Google Workspace Setup

Create OAuth 2.0 credentials for Google Workspace APIs including Gmail, Drive, Docs, Sheets, Slides, and Calendar.

Prerequisites

• Google Cloud Console access
• A Google Workspace organization (for Internal apps) or any Google account (for External apps)

Setup Steps

1. Create a Google Cloud Project

   Go to the Google Cloud Console and create a new project or select an existing one.

2. Enable Required APIs

   Enable the following APIs in your project from the API Library:

   • Gmail API
   • Google Drive API
   • Google Docs API
   • Google Sheets API
   • Google Slides API
   • Google Calendar API

3. Configure OAuth Consent Screen

   Go to OAuth Consent and configure:

   • User Type: Choose “Internal” for Google Workspace organizations (recommended) or “External” for broader access
   • App name: Your app name (e.g., “Fp Switchboard”)
   • Support email: Your email address
   • Authorized domains: fpdigital.ai (or your domain)

4. Add OAuth Scopes

   Add the required scopes for all Google Workspace services:

   https://www.googleapis.com/auth/gmail.modify
   https://www.googleapis.com/auth/drive
   https://www.googleapis.com/auth/documents
   https://www.googleapis.com/auth/spreadsheets
   https://www.googleapis.com/auth/presentations
   https://www.googleapis.com/auth/calendar

5. Create OAuth Credentials

   Go to Credentials and:

   • Click “Create Credentials” → “OAuth 2.0 Client ID”
   • Select “Web application” as the application type
   • Name it (e.g., “Fp Switchboard Web Client”)

6. Add Redirect URI

   Add the authorized redirect URI:

   https://api.switchboard.fpdigital.ai/oauth/google/callback

7. Save Client Credentials

   Copy the Client ID and Client Secret. You’ll add these as environment variables.

Environment Variables

npx wrangler secret put GOOGLE_CLIENT_ID
npx wrangler secret put GOOGLE_CLIENT_SECRET

Variable	Description
GOOGLE_CLIENT_ID	OAuth 2.0 Client ID from Google Cloud Console
GOOGLE_CLIENT_SECRET	OAuth 2.0 Client Secret from Google Cloud Console

Redirect URI

https://api.switchboard.fpdigital.ai/oauth/google/callback

Important Notes

Tip

For Google Workspace organizations, use “Internal” app type to avoid the unverified app warning for your users.

Caution

External apps need Google verification for sensitive scopes if you have more than 100 users. This process can take several weeks.

• Access tokens expire after 1 hour
• Refresh tokens are used to get new access tokens automatically
• Users only see the consent screen on first connection

Required Scopes

Scope	Services
gmail.modify	Gmail (read, send, labels, drafts)
drive	Google Drive (files, folders, sharing)
documents	Google Docs (read, create, edit)
spreadsheets	Google Sheets (read, create, formulas)
presentations	Google Slides (read, create, edit)
calendar	Google Calendar (events, attendees)

Common Issues

Unverified App Warning

If your consent screen is set to “External” and not yet verified by Google, users will see a warning screen. Click “Advanced” then “Go to [app name]” to proceed. For production, submit for Google verification.

Sensitive Scopes

gmail.modify and drive are sensitive scopes. External apps with more than 100 users need Google’s OAuth verification review, which can take several weeks.

• “Access blocked” error: The user’s Google Workspace admin may have restricted third-party app access. Check Admin Console > Security > API Controls.
• Missing API error: Ensure all 6 APIs are enabled in the Google Cloud Console API Library.
• Token refresh failure: If a user’s refresh token stops working, they need to disconnect and reconnect the service.

Testing

1. Go to your Switchboard Dashboard
2. Navigate to the Google Workspace service page
3. Click Connect and complete the OAuth flow
4. Click Test Connection to verify
5. Try a tool call: ask your AI to “search Gmail for recent emails”