Copy page

Guides

Connect Google

This guide is for Owners and Admins, and for partners who set up Google for a customer. At the end bots work with the Gmail, calendar, Drive files, people, and Meet transcripts of each person who talks to them.

The OAuth client belongs to the customer. It lives in a Google Cloud project of the customer's Google Workspace organization, not in yours. A setup in the Console guides you.

Before you start

• You are an Owner or Admin of the organization. A partner switches into the customer's organization first. See Partners.
• Someone of the customer can create a project in Google Cloud for the Workspace organization and set up its consent screen.
• Meet transcripts need Google Workspace Business Standard or higher.

The names of menus in the Google Cloud console change now and then. Look for the same wording if a name differs.

1. Start the setup

Open Connections and choose Add connection, then Connect Google. You can also open /connections/new/google in the Console directly.

Give the connection a name. Then decide about Files for bots (Google Drive). It is off by default. With it on, bots use the Drive of each person who talks to them: all files and shared drives that person can see. There is no limit to chosen folders. With it off, GEKI never asks for Drive. You can change it later.

Select Continue. The setup shows its steps at the top: OAuth client and Test.

2. OAuth client

The Console lists each step with a link into the Google Cloud console.

1. Create a project in the Workspace organization, for example "GEKI".
2. Turn on the APIs in the project: Gmail API, Google Calendar API, Google Drive API, People API, and Google Meet REST API. Without files, the Drive API is not needed.
3. Set up the consent screen. Choose the audience Internal. Then only people of your organization can sign in, and Google needs no review of the app, also for the Gmail and Drive scopes.
4. Add the scopes under Data access: choose Add or remove scopes and paste the list from the Console into Manually add scopes, one scope per line. The list has openid, email, profile, and the scopes for Gmail, Calendar, contacts, the directory, and Meet, and for Drive when files are on.
5. Create an OAuth client of the type Web application. Add the redirect URI https://api.geki.ai/v1/oauth/callback.
6. Enter the client ID and the client secret in the Console and select Save credentials.

The client secret is stored encrypted and never shown again. Google client secrets do not expire.

3. Test

Select Test connection. GEKI checks the client ID and the secret with Google. When the test passes, the setup is done: the connection page says Google is connected and offers the next steps, Connect my account and Set up a bot.

Then connect your own account under Google Workspace for bots with Connect my account. That shows whether the APIs and the scopes are set up.

The connection page

The page has tabs.

• Connection. The status, Test connection, Rename, the client ID, Run setup again, and Delete connection.
• Google Workspace for bots. See below.

Google Workspace for bots

A bot can use the Gmail, calendar, people, and Meet transcripts of each person who talks to it, and the Drive files when files are on. The bot uses the account of that person and sees only what that person can reach. Channel threads in Teams and Slack and service accounts never use a person's account.

It is on for a new connection. Only one connection of the organization can have it. The tab shows how many people connected their account, the redirect URI, and the scopes. Turn off stops it.

Each person connects once in Chat under Settings, then Connected accounts, in the row Google Workspace. Google shows its consent screen every time someone connects. A person can untick single parts there, for example Drive. The tab then names what some people did not allow, and the bot tools of that part tell the person to connect again and allow it.

People search finds colleagues only while directory sharing is on in the Google Admin console.

Files for bots on the tab turns Drive on or off. Off, GEKI does not ask for Drive and bots get no file tools. On, people who connected before connect again in Chat to allow Drive. Until then the tab names Drive as not allowed.

Give a bot access

Open the bot in the Console, then Editor and Mail and calendar. The section shows Google Workspace when your organization set up only Google. If it set up Microsoft 365 too, choose the suite first. A bot uses one of them.

Select Save, then Publish. Publishing asks you to confirm each area. A bot with these areas reads data of people, so keep the internet access of its workspace restricted.

What is different from Microsoft 365

• Gmail has labels instead of folders. A shared or delegated mailbox cannot be used.
• Free times are times from Monday to Friday, 9 to 17, in the time zone of the person's calendar. People whose calendar the person cannot see are not checked.
• Google Docs, Sheets, and Slides are read as Word, Excel, and PowerPoint files. They are never overwritten. A bot saves a new file instead.
• A new file with a name that exists gets a number, such as notes (2).txt.
• New events with an online meeting get a Google Meet link.

Single sign-on with the same client

The same OAuth client can also serve single sign-on. Add the redirect URI that the single sign-on setup shows to the client, and enter the client ID and the secret there too.

Remove the connection

Delete connection removes the connection and every connected Google account of it. Delete the OAuth client in the Google Cloud console yourself.

Next

• Tools and MCP connectors explains the tools and approvals.
• Triggers starts a bot when new mail, an event, a file, or a transcript arrives.
• Connect Microsoft is the same task for Microsoft 365.