Google Workspace

Overview

Connect from the Integrations screen after creating your company. Workspace OAuth requests Gmail readonly only, with one-use tenant/user state and PKCE. Refresh tokens are encrypted at rest. Disconnect invalidates local credentials immediately.

Setup & requirements

Production callback: https://app.mailraft.com/api/integrations/google/callback. Real mailbox consent remains a separate acceptance gate from Sign-In. Calendar, Drive, Gmail send and modify are not enabled.

Usage & verification

In Integrations choose Google Workspace and authorize Gmail readonly using an approved test mailbox. The production callback is https://app.mailraft.com/api/integrations/google/callback. The connection uses encrypted, one-use user/company state and PKCE S256. Foreign response issuers are rejected.

Test connection reads at most one message reference. The gmail.read action lists at most 20 references; explicit message reads return bounded plain text. No Gmail send/modify, Calendar or Drive scopes are requested. Disconnect immediately erases local credentials and attempts provider revocation. Real consent and mailbox acceptance are still pending.