Google

One OAuth client in your Google Cloud project lets each person connect their Google account: Gmail, Calendar, Search Console and Analytics, read only. Sign in with Google is a separate client, below.

Used by: OpenSEO for Search Console and Google Analytics (the identity, search-console.read and analytics.read sets); OpenCRM for Gmail and Google Calendar (the gmail.read and calendar.read sets).

Connect accountsCopy Anchor Link

Each person connects their own Google account in the Gateway, once, and every app that asks uses it. Apps never see the tokens. How connecting works

The redirect URI to register, with your Gateway's address (like apps.example.com):

https://<your gateway>/connect/google-workspace/callback

1. Signed in to Google, create a Cloud project (for example EveryApp). With Google Workspace, put it in your organization.
2. Enable the APIs your apps use: for OpenSEO, the Search Console API, the Analytics Admin API and the Analytics Data API; for OpenCRM, the Gmail API and the Google Calendar API.
3. Set up the consent screen: an app name people will see, a support email, and the audience: Internal (your Workspace only, no review) or External.
4. On Data Access, add only the scopes your apps use: webmasters.readonly and analytics.readonly for OpenSEO, gmail.readonly and calendar.readonly for OpenCRM.
5. Create a client: type Web application, and under Authorized redirect URIs add the redirect URI above. Copy the Client ID and Client secret, or select Download JSON.
6. External only: while the app is in Testing, add each person under Audience → Test users. Their access expires every 7 days until Google verifies the app.

Add it to your Gateway. It asks for the client ID and secret:

everyapp provider add google-workspace

Or add it in Manage workspace → Providers.

Use it in an appCopy Anchor Link

capabilities: {
  "google-workspace": { access: "read", scopes: ["gmail.read"], why: "What the app does with it." },
},

Apps ask for these scope sets:

Check it worked: everyapp provider show google-workspace shows the client as set. Then open the account menu → Connected accounts → Connect Google.

Sign in with GoogleCopy Anchor Link

Adds Continue with Google to your Gateway's sign-in page, for people you've invited. Sign-in

1. Open console.cloud.google.com and create an OAuth client ID (Web application).
2. Add the redirect URL https://<your gateway>/api/auth/callback/google.
3. Copy:
   • GOOGLE_SIGNIN_CLIENT_ID: The OAuth client's Client ID (ends in .apps.googleusercontent.com)
   • GOOGLE_SIGNIN_CLIENT_SECRET: The OAuth client's Client secret.

• An OAuth consent screen still in Testing only signs in the test users listed on it; publish it for everyone else.

Turn it on. It asks for each value:

everyapp signin add google

Check it worked: everyapp signin show google shows each setting as set. Then sign out and select the button.

More helpCopy Anchor Link

Ask your coding agent to set Google up: the everyapp skill has the full guide (setup/google.md, setup/signin-google.md).

Something wrong or missing? Open an issue.