Register one Google Cloud OAuth client for all eleven Google connectors.
One Google Cloud client covers every Google connector. Each one requests userinfo.email, userinfo.profile and the read scopes for its product.
Scopes
| Connector | Scopes | Google's class |
|---|---|---|
| Gmail | gmail.readonly | Restricted |
| Google Calendar | calendar.readonly | Sensitive |
| Google Drive | drive.readonly | Restricted |
| Google Sheets | spreadsheets.readonly, drive.metadata.readonly | Restricted |
| Google Docs | documents.readonly, drive.metadata.readonly | Restricted |
| Google Slides | presentations.readonly, drive.metadata.readonly | Restricted |
| Google Forms | forms.body.readonly, forms.responses.readonly, drive.metadata.readonly | Restricted |
| Google Tasks | tasks.readonly | Sensitive |
| Google Contacts | contacts.readonly | Sensitive |
| Google Meet | meetings.space.readonly | Sensitive |
| Google Chat | chat.spaces.readonly, chat.messages.readonly | Restricted |
Sheets, Docs, Slides and Forms have no search of their own, so they find files through drive.metadata.readonly, which reads names and dates but never contents.
Before people outside your own organization can connect, Google has to verify the app. A sensitive scope needs verification only. A restricted scope also needs a yearly third-party security assessment (CASA), so start that review early or offer only the connectors you need.
This page is for self-hosted installs. On Flowblocks Cloud these connectors work without any setup.
Create a project
Open Google Cloud Console and create or select a project.
Enable the APIs
Go to APIs & Services, then Library, and enable the API for each connector you offer: Gmail API, Google Calendar API, Google Drive API, Google Sheets API, Google Docs API, Google Slides API, Google Forms API, Google Tasks API, People API (Contacts), Google Meet REST API and Google Chat API.
Google Chat also needs a Chat app: open the Google Chat API, then Configuration, and fill in the app's name and avatar.
Configure the consent screen
Go to APIs & Services, then OAuth consent screen. Choose External for a personal project. While the app is in Testing, add yourself under Test users.
Create the client
Go to Credentials, then Create credentials, then OAuth client ID, and choose Web application. Under Authorized redirect URIs, add:
http://localhost:3000/api/auth/oauth2/callback/connector_gmail
http://localhost:3000/api/auth/oauth2/callback/connector_googlecalendar
http://localhost:3000/api/auth/oauth2/callback/connector_googledrive
http://localhost:3000/api/auth/oauth2/callback/connector_googlesheets
http://localhost:3000/api/auth/oauth2/callback/connector_googledocs
http://localhost:3000/api/auth/oauth2/callback/connector_googleslides
http://localhost:3000/api/auth/oauth2/callback/connector_googleforms
http://localhost:3000/api/auth/oauth2/callback/connector_googletasks
http://localhost:3000/api/auth/oauth2/callback/connector_googlecontacts
http://localhost:3000/api/auth/oauth2/callback/connector_googlemeet
http://localhost:3000/api/auth/oauth2/callback/connector_googlechatAdd only the ones for the connectors you offer.
For a deployed app, repeat the same paths with the https origin from BETTER_AUTH_URL.
Add the credentials
Copy the client id and client secret into .env.local, then restart the server:
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=Each Google connector is linked separately, so a person connects only the ones they want a workflow to read.
Register each URI exactly, with localhost rather than 127.0.0.1 and no trailing slash. A redirect URI that differs by one character is rejected.
Signing in with Google
The same client can power Google sign-in. Add one more redirect URI:
http://localhost:3000/api/auth/callback/google