---
title: Add a Google Drive source
slug: '1531'
canonical_url: https://docs.coveo.com/en/1531/
collection: index-content
source_format: adoc
---
# Add a Google Drive source

You can add the content of your domain's Google Drives to a [Coveo organization](https://docs.coveo.com/en/185/) by creating a Google Drive [source](https://docs.coveo.com/en/246/).

You can configure a Google Drive source to index only _My Drive_ content, both _My Drive_ and _Shared drives_ content, or only content from _Shared drives_.
See [how to index content from shared drives](#index-content-of-shared-drives).

Google Drive can store large volumes of content.
Follow our [leading practices](https://docs.coveo.com/en/o8ra8064/) to optimize indexing speed and enhance the relevance of search results.

> **Note**
>
> When using the Coveo [quickview](https://docs.coveo.com/en/3311/) component in search results, users won't be able to preview files over 50 MB that aren't native to Google Drive, such as `.pdf` or `.xls`.
> Your source enforces this limit to reduce indexing times.
> However, your source still indexes the [item](https://docs.coveo.com/en/210/), and users can click the search result to access the item in Google Drive.

## Source key characteristics

The following table presents the main characteristics of a Google Drive source.

[%header,cols="2,3,2,3"]
|===
2+|Features
^|Supported
|Additional information

2+|Google Drive version
^|Latest cloud version
|Following available Google Drive releases

2+|Indexable content
^|Files and folders
|

.3+|[Content update operations](https://docs.coveo.com/en/2039/)
|[refresh](https://docs.coveo.com/en/2710/)
^|[check]
|[Takes place every day by default](https://docs.coveo.com/en/1933/)

|[rescan](https://docs.coveo.com/en/2711/)
^|[check]
|

|[rebuild](https://docs.coveo.com/en/2712/)
^|[check]
|

.3+|[Content security](https://docs.coveo.com/en/1779/) options
|[Same users and groups as in your content system](https://docs.coveo.com/en/1779#same-users-and-groups-as-in-your-content-system)
^|[check]
|The findability of files shared by link depends on the file [link-sharing settings specified in Google Drive](#file-link-sharing-and-findability).

|[Specific users and groups](https://docs.coveo.com/en/1779#specific-users-and-groups)
^|[x]
|

|[Everyone](https://docs.coveo.com/en/1779#everyone)
^|[check]
|

.4+|[Metadata indexing for search](#index-metadata)
|Automatic mapping of [metadata](https://docs.coveo.com/en/218/) to [fields](https://docs.coveo.com/en/200/) that have the same name
2+a|This setting is disabled by default and [not recommended for this source type](https://docs.coveo.com/en/1640#about-the-performfieldmappingusingallorigins-setting).

|Automatically indexed [metadata](https://docs.coveo.com/en/218/)
2+a|Examples of [auto-populated default fields](https://docs.coveo.com/en/1833#field-origin) (no user-defined metadata required):  
  

* `author`

* `clickableuri`

* `date`

* `filetype`

* `gdfilecreateddate`

* `gdfilelastmodifyingusername`

* `indexeddate`

* `language` (auto-detected from item content)

* `title`  
 

After a content update, [inspect your item field values](https://docs.coveo.com/en/2053#inspect-search-results) in the **Content Browser**.

|Collected indexable metadata
2+a|The Google Drive source collects some of the [metadata that the Google Drive API](https://developers.google.com/drive/api/reference/rest/v3/files) makes available.  
  

