Create a Google OAuth app for OpenConnector

Use a Google OAuth app when a self-hosted OOMOL OpenConnector runtime needs to connect a user’s Google account. One Google Cloud project can hold the OAuth client used by Gmail, Google Drive, Google Calendar, Google Sheets, Google Docs, Google Slides, YouTube, Google Analytics, Google BigQuery, and other Google API providers.

OpenConnector services

Common Google OAuth service IDs include:

Service ID	Provider
`gmail`	Gmail
`googledrive`	Google Drive
`googlecalendar`	Google Calendar
`googlesheets`	Google Sheets
`googledocs`	Google Docs
`googleslides`	Google Slides
`youtube`	YouTube
`google_analytics`	Google Analytics
`google_bigquery`	Google BigQuery

Each service stores its own OAuth client config in OpenConnector. You can reuse the same Google OAuth client ID and client secret for multiple Google services if the client allows the same redirect URI and the required APIs and scopes.

Prerequisites

A running OpenConnector runtime.
A Google account with access to a Google Cloud project.
Permission to configure OAuth consent, enable APIs, and create OAuth credentials in Google Cloud.
The OpenConnector origin users open in the browser, such as http://localhost:3000 or https://connect.example.com.

Step 1: Set the OpenConnector callback URL

For local testing, use:

http://localhost:3000/oauth/callback

For a public runtime, set OOMOL_CONNECT_ORIGIN first and use:

https://connect.example.com/oauth/callback

Step 2: Prepare the Google Cloud project

In Google Cloud Console:

Create or select a project.
Open APIs & Services.
Enable the APIs your OpenConnector service needs, such as Gmail API, Google Drive API, Google Calendar API, Google Sheets API, YouTube Data API, Google Analytics Data API, or BigQuery API.
Open OAuth consent screen and configure the app name, support email, audience, contact information, and test users when Google asks for them.
Add the scopes needed by the OpenConnector service or let Google show them during consent when the OAuth request is started.

Google may require verification before broad production use of sensitive or restricted scopes. For local use or internal testing, keep the app in the testing or internal state allowed by your Google account type.

Step 3: Create OAuth credentials

In APIs & Services > Credentials:

Choose Create credentials.
Choose OAuth client ID.
Select Web application.
Add the exact OpenConnector callback URL under authorized redirect URIs.
Create the client.
Copy the client ID and client secret.

Google’s official OAuth guide is Using OAuth 2.0 for Web Server Applications.

Step 4: Save the client in OpenConnector

Use the OpenConnector web console for the service you want to connect:

Open the OpenConnector web console, such as http://localhost:3000.
Open Providers and select Gmail or another Google provider.
Choose Configure OAuth Client or Edit OAuth Client.
Paste the Google client ID and client secret.
Choose Save OAuth Client.

Repeat these steps on each Google provider page when you want to use the same Google OAuth client for another Google provider.

Step 5: Connect and test

After saving the OAuth client, choose Connect on the Google provider page. Complete Google consent, return to OpenConnector, and confirm that the provider page shows the account as connected.

For Gmail, low-risk test actions include gmail.get_profile and gmail.list_labels. Use the console action details to check the exact input before running an action.

Troubleshooting

Symptom	What to check
`redirect_uri_mismatch`	The URI sent to Google must exactly match one authorized redirect URI in the OAuth client. Confirm it is `<openconnector-origin>/oauth/callback`.
Google shows the app as unverified	Keep testing with allowed test users, use internal mode when available, or complete Google’s verification process before broad use.
Google does not issue a refresh token	Reconnect the account. OpenConnector Google providers request offline access and consent where the provider definition requires refresh tokens.
A Google action says insufficient permissions	Enable the required API in Google Cloud, add or approve the required scope, then reconnect the account.
The wrong Google account is used	Reconnect from a browser profile signed in to the intended Google account.

Keep Google client secrets in your secret manager and set OOMOL_CONNECT_ENCRYPTION_KEY before storing OAuth clients in OpenConnector.