--- title: Google Workplace slug: authentication-guides/google-workplace docTags: createdAt: 2026-01-19T17:11:09.114Z --- # Introduction This guide tells you how to authenticate the Google Workspace connector in Swimlane. You will create a Google Cloud project, enable required APIs, configure a service account, optionally enable domain-wide delegation, and configure the connector in Swimlane. This connector supports Google authentication using one of the following: - Service Account JSON credentials (Base64-encoded) - OAuth 2.0 Client ID, Client Secret, and Refresh Token # Prerequisites ## Google Access Requirements You must have permissions to: - Create and manage projects in Google Cloud Platform - Enable APIs in Google Cloud Console - Create service accounts and download JSON key files - Manage domain-wide delegation in Google Admin console (recommended) - Create OAuth 2.0 client credentials (optional) ## Required Credentials During setup, you will collect: - Service Account JSON key file (Base64-encoded) or OAuth 2.0 Client ID and Client Secret - Delegate account email address (recommended) - Customer ID or my\_customer alias (optional) - OAuth scopes for domain-wide delegation (recommended) - Refresh token (if using OAuth 2.0 client credentials) # GCP Project Creation Take the following steps to create a Google Cloud project: 1. Log in to **Google Cloud Console** at [https://console.cloud.google.com/](https://console.cloud.google.com/). 2. Navigate to [https://console.cloud.google.com/projectcreate](https://console.cloud.google.com/projectcreate) . 3. Name project and click **Create**. 4. Navigate to **Projects** and select **new project**. ![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/qse9TMHzTF8ZrMoniPqeQ_image.png) # Enabling Individual APIs 1. After creating **project**, enable required APIs for the connector. 2. Navigate to** APIs & Services** dashboard and enable following APIs using explicit names if links become deprecated: | **API** | **URL** | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | Google Drive | [https://console.cloud.google.com/apis/library/drive.googleapis.com](https://console.cloud.google.com/apis/library/drive.googleapis.com) | | Gmail | [https://console.cloud.google.com/apis/library/gmail.googleapis.com](https://console.cloud.google.com/apis/library/gmail.googleapis.com) | | Google Workspace Alert Center | [https://console.cloud.google.com/apis/library/alertcenter.googleapis.com](https://console.cloud.google.com/apis/library/alertcenter.googleapis.com) | | G Suite Vault | [https://console.cloud.google.com/apis/library/vault.googleapis.com](https://console.cloud.google.com/apis/library/vault.googleapis.com) | | Admin SDK API | [https://console.cloud.google.com/apis/library/admin.googleapis.com](https://console.cloud.google.com/apis/library/admin.googleapis.com) | | Google Chat API | [https://console.cloud.google.com/apis/library/chat.googleapis.com](https://console.cloud.google.com/apis/library/chat.googleapis.com) | | Google Sheets API | [https://console.cloud.google.com/apis/library/sheets.googleapis.com](https://console.cloud.google.com/apis/library/sheets.googleapis.com) | 3. After enabling APIs, navigate back to **APIs & Services** dashboard and verify all APIs are listed. 4. If any APIs are missing, enable again. # Configuring a Service Account Google Workspace connector requires a **Google service account** to authenticate. Take the following steps to create a service account and download JSON key file: 1. Open [https://console.developers.google.com/iam-admin/serviceaccounts](https://console.developers.google.com/iam-admin/serviceaccounts). 2. Select the appropriate project. 3. Click **CREATE SERVICE ACCOUNT.** 4. Assign name and description, then click **CREATE AND CONTINUE.** 5. Select role **Owner**, then click **CONTINUE.** 6. Skip **Grant users access to this service account or add users**, then click **DONE.** 7. Click **newly created service account email.** 8. Navigate to **KEYS.** 9. Click **ADD KEY **and select **CREATE NEW KEY.** 10. Select **JSON **and click **CREATE.** 11. Download **JSON** file. This file is required for Swimlane asset creation. 12. Navigate to **DETAILS** and copy **Unique ID. **This value is required for domain-wide delegation. # Delegating Domain-Wide Authority (Recommended) - In order to support accessing multiple user's accounts, domain-wide authority must be enabled before creating a service account. - Choosing not to delegate domain-wide authority will heavily limit the scope of what this connector can do. - If the connector will only operate against a single account, the Setting API Scopes section can be skipped. # Setting API Scopes After creating service account, authorize required API scopes using **Google Admin **console: 1. From [https://admin.google.com](https://admin.google.com), navigate to **Security > API controls**. 2. Click **Manage Domain Wide Delegation**. 3. Click **Add new**. 