A script’s ability to read a spreadsheet depends on its execution identity, authorization, and target file. The account currently viewing the sheet may not be the account running an automated trigger.
Identify how the script runs
Distinguish a manual editor run, a simple trigger, an installable trigger, and a deployed web app. Google documents different identity and authorization behavior for these contexts.
An installable trigger runs as its creator. A simple trigger has authorization restrictions and cannot freely access other private files. A successful manual run does not prove the scheduled path has the same access.
Check the exact target and scopes
Confirm the spreadsheet ID and whether the code relies on an active document context. An explicit openById call still requires the executing identity to have appropriate file access and authorization.
Review the requested OAuth scopes and any explicit manifest configuration. If approved code adds a new service, the responsible user may need to authorize the new scope through the normal process.
Verify with a limited read
Test a small non-sensitive range under the intended execution path and inspect the exact error. Record target identity, run context, and result without logging private cell contents.
Do not make the file public, share passwords, or grant unnecessary broad permissions as a diagnostic shortcut. Respect administrator restrictions and review unfamiliar code before granting access. If a trigger owner left the organization or lost source access, repair the ownership and authorization design explicitly. A working interactive read establishes only that tested path, not every future execution context.
References
- Authorization for Google Services | Apps Script | Google for Developers
- Simple Triggers | Apps Script | Google for Developers
- Installable Triggers | Apps Script | Google for Developers
- Class SpreadsheetApp | Apps Script | Google for Developers
Reviewed against the linked official product guidance on November 3, 2026. Features, limits, screen labels, and access can vary by account, platform, region, and organization policy.