Create a Google Cloud Project for Google Drive

What you need

A Google account whose Drive will hold the backup.
Permission to create or select a Google Cloud project.
Watermelon Backup for iOS. Its Bundle ID is exactly com.zizicici.watermelon.
About five minutes for a Testing setup. Long-lived External/Production access also needs a public HTTPS homepage and privacy policy on a domain you own and can verify.
No paid Google Cloud service, API key, service account, client secret, downloaded credentials.json, Firebase project, or manually created Drive folder is part of this flow.

Open Google Cloud Console: New project.
Use a dedicated project name such as Watermelon Backup so the OAuth audience, quota, and credentials are not mixed with another app.
Select Create, wait for the project to be created, then make sure the new project is selected in the project picker.
Watermelon Backup never asks for the generated project ID.

Open Google Drive API in the API Library.
Confirm the project selector is still on the project from the previous step.
Select Enable.
Only Google Drive API is required. Drive Activity API, Drive Labels API, Google Picker API, API keys, and service accounts are not required.

Open Google Auth Platform: Branding. If Google says the Auth Platform is not configured, select Get started.
Use a recognizable app name, such as Watermelon Backup, and choose a user support email and contact email you can receive.
An app logo is unnecessary for a personal project. Adding a logo or public branding can trigger brand verification.
Before publishing an External app to Production, add a public HTTPS homepage and privacy policy in App Domain. The homepage should identify the OAuth app, explain that it provides a personal Google Drive connection for Watermelon Backup, and not be only a sign-in page.
Add the registrable domain under Authorized domains and verify ownership in Google Search Console with a Google account that owns or edits the Cloud project.

Open Audience. Choose Internal only for a Google Workspace organization where every user belongs to that organization. Otherwise choose External.
For External while in Testing, add the exact Google account under Test users.
For long-term background backups, publish the External app to Production after completing Google's public homepage, privacy policy, and authorized-domain requirements. If Watermelon Backup was authorized while the project was still in Testing, reconnect the Google Drive Node once after publishing.
Publishing status and OAuth verification are separate. These Drive scopes are non-sensitive, but External production apps still need the required public pages, authorized domain, and accurate branding.

Open Google Auth Platform: Data Access.
Select Add or remove scopes. If a scope is not shown, use Manually add scopes.
Add openid for Google account identity.
Add https://www.googleapis.com/auth/userinfo.email for the authorized account email. Watermelon Backup requests the equivalent OpenID Connect shorthand email; Google may already list this identity scope by default.
Add https://www.googleapis.com/auth/drive.file so Watermelon Backup can create and manage files associated with this OAuth app.
Add https://www.googleapis.com/auth/drive.appdata for small hidden lock-control records.
Do not add whole-Drive scopes such as https://www.googleapis.com/auth/drive or drive.readonly.

Open Google Auth Platform: Clients.
Select Create client.
For Application type, choose iOS.
Use a Console-only name such as Watermelon iOS.
Enter the Bundle ID exactly as com.zizicici.watermelon.
Leave App Store ID and Team ID blank unless Google explicitly requires them in your project.
Create the client. If Google shows Firebase App Check on the created client's edit page, leave it disabled and do not enforce it.
Copy only the Client ID. It must end with .apps.googleusercontent.com.
Keep this Client ID with the Node setup. A second device, reinstall, or restored Watermelon Backup database should reuse the same Google Cloud project, iOS Client ID, and Google account to reconnect to the same repository identity.

In Watermelon Backup, choose Add Google Drive.
Paste the Client ID into OAuth client ID. Do not paste a project ID, numeric project number, client secret, or JSON configuration.
Tap Sign in with Google and use an allowed account.
Approve all requested access and do not deselect either Drive permission.
Return to Watermelon Backup and wait while it creates or reconciles the Watermelon Backup repository in My Drive, stores hidden lock records in Drive App Data, verifies write access, and then lets you save the Node.

Access blocked or account not allowed: add the exact Google account under Audience > Test users, or ask the Workspace administrator to allow the OAuth client.
Authorization does not return to Watermelon Backup: confirm the client type is iOS and the Bundle ID is exactly com.zizicici.watermelon.
Drive API disabled or 403: enable Google Drive API for the same project and confirm drive.file, drive.appdata, and the identity scopes are configured under Data Access.
It asks to sign in again after about seven days: publish the External app to Production, then reconnect the Google Drive Node once.
App Check error: disable enforcement for the iOS OAuth client. Enabling monitoring alone does not block OAuth, but enforcement can.
deleted_client or invalid_client: the OAuth client was deleted, copied incorrectly, or belongs to another app type. Restore it in Google Cloud if available, or create a new iOS client and reconnect the Node.
Google account third-party access revocation invalidates the saved refresh token. Google can also delete OAuth clients that stay unused for six months; normal Watermelon Backup token refreshes count as token use.

Install Watermelon Backup from the App Store to follow this guide on iPhone.