> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Gmail & Google Drive

> Set up your team's Google OAuth client so members can connect their own Gmail and Google Drive.

Gmail and Google Drive are **Personal Credentials**: each member connects their
own account in **Settings → Personal Credentials**, and the agent uses it only in
that member's own agents. Nobody else on the team can use it.

Members connect through a Google OAuth client that **your team owns**. An
Administrator creates it once in your own Google Cloud project and saves it in
Nuphos. Until then, the Gmail and Google Drive **Connect** buttons are disabled.

> [!TIP]
>
> If your company uses Google Workspace, create the client in a project owned by
> your Workspace organization and choose the **Internal** user type. Internal
> apps need no Google verification and have no user cap. Only accounts in your
> organization can connect.

## Set up the OAuth client

**1. Create or pick a project**

In the [Google Cloud console](https://console.cloud.google.com/), create a
project for Nuphos (or reuse one) under your Workspace organization.

**2. Configure the consent screen**

Open **Google Auth Platform → Branding** and fill in the app name and
support email. Under **Audience**, choose **Internal**, or **External** if
your members use personal Gmail accounts (see
[External apps](#external-apps)).

**3. Enable the APIs**

In **APIs & Services → Library**, enable the **Gmail API** and the
**Google Drive API**.

**4. Add the scopes**

Under **Google Auth Platform → Data Access**, add these scopes:

* `https://www.googleapis.com/auth/gmail.modify`
* `https://www.googleapis.com/auth/drive`

**5. Create a Web client**

Under **Google Auth Platform → Clients**, create a client of type
**Web application** with these **Authorized redirect URIs**:

* `https://api.nuphos.ai/personal-credentials/gmail/callback`
* `https://api.nuphos.ai/personal-credentials/google-drive/callback`

If you self-host Nuphos, replace `https://api.nuphos.ai` with your
backend's public URL (`NUPHOS_PUBLIC_BACKEND_URL`).

**6. Save it in Nuphos**

Copy the **Client ID** and **Client secret**. In Nuphos, open
**Settings → General → Google OAuth client**, paste both, and click
**Save**. Only Administrators can change this.

One client covers both Gmail and Google Drive. The secret is stored encrypted
and is never shown again. To rotate it, save a new secret for the same client;
members stay connected. Removing the client, or saving a different client ID,
disconnects every member's Gmail and Google Drive, because their grants only
work with the client that issued them.

If you belong to several Nuphos teams, you connect separately in each team,
through that team's client.

## External apps

Without Google Workspace, or to let accounts outside your organization connect,
choose the **External** user type. Gmail and Drive scopes are *restricted*, so
an External app works differently:

* **Testing mode.** While the app's publishing status is **Testing**, only the
  accounts you add under **Audience → Test users** (up to 100) can connect.
  They see an "unverified app" warning, and Google expires their grants after
  **7 days**, so members must reconnect weekly.
* **Production.** To publish the app, Google requires
  [OAuth app verification](https://support.google.com/cloud/answer/13463073)
  for the restricted scopes, including an annual security assessment. Until it
  is approved, stay in Testing mode.

## Connect your account

Each member opens **Settings → Personal Credentials** and clicks **Connect**
next to Gmail or Google Drive, then approves the request in the browser.

* **Gmail** asks for `gmail.modify`: read, label, draft and send mail.
* **Google Drive** asks for `drive`: find, read and save files.

The agent asks before it sends mail, shares a file, or moves anything to the
trash. Disconnecting removes the grant from Nuphos. Google revokes it once
neither Gmail nor Google Drive is still connected.

## Other personal connections

GitHub and Linear can also be connected under **Personal Credentials** to author
work as yourself. Those connections use their own authorization flows, not this
Google OAuth client. Sharing a conversation does not give another member access
to your Gmail or Drive account. Check the intended recipients and file-sharing
scope before asking the agent to send or share private material.

For verification requirements, use Google's current
[OAuth verification guidance](https://support.google.com/cloud/answer/13463073);
requirements can depend on audience, scopes and app deployment.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.