Google Workspace

Google Workspace is a suite of productivity tools developed by Google, including Drive, Docs, Sheets, Slides, and more.

To administer the tenant itself, its users, groups, org units, and devices, use Google Workspace Admin instead.

Authentication Types

Google Workspace supports 3 authentication methods:

• OAuth - Create your own Google Cloud OAuth app. Every user connects with their Google account.

  • Pros: Full control, per-user tracking, production-ready
  • Cons: Requires Google Cloud Console setup

• Instant OAuth - Use Willow's pre-configured Google app for the fastest setup.

  • Pros: Fastest setup, no configuration needed
  • Cons: Limited scopes, not recommended for production

• Server App - Use a Google Cloud service account for server-to-server authentication.

  • Pros: No user interaction needed, good for automated workflows
  • Cons: More complex setup, requires domain-wide delegation for accessing user data

Setting up OAuth

1. Go to https://console.cloud.google.com/

2. Create a new project or select an existing one

3. Go to APIs & Services → Library and enable the APIs you need:

   • Google Drive API
   • Google Docs API
   • Google Sheets API
   • Google Slides API

4. In the left sidebar, go to APIs & Services → OAuth consent screen

5. Configure your OAuth consent screen with the required information

6. On the Scopes page, add the scopes you need:

   • https://www.googleapis.com/auth/drive (Drive)
   • https://www.googleapis.com/auth/documents (Docs)
   • https://www.googleapis.com/auth/spreadsheets (Sheets)
   • https://www.googleapis.com/auth/presentations (Slides)

7. Go to APIs & Services → Credentials

8. Click Create Credentials → OAuth client ID

9. Select Web application

10. Under Authorized redirect URIs, add:

    • For SaaS deployments: https://{org}.mcp-s.com/{org}/api/auth/callback
    • For On-Premise deployments: {connectUrl}/{org}/api/auth/callback

11. Click Create

12. Copy the Client ID and Client Secret

13. In Willow, paste the Client ID and Client Secret

14. Select the same scopes you configured

15. Click Save Changes

Setting up a Server App (Service Account)

1. Go to https://console.cloud.google.com/

2. Go to APIs & Services → Credentials

3. Click Create Credentials → Service account

4. Enter a Service account name and click Create and Continue

5. Click Done

6. Click on the created service account

7. Go to the Keys tab

8. Click Add Key → Create new key → JSON

9. Save the downloaded JSON key file

10. In Willow, upload or paste the service account JSON key

11. Enable Domain-wide delegation for the service account:

    • In the service account details, check Enable Google Workspace Domain-wide Delegation
    • Go to Google Workspace Admin Console
    • Navigate to Security → API controls → Domain-wide delegation
    • Add the service account Client ID with the required scopes

12. Configure the scopes and subject (user to impersonate) in Willow

Note: If setting up a Service Account without first going through the OAuth flow above, make sure to enable the required Google Workspace APIs (Drive, Docs, Sheets, Slides) in APIs & Services → Library.

Blocking sensitive Drive files

Google Workspace ships predefined conditions that check a Drive file's applied labels before a tool touches it, so access follows the classification your organization already maintains in Drive:

Condition	Effect
Block sensitive Drive files	Blocks files carrying any of the labels you select.
Block Drive files by label field value	Blocks files whose label field is set to a flagged value, for example Confidentiality = Confidential.

Both are designed for google-drive-get-file-metadata, google-drive-copy-file, and google-drive-convert-to-google-doc, and both require the https://www.googleapis.com/auth/drive.labels.readonly scope. Add it alongside the scopes above, otherwise the label lookup fails and — because conditions fail closed by default — every call to those tools is blocked.