Prerequisites

1. An active Google Workspace account for your organization (formerly G Suite).
2. Administrator access to the Google Cloud Console using your Workspace account.
3. Super Admin access to your Vertical Studio application.
4. All users in your organization must use email addresses from the same Google Workspace domain.

Where to access and configure Google Integration

Subscriber setup (super admin only)

1. Sign in to your Vertical Studio application as a Super Admin
2. Navigate to Setup > Marketplace > Google > Set up
3. Enter the Client ID and Client Secret generated from Google Cloud Console
4. Confirm the Redirect URI matches the one shown in Vertical Studio application
5. Click Save

Before you can add credentials in Vertical Studio, you must first create a Google Cloud project and generate OAuth credentials in the Google Cloud Console. The complete setup involves two phases: creating OAuth credentials in Google Cloud Console and adding them to Vertical Studio application.

This setup is required because the Client ID and Client Secret identify your Vertical Studio application to Google. When a user wants to sync their Calendar, Contacts, or Gmail, Vertical Studio applications uses these credentials to request access to that user's Google data. The user then signs in with their own Google account and grants permission to the Vertical Studio application to access their Calendar and Contacts. Once permission is granted, Vertical Studio application can sync data on behalf of that user. Each user goes through this authorization process individually, so each user controls their own data and can revoke access at any time.

Phase 1: Create Google OAuth credentials

Complete these steps in the Google Cloud Console with a Google Workspace administrator account.

Step 1: Create a new Google Cloud project

Sign in to the Google Cloud Console with your Google Workspace account

1. Open the project selector at the top of the page
2. Click New project
3. Enter a unique project name and confirm your organization
4. Click Create

The Project ID cannot be changed after creation, so choose carefully.

Step 2: Configure the OAuth consent screen

The consent screen is what your users see when they authorize the integration.

1. With your new project selected, open the navigation menu.
2. Navigate to APIs & Services > OAuth consent screen.
   
   
3. Enter your app name and the required support email.
4. For Audience (user type), select Internal. Selecting Internal restricts the credentials to users within your own Google Workspace organization and does not require Google's verification process.
   
   
   
   
5. Add the contact information for Google to notify you about any changes to your project.
6. Read and agree to the Google API Services - User Data Policy
7. Click Create 
   

Step 3: Create the OAuth client ID and secret

1. From the navigation menu, go to APIs & Services > Credentials
2. Click Create OAuth client 
   
   
3. For Application type, select Web application
4. Under Authorized redirect URIs, add the following URIs:
1. For Google Calendar and Google Contacts sync: Enter the redirect URI exactly as shown on the Vertical Studio application's Google setup page (Setup > Marketplace > Google > Set up).
   Example: https://gadgets.zoho.com/google/auth
2. For Gmail integration: Click Add URI again and add the following URI: https://gadgets.zoho.com/tpa/serviceapps
   Use the data center-specific base domain when applicable. Examples include https://gadgets.zoho.com, https://gadgets.zoho.eu, https://gadgets.zoho.com.au, and https://gadgets.zoho.in.
5. Click Create.
   

Google generates your Client ID and Client Secret. Copy and securely store the Client Secret. You can also click Download JSON to save the credentials.

Step 4: Enable the required Google APIs

Enable the API that corresponds to each integration you plan to use. You only need the APIs for the features you want.

1. Google People API - for Google Contacts sync
2. Google Calendar API - for Google Calendar sync
3. Gmail API - for Gmail integration

To enable each API:

1. From the navigation menu, go to APIs & Services > Library
2. Search for the API by name (Google People API, Google Calendar API, or Gmail API)
3. Open the API and click Enable.

Repeat for each API you need.

Phase 2: Add the Credentials to Vertical Studio

Once you have the Client ID and Client Secret from Google Cloud Console, add them to your Vertical Studio application.

Step 5: Enter your credentials

1. Sign in to the Vertical Studio application as Super Admin
2. Navigate to Setup > Marketplace > Google > Set up
3. Enter the Client ID and Client Secret you created in Phase 1
4. Confirm the Redirect URI matches exactly the one you added in the Google Cloud Console
5. Click Save.
   

After saving, all users in your organization can authorize Google Calendar and Google Contacts to sync between Google and Vertical Studio.

Important: The Redirect URI must match exactly. The value in the Google Cloud Console and the one shown in the Vertical Studio application must be identical, or authorization will fail.

Managing Credentials after first User Authorization

1. Editing is restricted: You cannot change the Client ID and Client Secret after any user authorizes Calendar, Contacts, or Gmail integration.
2. To enable editing: All users must deactivate their authorization for all three integrations (Calendar, Contacts, and Gmail) before you can edit the credentials.

How to enable Credential editing

1. Deactivate Calendar sync: Navigate to Setup > Marketplace > Google > Calendar and deactivate.
2. Deactivate Contacts sync: Navigate to Setup > Marketplace > Google > Contacts and deactivate.
3. Deactivate Gmail integration: Navigate to Setup > Channels > Email > Email Configuration and deactivate Gmail.

Important Notes

Security and access

1. Keep your Client Secret secure: Treat it like a password. The Google Cloud Console displays it only once immediately after creation. Store it securely and do not share it.
2. App authentication on behalf of users: The Client ID and Client Secret identify the Vertical Studio application as trusted application to Google. When users authorize the integration, they grant Vertical Studio application permission to access their own Google Calendar, Contacts, and Gmail data. Each user controls their own permissions and can revoke access at any time.
3. Individual user consent required: Each user must sign in with their own Google account and grant permission. Users can only authorize access to their own data.
4. Internal app, no verification: Because the consent screen is set to Internal, only users in your Google Workspace organization can authorize the integration, and Google verification is not required.
5. Super admin only: Only super administrators can access the setup page and configure the integration.

Domain restrictions

1. Same domain requirement: All users in your Vertical Studio application must use email addresses from the same Google Workspace domain as the super admin who created the credential.
   Example: If you create credentials using admin@example.com, only users with @example.com email addresses can use the integration
2. Cannot use personal Gmail accounts: Users with personal Gmail addresses cannot authorize the integration. All users must be part of the same Google Workspace organization.