uploads it to the bucket under the resolved key (folder prefix + base file name), then returns the result of the upload call. Branch on success in a downstream node rather than assuming the object was created.

Example Usage & Common Use Cases

Upload a generated report to a bucket

[Generate report] → [Google Cloud Storage]

Google Cloud Storage:
  Authentication: OAuth2
  Resource: Files
  Action: Upload a file
  Bucket ID: acme-exports
  Folder: daily-reports
  File: {{ steps.generateReport.output }}
  Credential: Acme → GCS OAuth2

Result: object daily-reports/<fileName> created in acme-exports

Retrieve an object then deliver it over FTP

[Google Cloud Storage] → [FTP: upload]

Google Cloud Storage:
  Authentication: Service Account
  Resource: Files
  Action: Get a file
  Bucket ID: acme-inbound
  Object ID: partners/order-12345.xml
  Credential: Acme → GCS Service Account

Output: "<execution>/<task>/order-12345.xml"   (storage path for the next node)

Archive a downloaded document

[HTTP Request: download PDF] → [Google Cloud Storage: Upload]

Google Cloud Storage:
  Action: Upload a file
  Bucket ID: acme-archive
  Folder: invoices/2026
  File: {{ steps.download.output }}

How It Works

1. Validate the request - The handler confirms that parameters and a credential ID are present; if either is missing it throws before contacting Google Cloud Storage.
2. Look up the credential - The configured credential is resolved by tenant and credential ID. If it cannot be found, the run fails with Credential [<id>] not found.
3. Resolve the source / target -
   • Upload: the File path is resolved against workflow storage — paths beginning with trigger are used as-is, otherwise the path is scoped to the current execution (<execution>/<File>). The file's bytes are read from storage, and the object key is built from the Folder prefix plus the file's base name.
   • Get: the Object ID is used directly as the object key within the bucket.
4. Authenticate - The node initializes its Google Cloud Storage client with the selected Authentication method (OAuth2 access token or service-account key) and the resolved credential.
5. Transfer the object -
   • Upload: the file content is uploaded to the Bucket ID under the resolved key.
   • Get: the object is downloaded from the Bucket ID by Object ID.
6. Return - Upload returns the upload result; Get writes the downloaded bytes to workflow storage under the object's base name and returns that storage path for downstream nodes.

Best Practices

• Match authentication to the use case - Use Service Account for unattended server-to-server workflows; use OAuth2 when access should be tied to a specific Google user's consent.
• Grant least-privilege bucket access - The service account or OAuth client only needs read access for Get a file and write access for Upload a file; scope IAM roles on the bucket accordingly.
• Use the Folder prefix for organization - Group uploads under a path prefix (e.g. daily-reports/, invoices/2026/) rather than writing everything to the bucket root.
• Pass storage paths between nodes - For Get a file, hand the returned storage path to the next node (FTP, AS2, email, etc.) rather than hardcoding a path.
• Confirm the object exists for Get - Supply the exact Object ID (full key); GCS object IDs are case-sensitive and include any folder prefix.

Troubleshooting

Common Issues

• "Error: No parameters found" - The node ran without configuration parameters; confirm the node is configured.
• "Error: No credential specified" - No credential was attached to the node; select a Google Cloud Storage OAuth2 or Google API credential matching the chosen Authentication.
• "Credential [<id>] not found" - The attached credential could not be resolved for the tenant; re-select or re-create the credential.
• Authentication / permission errors from Google - The OAuth client or service account lacks access to the bucket, the token expired, or the service-account key is invalid. Verify IAM roles on the bucket and that the credential's client/key are correct and current.
• Object not found on Get - The Object ID does not match an object in the bucket. Confirm the full key, including any folder prefix, and that Bucket ID is correct.

Debugging Tips

• Verify the credential first - Confirm the selected credential matches the Authentication method (OAuth2 ↔ Google Cloud Storage OAuth2 API, Service Account ↔ Google API).
• Check the resolved File path - For uploads, ensure the File value points at an existing file in workflow storage (the output of the upstream node).
• Confirm bucket and key - Cross-check Bucket ID and Object ID against the bucket in the Google Cloud console.

Related

• HTTP Request - For Google Cloud APIs beyond object upload/download
• FTP - Deliver a retrieved object to a remote server
• Set - Build or reshape the path/parameters passed into the node
• Send Email - Attach or reference a retrieved object in an email