After a rebuild, review the [**View and map metadata**](https://docs.coveo.com/en/m9ti0339#view-and-map-metadata-subpage) subpage for the list of indexed metadata, and [index additional metadata](https://docs.coveo.com/en/m9ti0339#index-metadata).

|Custom metadata extraction
2+a|Use the Google Drive API to [add custom file properties](https://developers.google.com/drive/api/guides/properties) and enable the [Custom properties](https://docs.coveo.com/en/1531#additional-content) option.
Then, your Google Drive source automatically extracts the properties as metadata during content update operations.
|===

## Prerequisites

Before you create a **Google Drive** source, you must:

. Ensure you have a Google account with administrator credentials.
Administrator privileges are required to create a Google Cloud Console project and service account, and to set up domain-wide delegation of authority to the service account. (The service account used by the Google Drive source will _not_ have administrator privileges. See [Authorize the service account)(https://docs.coveo.com/en/3369/) for more information.]

. [Create a Google Cloud Console project and service account](https://docs.coveo.com/en/3365/).

. [Authorize the service account](https://docs.coveo.com/en/3369/).

## Add a Google Drive source

Before you start, make sure you've [authorized your Coveo organization to access your users' Google Drive](#prerequisites).

Follow the instructions below to add a Google Drive source.

. On the [**Sources**](https://platform.cloud.coveo.com/admin/#/orgid/content/sources/) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/content/sources/)) page, click **Add source**.

. In the **Add a source of content** panel, click the **Google Drive** source tile.

. Configure your source.

> **Leading practice**
>
> It's best to create or edit your source in your sandbox organization first.
> Once you've confirmed that it indexes the desired content, you can copy your source configuration to your production organization, either [with a snapshot](https://docs.coveo.com/en/3239/) or manually.
> 
> See [About non-production organizations](https://docs.coveo.com/en/2959/) for more information and best practices regarding sandbox organizations.

### "Configuration" tab

In the **Add a Google Drive source** panel, the **Configuration** tab is selected by default.
It contains your source's general and authentication information, as well as other parameters.

#### "Identification" subtab

The **Identification** subtab contains general information about the source.

## Name

The source name.
It can't be modified once it's saved.

##### Name

Enter a name for your source.

> **Leading practice**
>
> A source name can't be modified once it's saved, therefore be sure to use a short and descriptive name, using letters, numbers, hyphens (`-`), and underscores (`_`). Avoid spaces and other special characters.

##### Project

Use the **Project** selector to associate your source with one or more Coveo [projects](https://docs.coveo.com/en/n7ef0517/).

#### "Content to index" subtab

The **Content to index** subtab lets you define the content that you want to make available as search results.

##### Content

Select **All users** or specify the users whose content you want to target.
Then, choose the types of drives to index for these users—whether individual user drives, shared drives, or both.

> **Tip**
>
> When indexing content from shared drives only, consider [using a dedicated user account and share the relevant shared drives](#index-content-of-shared-drives) with this account.

##### Exclusions and inclusions

Add exclusion and inclusion rules to crawl only specific items based on their URL.

![Exclusions and inclusions user interface screenshot | Coveo](https://docs.coveo.com/en/assets/images/index-content/exclusions-and-inclusions-spo.png)

The URLs to specify in exclusion and inclusion rules are unique to Coveo.
They aren't the ones you see in Google Drive.
The Coveo URL (that is, the [item URI](https://docs.coveo.com/en/1712#additional-details-tab)) begins with `googledrive://` and follows a pattern that includes references to:

* The user's email address (for _My Drive_ content)

* The Google shared drive ID (for _Shared drives_ content)

* The Google file ID.

The following are examples of Coveo URLs:

* `googledrive://source_17345/Root:GoogleDrive/User:msaunders@gd.abc.com/File:1xQ5E-mHczB-q2YHJU7cD-iDS2KWe5rU`

* `googledrive://source_17345/Root:GoogleDrive/SharedDrive:0AIzbK3jw1UPpUk9PVA/File:1jKgYruqAZqEsmHSGqk0Wml3M3wS3NSY1dMv5L9Es4vs`

The following diagram illustrates how the Google Drive [crawler](https://docs.coveo.com/en/2121/) applies the exclusion and inclusion rules.
This flow applies to all items, including the starting URLs.
You must therefore pay attention to not filter out your starting URLs.

