Skip to main content

​
Overview

Connect to Google Workspace by authorizing Mistle with a Google OAuth client or service account that you create in Google Cloud. Mistle uses the configured connection to obtain Google access tokens, then injects those tokens into the Workspace tools selected in a sandbox profile. Gmail, Drive, Sheets, Docs, Slides, Calendar, Chat, and People use Mistle’s local gws tool wrapper around the official Google REST APIs.

​
Enable Google Workspace APIs

Use a Google Cloud project owned by the Workspace organization that should authorize the selected Workspace tools. Enable the Workspace product APIs needed by the selected tools:
Replace PROJECT_ID with the Google Cloud project ID.

​
Configure Google Chat

If you enable the Google Chat tools, configure a Chat app in the same Google Cloud project:
  1. Open Google Chat API > Manage > Configuration.
  2. Set App name to Chat MCP.
  3. Set Avatar URL to https://developers.google.com/chat/images/quickstart-app-avatar.png.
  4. Set Description to Chat MCP server.
  5. Turn off Enable interactive features.
  6. Select Log errors to Logging.
  7. Save the configuration.
In Google Auth Platform, configure branding, audience, and data access for the OAuth app. For an internal Workspace rollout, select Internal audience when available. For an external app in testing mode, add every authorizing Google account as a test user before connecting. Add the OAuth scopes for the Workspace tools you intend to use. Mistle currently requests a fixed scope set for the supported Workspace tools:
  • https://www.googleapis.com/auth/gmail.readonly
  • https://www.googleapis.com/auth/gmail.compose
  • https://www.googleapis.com/auth/drive
  • https://www.googleapis.com/auth/spreadsheets
  • https://www.googleapis.com/auth/documents
  • https://www.googleapis.com/auth/presentations
  • https://www.googleapis.com/auth/calendar.calendarlist.readonly
  • https://www.googleapis.com/auth/calendar.events.freebusy
  • https://www.googleapis.com/auth/calendar.events.readonly
  • https://www.googleapis.com/auth/calendar.events
  • https://www.googleapis.com/auth/chat.spaces.readonly
  • https://www.googleapis.com/auth/chat.memberships.readonly
  • https://www.googleapis.com/auth/chat.messages.readonly
  • https://www.googleapis.com/auth/chat.messages.create
  • https://www.googleapis.com/auth/chat.users.readstate.readonly
  • https://www.googleapis.com/auth/directory.readonly
  • https://www.googleapis.com/auth/userinfo.profile
  • https://www.googleapis.com/auth/contacts.readonly

​
Create A Google OAuth Client

Create a Web application OAuth client in Google Auth Platform.
  1. In Mistle, open Integrations and choose Google Workspace.
  2. Copy the callback URL shown by Mistle.
  3. In Google Cloud, open Google Auth Platform > Clients.
  4. Create an OAuth client with Application type set to Web application.
  5. Add the Mistle callback URL to Authorized redirect URIs.
  6. Create the client and copy its Client ID and Client secret.
  7. Return to Mistle, enter the client ID and client secret, and click Connect Google Workspace.
  8. Complete the Google consent flow with the Google account that should back the connection.

​
Connect With A Service Account

For headless Workspace automation, you can connect with a Google Cloud service account. This lets Mistle mint short-lived Google access tokens without an interactive OAuth consent flow.
Domain-wide delegation is optional. Leave the sandbox profile’s Workspace user email blank to mint tokens as the service account itself. Enter a Workspace user email only when the service account is configured for domain-wide delegation and should impersonate that user.
To use a service account connection:
  1. Create a Google Cloud service account in the same project used for the Workspace APIs.
  2. If you need domain-wide delegation, enable it in the service account details and copy the service account Client ID.
  3. If you enabled domain-wide delegation, open Google Workspace Admin Console > Security > Access and data control > API controls > Manage Domain Wide Delegation.
  4. If you enabled domain-wide delegation, click Add new, paste the service account Client ID, and authorize the full fixed Mistle OAuth scope set listed in Configure OAuth Consent.
  5. In Google Cloud, create a JSON key for the service account and store it carefully.
  6. In Mistle, choose Service account when adding a Google Workspace connection.
  7. Paste the service account JSON key.
Mistle signs a Google OAuth JWT bearer assertion with the service account key, exchanges it for a short-lived Google access token, and injects that token into calls to the selected Workspace tools.

​
Connect MCP Servers To A Sandbox Profile

After the Google Workspace connection is active:
  1. Open the sandbox profile that should use Google Workspace.
  2. Add the Google Workspace integration connection to the profile.
  3. In Resources & Tools, select the Google Workspace tools that agents may use.
  4. For service account connections, optionally enter the Workspace user email Mistle should use as the Google Workspace user subject when minting access tokens with domain-wide delegation.
  5. Publish the profile version.
Only selected tools are exposed to sessions using that published profile.

​
Supported Tools

​
Official References