Skip to content

External service — Google

Give assistants access to each user's Google services: Gmail, Drive, Calendar, Sheets, Docs, Google Analytics, Google Play Developer, etc.

Approach

Forra provides a shared Google OAuth client for external services. The service is not enabled by default on a new tenant — it must be pre-configured by the Forra team on request.

During pre-configuration, Forra enables the service with limited visibility (typically restricted to the organization administrator) so you can validate that the OAuth flow works correctly and that the Google Workspace authorization is in place (see below).

1. Request pre-configuration

Contact the Forra team to request activation of the Google service. After this request:

  • The service appears in the OAuth Services section of the External Services tab.
  • Its visibility is set to a restricted scope (admin only).

2. Authorize the OAuth client in Google Workspace

As with Google authentication, if your Google Workspace organization restricts third-party applications, the Forra OAuth client must be marked as Trusted in the Google admin console (admin.google.com → Security → API controls → App access control → Manage Third-Party App Access). Without this, users will not be able to authorize Forra to access their data.

The Forra team will provide the OAuth client ID to authorize.

3. Broaden visibility in Forra

Once the client is authorized on the Workspace side and the service is tested with your admin account:

  1. Tenant Admin → External Services → OAuth Services section.
  2. Open the Google card.
  3. Broaden visibility: Public for the whole tenant, or assign specific groups/users as needed.
  4. Save.

4. Test with an end user

Ask a (non-admin) user to connect to the Google service from their Forra settings to validate the full flow.

Domain migration

If your Forra instance changes domain, the Redirect URI of the Google OAuth configuration must be updated to point to the new scout.mirego.com domain (or other) instead of the old subdomain. Contact the Forra team — they manage the Google console on the shared OAuth client side.

Manual configuration (advanced)

If you want to use your own Google OAuth client rather than Forra's shared client — for example for compliance reasons or to limit scopes — follow the Custom service procedure with the following parameters:

  • Authorize URL: https://accounts.google.com/o/oauth2/v2/auth
  • Access token URL: https://oauth2.googleapis.com/token
  • Authorize URL params: {"access_type": "offline"}
  • Scopes (client_kwargs.scope): adjust as needed, for example https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/gmail.readonly https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/documents

Contact the Forra team for the Redirect URI to declare in your Google Cloud console.