![Crawling workflow diagram | Coveo](https://docs.coveo.com/en/assets/images/index-content/crawl-rules-flow.png)

> **About the "Include all non-excluded items" option**
>
> [.float-group]
> --
> ![Crawling flow with the all-inclusive inclusion rule | Coveo](:https://docs.coveo.com/en/assets/images/index-content/crawl-rules-flow-all-include.png)
> 
> The **Include all non-excluded items** option automatically adds an "include all" inclusion rule in the background.
> This ensures that all starting URLs meet the `Does URL match at least one inclusion rule?` condition and that all non-excluded items get crawled.
> 
> The following are common Google Drive source configuration patterns:
> 
> * When you don't want to exclude content on a URL basis, you don't add any exclusion rule and you use the default **Include all non-excluded items** inclusion option.
> 
> * When you want to exclude content on a URL basis, you add exclusion rules for the content to exclude and you use the default **Include all non-excluded items** inclusion option.
> 
> See [Exclusion and inclusion configuration examples](#exclusion-and-inclusion-configuration-examples).
> --

You can use any of the six types of rules:

* **is** and a URL that includes the protocol.
For example, `+https://myfood.com/+`.

* **contains** and a string found in the URL.
For example, `recipes`.

* **begins with** and a string found at the beginning of the URL and which includes the protocol.
For example, `+https://myfood+`.

* **ends with** and a string found at the end of the URL.
For example, `.pdf`.

* **matches wilcard rule** and a wildcard expression that matches the whole URL.
For example, `+https://myfood.com/recipes*+`.

* **matches regex rule** and a regex rule that matches the whole URL.
For example, `^.**(company-(dev|staging)).**html.?$`.

> **Tip**
>
> When using regex rules, make sure they match the desired URLs with a testing tool such as [Regex101](https://regex101.com/).

###### Exclusion and inclusion configuration examples

The following examples illustrate how to configure exclusion and inclusion rules for your source.

**Example 1: Excluding a specific shared drive**
<details><summary>Details</summary>

You're indexing shared drives but you want to exclude a specific one (for example, the `+https://drive.google.com/drive/folders/0AIzbK3jw1UPpUk9PVA+` shared drive).

**Possible solution**

* Exclusions: `SharedDrive:0AIzbK3jw1UPpUk9PVA` (type: `contains`)

* Inclusions: **Include all non-excluded items**

</details>

**Example 2: Excluding the My Drive content of a specific user**
<details><summary>Details</summary>

You're indexing the _My Drive_ content of [all users](#content) but you want to exclude user `msaunders@gd.abc.com`'s drive.

**Possible solution**

* Exclusions: `User:msaunders@gd.abc.com` (type: `contains`)

* Inclusions: **Include all non-excluded items**

</details>

**Example 3: Excluding a specific file**
<details><summary>Details</summary>

You want to prevent a specific file from being indexed.
For example, the file you would share via the `+https://docs.google.com/document/d/1jKgYruqAZqEsmHSGqk0Wml3M0wS3NSP1dMv5L9Es4vs/edit?usp=drive_link+` link.

**Possible solution**

* Exclusions: `File:1jKgYruqAZqEsmHSGqk0Wml3M0wS3NSP1dMv5L9Es4vs` (type: `contains`)

* Inclusions: **Include all non-excluded items**

</details>

##### Additional exclusions

###### Crawl folders as individual items

Select the **Exclude folders** option to index the files in folders but not the folders themselves.
If you don't exclude folders, your index will contain items that represent Google Drive folders.
If you don't select the **Exclude folders** option, your index will contain items that represent Google Drive folders.

###### Exclude MIME types

(Recommended) In the drop-down menu, select the [Google Drive supported MIME types](https://developers.google.com/drive/api/guides/mime-types) you want to exclude from indexing.

You can also add your own MIME types to the exclusion list.