4. In **Client ID **field, enter **Unique ID** from service account **Details** menu. 5. Enter following CSV value into **OAuth Scopes** (comma-delimited) input: https\://mail.google.com/,https\://www\.googleapis.com/auth/admin.directory.device.mobile,https\://www\.googleapis.com/auth/admin.directory.device.mobile.action,https\://www\.googleapis.com/auth/admin.directory.group,https\://www\.googleapis.com/auth/admin.directory.group.member,https\://www\.googleapis.com/auth/admin.directory.orgunit,https\://www\.googleapis.com/auth/admin.directory.user,https\://www\.googleapis.com/auth/admin.directory.user.security,https\://www\.googleapis.com/auth/admin.directory.user.alias,https\://www\.googleapis.com/auth/admin.directory.userschema,https\://www\.googleapis.com/auth/apps.alerts,https\://www\.googleapis.com/auth/devstorage.read\_only,https\://www\.googleapis.com/auth/drive,https\://www\.googleapis.com/auth/ediscovery,https\://www\.googleapis.com/auth/chat.bot,https\://www\.googleapis.com/auth/spreadsheets 6. Click **Authorize.** # OAuth 2.0 (Optional) To configure OAuth 2.0 for Google Workspace connector, follow these steps: 1. Navigate to **Google Cloud Console.** 2. Select** project.** 3. In left sidebar, select **APIs & Services **> **Credentials.** 4. Click **CREATE CREDENTIALS** and select **OAuth client ID.** 5. Select application type as **Web application.** 6. Enter name and click **Create.** 7. Copy client ID and client secret. 8. Add necessary scopes under **Scopes for Google APIs.** 9. Click **Save.** ## Retrieve Refresh Token To retrieve refresh\_token, reach out to Swimlane support for requirements.txt and get\_refresh\_token.py files. Python3 must be installed on local system. Run the following commands: - `python3 -m pip install -r requiremments.txt` - `python3 get_refresh_token.py` Script will: - Prompt for client\_id and client\_secret - Prompt for additional scopes. By default requested scopes are gmail.send and gmail.modify - Direct user to Gmail authentication and approval in browser. - Redirect the user to a blank page at [https://localhost](https://localhost). - Copy full URL for https\://localhost address and provide it to script to receive refresh token. # Swimlane Asset Setup ## Credentials Contents of JSON credentials key file downloaded when creating service account must be base64-encoded when creating Swimlane Google Workspace asset. Copy Base64 encoded string and paste into Service Account JSON field. **For Linux and Mac:** `$ cat | base64` **For Windows using Powershell:** `[convert]::ToBase64String((Get-Content -path your_file_path -Encoding byte))` ## Delegate Account - Delegate account value determines which account to operate as when running actions. - Delegate account value should be the email address for the target account. - In most cases an Admin account of Google Workspace should be used. - Do not use service account email. ## Customer ID - Customer ID is unique ID for customer's Google Workspace account. - As account administrator, my\_customer alias can be used to represent customerId. - To find Customer ID, navigate to https\://admin.google.com and go to Account > Account settings. ## Limitations when NOT using a Delegated Account 1. Using a service account without **delegate\_account** introduces limitations when interacting with user data. 2. Service accounts may not be able to access user emails, contacts, or Google Drive files in the same way a regular user can. # Connector configuration in Swimlane 1. Log in to Turbine. 2. From the left-hand navigation pane, click **ORCHESTRATION **and click **Assets**. Asset homepage opens. 3. Click **plus** icon to open **Configure your Connector Asset** window. 4. Select Google Workspace from **Asset type **list. 5. Fill in **Asset Settings **and **Asset Input** as shown: | **Field** | **Description** | **Required/Optional** | | ----------------- | ------------------------------------------------------------------------------------------------------------------------ | --------------------- | | credentials | Base64-encoded contents from Service Account JSON credentials file. | Optional | | delegate\_account | Account to execute integrations under. If not specified, integration will run as service account. | Optional | | client\_id | The client ID for the OAuth 2.0 application. | Optional | | client\_secret | The client secret for the OAuth 2.0 application. | Optional | | refresh\_token | OAuth 2.0 refresh token used to obtain new access tokens. If using refresh token, provide client\_id and client\_secret. | Optional | Fields with \* marks are required. :::hint{type="info"} While adding an asset, provide either credentials or Client ID and Client Secret. If both are provided, Client ID takes precedence. ::: 6. Click **Create**. ![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/qVwAGQDZwPCOy1RYZM_dE_image.png) # Troubleshooting If you encounter an authentication error: - Verify required APIs are enabled in **Google Cloud project.** - Verify service account JSON key is valid and Base64 encoding includes full file contents. - Verify domain-wide delegation is configured with correct Unique ID and required scopes. - Verify delegate\_account is a valid admin user email address and not a service account email.If using refresh\_token flow, verify client\_id, client\_secret, and refresh\_token match the same OAuth client. You have successfully authenticated the Google Workspace Connector in Swimlane.