> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace

> Connect your AI agents to Google Workspace services including Gmail, Calendar, Sheets, Drive, and more.

export const TokenVaultConfigBlock = ({connectionName = "connection-name", providerName = "Provider", scopes = ["scope1", "scope2"], optionalScopes = []}) => {
  const formatScopes = scopes => {
    return scopes.map(scope => `"${scope}"`).join(", ");
  };
  const jsVariableName = `with${providerName.replace(/\s+/g, '')}Connection`;
  const pythonVariableName = `with_${connectionName.replace(/-/g, '_')}_connection`;
  return <>
      <Tabs>
        <Tab title="JavaScript" icon="js">
          <CodeBlock language="javascript" wrap="true" lines="true">
{`const auth0AI = new Auth0AI();

export const ${jsVariableName} = auth0AI.withTokenVault({
  connection: "${connectionName}",
  scopes: [${scopes.length > 0 ? `
    // Required scopes for Token Vault
    ${formatScopes(scopes)},` : ''}
    // Optional Scopes specific for your app
    ${optionalScopes.length > 0 ? `${formatScopes(optionalScopes)},` : ''} ...
  ],
  refreshToken: getAuth0RefreshToken(),
});`}
          </CodeBlock>
        </Tab>
        <Tab title="Python" icon="python">
          <CodeBlock language="python" wrap="true" lines="true">
{`auth0_ai = Auth0AI()

${pythonVariableName} = auth0_ai.with_token_vault(
    connection="${connectionName}",
    scopes=[${scopes.length > 0 ? `
        # Required scopes for Token Vault
        ${formatScopes(scopes)},` : ''}
        # Optional Scopes specific for your app
        ${optionalScopes.length > 0 ? `${formatScopes(optionalScopes)},` : ''} ...
    ],
    refresh_token=get_auth0_refresh_token,
)`}
          </CodeBlock>
        </Tab>
      </Tabs>
    </>;
};

export const Auth0SetupBlock = ({providerName, clientIDName = "Client ID", clientSecretName = "Client Secret", scopesName = "Permissions", allowFreeFormScopes = false, allowOfflineAccess = false}) => {
  return <>
      <ol>
        <li>
          In the <a href="https://manage.auth0.com">Auth0 Dashboard</a>, go to{" "}
          <b>Authentication &gt; Social</b>.
        </li>
        <li>
          Select <b>Create Connection</b>, then choose <b>{providerName}</b>.
        </li>
        <li>Click <b>Continue</b>.</li>
        <li>
          In <b>General</b>:
          <ol type="A">
            <li>
              Enter the <b>{clientIDName}</b> and <b>{clientSecretName}</b> from
              your {providerName} OAuth app.
            </li>
            <li>
              Under <b>{scopesName}</b>, select the scope(s) required for your
              application. These determine what permissions your application can
              request from {providerName}, whether for authentication (such as
              accessing basic profile details) or for API access (such as
              connecting to the provider's APIs).<br /><br />For a Dropbox and Google social
              connection, you must select <b>Offline Access</b> in the Auth0 Dashboard, enabling
              the client application to obtain an Auth0 refresh token.
            </li>
            {allowOfflineAccess && <li>
                Under <b>{scopesName}</b>, enable <b>Offline Access</b> for the connection.
                This is required by Auth0 to obtain a refresh token from {providerName}.
              </li>}
            {allowFreeFormScopes && <li>
                Add any additional scopes your application requires in the{" "}
                <b>Additional Scopes</b> field.
              </li>}
          </ol>
        </li>
        <li>
          In <b>Purpose</b>, toggle on <b>Connected Accounts for Token Vault</b>. This lets the
          connection retrieve and securely store access tokens for external
          APIs. Learn more in{" "}
          <a href="https://auth0.com/docs/secure/tokens/token-vault/connected-accounts-for-token-vault">
            Connected Accounts for Token Vault
          </a>.
        </li>
        <li>Click <b>Create</b>.</li>
        <li>
          After creation, you are redirected to the <b>Applications</b> page.
          Select the application(s) to enable this connection for.
          <br />
          Note: In a new Auth0 tenant, you can select the <b>Default App</b>.
        </li>
        <li>
          Once you have created your {providerName} social connection, <a href="https://auth0.com/docs/authenticate/identity-providers/test-connections">test your connection</a> to ensure the setup is working correctly before using it in your application.
        </li>
      </ol>
    </>;
};

export const IntegrationInfoBlock = ({providerName}) => {
  return <Note>
      This guide walks you through setting up the <strong>{providerName}</strong> connection in Auth0. 
      For an end-to-end example that shows how to set up your app to call third-party APIs on the user's behalf 
      using a connection like this, read the{' '}
      <a href="/ai/docs/get-started/call-others-apis-on-users-behalf">
        Call Other's APIs on User's Behalf Quickstart
      </a>.
    </Note>;
};

The Google Workspace integration allows users to authenticate with your AI agents using their Google Workspace identity. This integration provides access to Google's ecosystem of applications and services and is essential for B2B scenarios where users need to access their work data and collaborate through Google services.

## Connect Google Workspace with Auth0

To set up a Google Workspace connection with Auth0, follow the [Connect Your App to Google Workspace](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/google-apps) detailed guide.

<IntegrationInfoBlock providerName="Google Workspace" />

## Token Vault configuration example

To configure the Token Vault for your Google Workspace connection, you can use the following code snippet in your application:

<TokenVaultConfigBlock providerName="GoogleWorkspace" connectionName="google-workspace-connection-name" scopes={["email"]} optionalScopes={["https://www.googleapis.com/auth/spreadsheets.readonly","https://www.googleapis.com/auth/admin.directory.user.readonly"]} />

## Next steps

* To learn how to configure applications to access Token Vault, read [Configure Token Vault](https://auth0.com/docs/secure/tokens/token-vault/configure-token-vault).
* If your application uses [Organizations](https://auth0.com/docs/manage-users/organizations), authenticate the user with the target organization before initiating the Connected Accounts flow. Connected accounts remain linked to the individual user profile.
* To learn how to get an access token to make a tool call, complete the [Call other's APIs on user's behalf Quickstart](https://auth0.com/ai/docs/get-started/call-others-apis-on-users-behalf).