###### Exclude older content

(Recommended) You can specify a time frame within which a file must have been created or modified to be indexed.
Use the two controls to specify the number of units and the time period respectively.

> **Note**
>
> During a content update operation, existing items that no longer meet the specified criteria are removed from the index.

##### Additional content

You can choose to index trashed items and [custom properties](https://developers.google.com/drive/api/guides/properties).

> **Note**
>
> Including custom properties significantly increases communication traffic between the source and the Google Drive.
> This, in turn, significantly increases indexing time.

#### "Authentication" subtab

Your Google Drive source must [authenticate](https://docs.coveo.com/en/2120/) to retrieve your Google Drive content.

##### Google Apps domain

Enter the Google Drive domain that you want to index.

##### Google Apps administrator account email

Enter the email of a Google Apps administrator account in the `user@company.com` format.

##### Google Service account email

Enter the Google service account email address that you obtained when you [authorized your Coveo organization to access your users' Google Drive](#prerequisites).

##### Private key file (.p12)

Click **Upload private key file**, and then select the private key file that you created when you [authorized your Coveo organization to access your users' Google Drive](#prerequisites).

### "Items" tab

On the **Items** tab, you can specify how the source handles items based on their file type or content type.

#### File types

File types let you define how the source handles [items](https://docs.coveo.com/en/210/) based on their file extension or content type.
For each file type, you can specify whether to index the item content and [metadata](https://docs.coveo.com/en/218/), only the item metadata, or neither.

You should fine-tune the file type configurations with the objective of indexing only the content that's relevant to your users.

**Example**

Your repository contains `.pdf` files, but you don't want them to appear in search results.
You click **Extensions** and then, for the `.pdf` extension, you change the **Default action** and **Action on error** values to `Ignore item`.

For more details about this feature, see [File type handling](https://docs.coveo.com/en/l3qg9275/).

#### Content and images

If you want Coveo to extract text from image files or PDF files containing images, enable the appropriate option.
The extracted text is processed as item data, meaning that it's fully searchable and will appear in the item [Quick view](https://docs.coveo.com/en/2760#search-result-quick-view).

> **Note**
>
> When OCR is enabled, ensure the source's relevant [file type configurations](https://docs.coveo.com/en/l3qg9275/) index the item content.
> Indexing the item's metadata only or ignoring the item will prevent OCR from being applied.

See [Enable optical character recognition](https://docs.coveo.com/en/2937/) for details on this feature.

### "Content security" tab

Select who will be able to access the source items through a Coveo-powered [search interface](https://docs.coveo.com/en/2741/).
For details on the content security options, see [Content security](https://docs.coveo.com/en/1779/).

> **Important**
>
> When using the **Everyone** content security option, see [Safely apply content filtering](#safe) for information on how to ensure that your source content is safely filtered and only accessible by intended users.

### "Access" tab







. On the **Access** tab, specify whether each group (and API key, if applicable) in your [Coveo organization](https://docs.coveo.com/en/185/) can view or edit the current source.

For example, when creating a new source, you could decide that members of Group A can edit its configuration, while Group B can only view it.

For more information, see [Custom access level](https://docs.coveo.com/en/3151#custom-access-level).
On the **Access** tab, specify whether each group (and API key, if applicable) in your [Coveo organization](https://docs.coveo.com/en/185/) can view or edit the current source.

For example, when creating a new source, you could decide that members of Group A can edit its configuration, while Group B can only view it.

For more information, see [Custom access level](https://docs.coveo.com/en/3151#custom-access-level).

### Build the source

. Finish adding or editing your source:

** When you're done editing the source and want to make your changes effective, click **Add and build source**/**Save and rebuild source**.

** When you want to save your source configuration changes without starting a build/rebuild, such as when you know you want to make other changes soon, click **Add source**/**Save**.
On the [**Sources**](https://platform.cloud.coveo.com/admin/#/orgid/content/sources/) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/content/sources/)) page, click **Launch build** or **Start required rebuild** when you're ready to make your changes effective and index your content.

