I’m running into some confusion with OAuth scopes around Google Sheets and wanted to sanity check that I’m not missing something obvious.

My use case is pretty simple:

• I let users pick a Google Sheet from their own account (via the file picker).

• I only need access to the specific file(s) the user selects.

• I do not need access to all of their spreadsheets.

• I’m not trying to scan their Drive or read everything.

For Drive, there’s the drive.file scope, which is great because it limits access to files the user explicitly opens or creates with the app. That makes sense from a least-privilege standpoint and avoids requesting broad access.

But when it comes to the Sheets API, there doesn’t seem to be an equivalent like spreadsheets.file. The only option that actually allows reading/writing sheet content via the Sheets API is the full:

https://www.googleapis.com/auth/spreadsheets

Which gives access to all spreadsheets in the user’s Drive, not just the ones they picked.

So from what I can tell:

• drive.file → limited to user-selected files, but doesn’t fully cover Sheets API usage

• spreadsheets → required for Sheets API, but grants access to all spreadsheets

This feels like it forces developers to request broader access than necessary, even for very narrow use cases.

Am I misunderstanding how drive.file works with the Sheets API?
Is there any supported pattern to restrict Sheets API access to only user-selected spreadsheets?
Or is full spreadsheets scope currently the only option?

If the last one is true (and my understanding so far), is there a channel/board where one could submit this request to introduce such new scope?

Just trying to follow least-privilege best practices and avoid asking for more access than needed.