Check if Google Drive file is publicly accessible without authentication

Other Questions Google drive
1

I’m working on a PHP application where I need to verify whether a Google Drive file is publicly viewable using just the file ID. The challenge is that my application needs to work for users who aren’t logged into any Google account.

When I try using the standard Google Drive API, it always asks for authentication. But I want to create a feature that checks if a file is public or private without requiring the user to sign in.

My goal is to show users a message like “This image is private” when they try to access a non-public file, and display the content when it’s publicly shared.

Is there a way to accomplish this file visibility check in PHP without going through the OAuth process?

2

Here’s another reliable method: hit the Google Drive API’s files.get endpoint with supportsAllDrives=true but skip the auth headers. The API still responds for public files even without tokens. Just GET https://www.googleapis.com/drive/v3/files/FILE_ID?fields=id,name,permissions - public files return metadata, private ones throw 401/403 errors. Way better than parsing HTML since you get structured data and won’t break when Google tweaks their interface. Watch out for rate limiting though since you’re going in without proper credentials.

3

Tried this last week - just make a HEAD request to https://drive.google.com/uc?export=download&id=FILE_ID. Public files return content headers, private ones redirect to the login page. Way faster than GET since you’re not downloading anything, just checking if it’s accessible. Works perfectly for my image gallery.

4

You can check file accessibility with a simple HTTP request to the Google Drive URL - no authentication needed. I use https://drive.google.com/file/d/FILE_ID/view and check the response with PHP’s get_headers() or cURL. Public files return 200, private ones give 403 or redirect to login. Works great in my projects. The direct download format https://drive.google.com/uc?id=FILE_ID gives cleaner responses for programmatic checks. Just set proper timeouts and handle network errors since you’re hitting external endpoints.