> ## Documentation Index > Fetch the complete documentation index at: https://docs.mistle.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google Workspace > Connect Google Workspace tools to Mistle ## Overview Connect to Google Workspace by authorizing Mistle with a Google OAuth client or service account that you create in Google Cloud. Mistle uses the configured connection to obtain Google access tokens, then injects those tokens into the Workspace tools selected in a sandbox profile. Gmail, Drive, Sheets, Docs, Slides, Calendar, Chat, and People use Mistle's local `gws` tool wrapper around the official Google REST APIs. ## Enable Google Workspace APIs Use a Google Cloud project owned by the Workspace organization that should authorize the selected Workspace tools. Enable the Workspace product APIs needed by the selected tools: ```bash theme={null} gcloud services enable \ gmail.googleapis.com \ drive.googleapis.com \ sheets.googleapis.com \ docs.googleapis.com \ slides.googleapis.com \ calendar-json.googleapis.com \ chat.googleapis.com \ people.googleapis.com \ --project=PROJECT_ID ``` Replace `PROJECT_ID` with the Google Cloud project ID. ## Configure Google Chat If you enable the Google Chat tools, configure a Chat app in the same Google Cloud project: 1. Open **Google Chat API > Manage > Configuration**. 2. Set **App name** to `Chat MCP`. 3. Set **Avatar URL** to `https://developers.google.com/chat/images/quickstart-app-avatar.png`. 4. Set **Description** to `Chat MCP server`. 5. Turn off **Enable interactive features**. 6. Select **Log errors to Logging**. 7. Save the configuration. ## Configure OAuth Consent In **Google Auth Platform**, configure branding, audience, and data access for the OAuth app. For an internal Workspace rollout, select **Internal** audience when available. For an external app in testing mode, add every authorizing Google account as a test user before connecting. Add the OAuth scopes for the Workspace tools you intend to use. Mistle currently requests a fixed scope set for the supported Workspace tools: * `https://www.googleapis.com/auth/gmail.readonly` * `https://www.googleapis.com/auth/gmail.compose` * `https://www.googleapis.com/auth/drive` * `https://www.googleapis.com/auth/spreadsheets` * `https://www.googleapis.com/auth/documents` * `https://www.googleapis.com/auth/presentations` * `https://www.googleapis.com/auth/calendar.calendarlist.readonly` * `https://www.googleapis.com/auth/calendar.events.freebusy` * `https://www.googleapis.com/auth/calendar.events.readonly` * `https://www.googleapis.com/auth/calendar.events` * `https://www.googleapis.com/auth/chat.spaces.readonly` * `https://www.googleapis.com/auth/chat.memberships.readonly` * `https://www.googleapis.com/auth/chat.messages.readonly` * `https://www.googleapis.com/auth/chat.messages.create` * `https://www.googleapis.com/auth/chat.users.readstate.readonly` * `https://www.googleapis.com/auth/directory.readonly` * `https://www.googleapis.com/auth/userinfo.profile` * `https://www.googleapis.com/auth/contacts.readonly` ## Create A Google OAuth Client Create a Web application OAuth client in Google Auth Platform. 1. In Mistle, open **Integrations** and choose **Google Workspace**. 2. Copy the **callback URL** shown by Mistle. 3. In Google Cloud, open **Google Auth Platform > Clients**. 4. Create an OAuth client with **Application type** set to **Web application**. 5. Add the Mistle callback URL to **Authorized redirect URIs**. 6. Create the client and copy its **Client ID** and **Client secret**. 7. Return to Mistle, enter the client ID and client secret, and click **Connect Google Workspace**. 8. Complete the Google consent flow with the Google account that should back the connection. ## Connect With A Service Account For headless Workspace automation, you can connect with a Google Cloud service account. This lets Mistle mint short-lived Google access tokens without an interactive OAuth consent flow. Domain-wide delegation is optional. Leave the sandbox profile's Workspace user email blank to mint tokens as the service account itself. Enter a Workspace user email only when the service account is configured for domain-wide delegation and should impersonate that user. To use a service account connection: 1. Create a Google Cloud service account in the same project used for the Workspace APIs. 2. If you need domain-wide delegation, enable it in the service account details and copy the service account **Client ID**. 3. If you enabled domain-wide delegation, open **Google Workspace Admin Console > Security > Access and data control > API controls > Manage Domain Wide Delegation**. 4. If you enabled domain-wide delegation, click **Add new**, paste the service account Client ID, and authorize the full fixed Mistle OAuth scope set listed in **Configure OAuth Consent**. 5. In Google Cloud, create a JSON key for the service account and store it carefully. 6. In Mistle, choose **Service account** when adding a Google Workspace connection. 7. Paste the service account JSON key. Mistle signs a Google OAuth JWT bearer assertion with the service account key, exchanges it for a short-lived Google access token, and injects that token into calls to the selected Workspace tools. ## Connect MCP Servers To A Sandbox Profile After the Google Workspace connection is active: 1. Open the sandbox profile that should use Google Workspace. 2. Add the Google Workspace integration connection to the profile. 3. In **Resources & Tools**, select the Google Workspace tools that agents may use. 4. For service account connections, optionally enter the **Workspace user email** Mistle should use as the Google Workspace user subject when minting access tokens with domain-wide delegation. 5. Publish the profile version. Only selected tools are exposed to sessions using that published profile. ## Supported Tools | Tool | Runtime path | | --------------- | --------------------------------------------- | | Gmail | Local `gws` MCP wrapper for Gmail REST API | | Google Drive | Local `gws` MCP wrapper for Drive REST API | | Google Sheets | Local `gws` MCP wrapper for Sheets REST API | | Google Docs | Local `gws` MCP wrapper for Docs REST API | | Google Slides | Local `gws` MCP wrapper for Slides REST API | | Google Calendar | Local `gws` MCP wrapper for Calendar REST API | | Google Chat | Local `gws` MCP wrapper for Chat REST API | | People API | Local `gws` MCP wrapper for People REST API | ## Official References * [OAuth 2.0 for Web Server Applications](https://developers.google.com/identity/protocols/oauth2/web-server) * [Using OAuth 2.0 for Server to Server Applications](https://developers.google.com/identity/protocols/oauth2/service-account) * [Control API access with domain-wide delegation](https://knowledge.workspace.google.com/admin/apps/control-api-access-with-domain-wide-delegation)