> **Leading practice**
>
> By default, a Jira Software source indexes the entire Jira Software instance content.
> To index only certain projects, click **Save**, and then specify the desired address patterns in your [source JSON configuration](https://docs.coveo.com/en/1685/) before launching the initial build.
> See [Add source filters](https://docs.coveo.com/en/2006#add-source-filters) for further information.

. On the [**Sources**](https://platform.cloud.coveo.com/admin/#/orgid/content/sources/) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/content/sources/)) page, follow the progress of your source addition or modification.

. Once the source is built or rebuilt, [review its content in the Content Browser](https://docs.coveo.com/en/2053/).

. Optionally, consider [editing or adding mappings](https://docs.coveo.com/en/1640/).


> **Note**
>
> If you selected **Specific URLs** or **User profiles** in the [**Content**](https://docs.coveo.com/en/1739#content) section, some additional items will appear in the Content Browser.
> To retrieve user profiles, Coveo must crawl your SharePoint Online instance, including your host site collection and the documents it contains.
> Items encountered during this process are also retrieved and therefore appear in the Content Browser.

### Index metadata

To use [metadata](https://docs.coveo.com/en/218/) values in [search interface](https://docs.coveo.com/en/2741/) [facets](https://docs.coveo.com/en/198/) or result templates, the metadata must be [mapped](https://docs.coveo.com/en/217/) to [fields](https://docs.coveo.com/en/200/).
Coveo automatically [maps](https://docs.coveo.com/en/217/) only a subset of the metadata it extracts.
You must map any additional metadata to fields manually.

> **Note**
>
> Not clear on the purpose of indexing metadata?
> Watch [this video](https://www.youtube.com/watch?v=BmmmVJ3AWi0).

. On the [**Sources**](https://platform.cloud.coveo.com/admin/#/orgid/content/sources/) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/content/sources/)) page, click your source, and then click **More** > **View and map metadata** in the Action bar.

. Review the default [metadata](https://docs.coveo.com/en/218/) that your source is extracting from your content.

. Map any currently _not indexed_ metadata that you want to use in facets or result templates to fields.

.. Click the metadata and then, at the top right, click **Add to Index**.

.. In the **Apply a mapping on all item types of a source** panel, select the field you want to map the metadata to, or [add a new field](https://docs.coveo.com/en/1833#add-a-field) if none of the existing fields are appropriate.

> **Note**
>
> For advanced mapping configurations, like applying a mapping to a specific item type, see [Manage mappings](https://docs.coveo.com/en/1640#manage-mappings).

.. Click **Apply mapping**.

. Return to the [**Sources**](https://platform.cloud.coveo.com/admin/#/orgid/content/sources/) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/content/sources/)) page.

. To reindex your source with your new mappings, click your source, and then click **More** > **Rebuild** in the Action bar.

. Once the source is rebuilt, review your item field values.
They should now include the values of the metadata you selected to index.

.. On the [**Sources**](https://platform.cloud.coveo.com/admin/#/orgid/content/sources/) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/content/sources/)) page, click your source, and then click **More** > **Open in Content Browser** in the Action bar.

.. Select the card of the item for which you want to inspect properties, and then click **Properties** in the Action bar.

.. In the panel that appears, select the **Fields** tab.

. If needed, extract and map additional metadata.

**More on custom metadata extraction**
<details><summary>Details</summary>

The Google Drive API lets you add [custom properties](https://developers.google.com/workspace/drive/api/guides/properties) to your files and folders.
You can extract these custom properties as metadata by enabling the **Custom properties** option in the source configuration [**Additional content**](#additional-content) section.

Then, rebuild and map each extracted custom metadata to a field, as you did for the default metadata.

</details>

## Index content of shared drives

The Google Drive source's basic [content configurations](#content) allow you to index content from _Shared drives_ managed by your organization or domain users.

If you need to index content from multiple shared drives that aren't managed by the same user, configuring your source and maintaining control over the indexed content can become challenging.
A better approach is to create a dedicated user account in your Google Workspace domain and share the desired shared drives with this account.
The [Index handpicked shared drives only](https://docs.coveo.com/en/nceg8428/) article contains instructions on how to set this up.

## File link sharing and findability

A file is always indexed under its Google Drive owner with the permissions that the owner has set.

If your source content security setting is set to [**Same users and groups as in your content system**](https://docs.coveo.com/en/1779#same-users-and-groups-as-in-your-content-system), a user will only see a Google Drive file in their Coveo search results if they're authorized to search for the file in Google Drive.
This visibility is determined by the file's link-sharing settings.

Depending on the file's link-sharing settings in Google Drive, general access can be:

* **Restricted** to only people with access

A user with this access can search for the file in Google Drive and will see it in Coveo search results.

* Granted to **Anyone in this group...** (that is, the group that the owner belongs to)

When this access is granted, the file will be set to one of the following:

** **Can find in search results**

A user in the same group as the owner with this access can search for the file in Google Drive and will see the file in Coveo search results.

** **Must have link to access**

A user in the same group as the owner with this access can't search for the file in Google Drive and won't see the file in Coveo search results.

* **Anyone with the link**

A user with this access can't search for the file in Google Drive and, therefore, won't see the file in Coveo search results.

> **Important**
>
> Using the **Everyone** content security option isn't recommended for Google Drive sources.
> This option effectively overrides the link-sharing settings in Google Drive, notably files that can only be accessed with its link.
> As a result, all files indexed in the source become searchable via free-text search by anyone who accesses a Coveo-powered search interface that targets this source.

> **Note**
>
> When you set the link-sharing options for a folder in Google Drive, all files in the folder automatically inherit the folder's link-sharing settings.
> This means that if you set the link-sharing options for a specific file, and then set the options for the file's folder, the file's link-sharing settings change to match its folder settings.

### Restrict access to searchable content only

If the link-sharing options for a Google Drive file is set to allow access to everyone in your organization, you can use the [`OnlyIndexFilesSharedToDomainAndSearchable`](https://docs.coveo.com/en/o73a8409#onlyindexfilessharedtodomainandsearchable-boolean) source parameter in conjunction with the **Anyone in this group...** > **Can find in search results** link setting in Google Drive to index the file only if it's set as searchable in Google Drive.
You can use this parameter, for instance, to exclude a file from Coveo search results but make the file accessible in Google Drive.

By default, the [`OnlyIndexFilesSharedToDomainAndSearchable`](https://docs.coveo.com/en/o73a8409#onlyindexfilessharedtodomainandsearchable-boolean) parameter value is set to `false`, which means that all shared files are indexed and appear in Coveo search results for everyone in your organization.

To restrict file access in Coveo search results only to files that are set as searchable in Google Drive

. In Google Drive, for each file that you want your organization members to see in Coveo search results, set the file to **Can find in search results**.

.. Right-click the file, and then select **Share** > **Share**.

.. In the **General access** section, select your group.

.. Next to the group, click the role (for example, `Viewer`), and then select **Can find in search results**.

.. Click **Done**.

. On the [**Sources**](https://platform.cloud.coveo.com/admin/#/orgid/content/sources/) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/content/sources/)) page, click the **Google Drive** source, and then click **More** > **Edit configuration with JSON** in the Action bar.

. In the **Edit configuration with JSON** panel, set the [`OnlyIndexFilesSharedToDomainAndSearchable`](https://docs.coveo.com/en/o73a8409#onlyindexfilessharedtodomainandsearchable-boolean) parameter value to `true`.

. Click **Save** or **Save and Rebuild**.

## [[safe]]Safely apply content filtering

The best way to ensure that your indexed content is seen only by the intended users is to enforce [content security](#content-security-tab) by selecting the [**Same users and groups as in your content system**](https://docs.coveo.com/en/1779#same-users-and-groups-as-in-your-content-system) option. Should this option be unavailable, select [**Specific users and groups**](https://docs.coveo.com/en/1779#specific-users-and-groups) instead.

However, if you need to configure your source so that the indexed source content is accessible to [**Everyone**](https://docs.coveo.com/en/1779#everyone), you should adhere to the following leading practices.
These practices ensure that your source content is safely filtered and only accessible by the appropriate users:

* [Configure query filters](#configure-query-filters): Apply filter rules on a query pipeline to filter the source content that appears in search results when a query goes through that pipeline.

* [Use condition-based query pipeline routing](#use-condition-based-query-pipeline-routing): Apply a condition on a query pipeline to make sure that every query originating from a specific search hub is routed to the right query pipeline.
### Configure query filters

[Filter rules](https://docs.coveo.com/en/3410/) allow you to enter hidden [query](https://docs.coveo.com/en/231/) expressions to be added to all queries going through a given [query pipeline](https://docs.coveo.com/en/180/).
They're typically used to add a field-based expression to the [constant query expression (`cq`)](https://docs.coveo.com/en/179/).

**Example**

You apply the `@objectType=="Solution"` query filter to the pipeline to which the traffic of your public support portal is directed.
As a result, the `@objectType=="Solution"` query expression is added to any query sent via this support portal.

Therefore, if a user types `Speedbit watch wristband` in the search box, the items returned are those that match these keywords and whose `objectType` has the `Solution` value.
Items matching these keywords but having a different `objectType` value aren't returned in the user's search results.

To learn how to configure query pipeline filter rules, see [Manage filter rules](https://docs.coveo.com/en/3410/).

> **Note**
>
> You can also enforce a filter expression directly in the [search token](#configure-the-search-token).

### Use condition-based query pipeline routing

The most recommended and flexible query pipeline routing mechanism is [condition-based routing](https://docs.coveo.com/en/1666#condition-based-routing-recommended).

When using this routing mechanism, you ensure that search requests are routed to a specific query pipeline according to the search interface from which they originate, and the authentication is done server side.

To accomplish this:

. [Apply a condition to a query pipeline based on a search hub value](https://docs.coveo.com/en/1959/), such as **Search Hub is Community Search** or **Search Hub is Agent Panel**.
This condition ensures that all queries that originate from a specific search hub go through that query pipeline.

. [Authenticate user queries via a search token](#configure-the-search-token) that's generated server side and that contains the search hub parameter that you specified in the query pipeline.
> **Note**
>
> If you're using the Coveo In-Product Experience (IPX) feature, see [Implement advanced search token authentication](https://docs.coveo.com/en/3160#option-2-implement-advanced-search-token-authentication).

## Required privileges

You can assign privileges to allow access to specific tools in the [Coveo Administration Console](https://docs.coveo.com/en/183/).
The following table indicates the privileges required to view or edit elements of the [**Sources**](https://platform.cloud.coveo.com/admin/#/orgid/content/sources/) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/content/sources/) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/content/sources/)) page and associated panels.
See [Manage privileges](https://docs.coveo.com/en/3151/) and [Privilege reference](https://docs.coveo.com/en/1707/) for more information.

> **Note**
>
> The **Edit all** privilege isn't required to create sources.
> When granting privileges for the [Sources](https://docs.coveo.com/en/1707#sources-domain) domain, you can grant a group or API key the **View all** or [**Custom**](https://docs.coveo.com/en/3151#custom-access-level) access level, instead of **Edit all**, and then select the **Can Create** checkbox to allow users to create sources.
> See [Can Create ability dependence](https://docs.coveo.com/en/3151#can-create-ability-dependence) for more information.

## What's next?

* [Schedule source updates](https://docs.coveo.com/en/1933/).
[Schedule source updates](https://docs.coveo.com/en/1933/).