> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Google

> Connect your AI Agents to Google services including Gmail, Google Calendar, Drive, and more.

The Google integration allows users to log in to your AI Agents using their Google profile. To complete the [Call other's APIs on user's behalf quickstart](/ai/docs/get-started/call-others-apis-on-users-behalf), you need to set up a Google social connection.

To set up a Google social connection, you must:

* Create Google OAuth credentials with the Google Auth Platform.
* Configure and test a Google social connection with the Auth0 Dashboard.

## Prerequisites

1. [Sign up for a Google Cloud account](https://console.cloud.google.com/).
2. [Create a Google project](https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects).

## Google Auth Platform

The Google Auth Platform helps you manage your applications and OAuth credentials for logging in and calling Google APIs. To learn more, read [Get started with the Google Auth Platform](https://support.google.com/cloud/answer/15544987?hl=en).

Use the Google Auth Platform to:

* [Configure Google consent screen](#configure-google-consent-screen)
* [Create Google OAuth Client](#create-google-oauth-client)
* [Enable Google APIs](#enable-google-apis)

### Configure Google consent screen

<Note>
  **Note:** If your application requests sensitive OAuth scopes or uses a custom
  image, [Google limits it to 100 logins until the OAuth consent screen is
  verified](https://developers.google.com/apps-script/guides/client-verification).
  Consent screen verification may take up to several days.
</Note>

When you use OAuth 2.0 for authorization, your application requests authorization for one or more scopes of access from a Google Account. Google displays a consent screen to the user, including a summary of your project, its policies, and the requested access scopes.

Before creating an OAuth client ID, you must first configure the OAuth consent screen with information about your application.

In the Google Cloud Console, [configure your Google OAuth consent screen](https://developers.google.com/workspace/guides/configure-oauth-consent):

<Steps>
  <Step title="Configure Authorized domains">
    Navigate to **Google Auth Platform > Branding**. For Authorized domains,
    enter `auth0.com`. If you're using a [custom
    domain](https://auth0.com/docs/customize/custom-domains), enter your custom
    domain instead.
  </Step>

  <Step title="Configure Audience">
    Navigate to **Google Auth Platform > Audience**. For **User type**, select
    **Make External**. In **Test Users**, you can add the email addresses you
    want to use for testing.
  </Step>

  <Step title="Configure Data Access">
    Navigate to **Google Auth Platform > Data Access** to add or remove scopes.
    To learn more, read [OAuth 2.0 Scopes for Google
    APIs](https://developers.google.com/identity/protocols/oauth2/scopes).
  </Step>

  <Step title="Configure Consent screen">
    Follow the rest of the instructions to finish [configuring your Google OAuth
    consent
    screen](https://developers.google.com/workspace/guides/configure-oauth-consent).
  </Step>

  <Step title="Save Changes">Select **Save Changes**.</Step>
</Steps>

### Create Google OAuth Client

In the Google Cloud Console, [create a new OAuth 2.0 Client](https://console.cloud.google.com/auth/clients/create):

<Steps>
  <Step title="Create Client">
    Navigate to **Google Auth Platform > Clients**. Then, select **New Client**.
  </Step>

  <Step title="Select Application type">
    For the **Application type**, select **Web application**.
  </Step>

  <Step title="Configure Client credentials">
    Enter the following information for your OAuth 2.0 Client:

    <ul>
      <li>**Name**: The name of your OAuth 2.0 Client.</li>
      <li>**Authorized JavaScript origins**: `https://{YOUR_AUTH0_DOMAIN}`</li>

      <li>
        **Authorized redirect URIs**: `https://{YOUR_AUTH0_DOMAIN}/login/callback`
      </li>
    </ul>

    <Info>
      You can find the **Auth0 domain** in the [Auth0 Dashboard](https://manage.auth0.com/).

      You can find this under **Applications > \[Your Application] > Settings > Basic Information > Domain**.

      If you are using the [custom domains](https://auth0.com/docs/custom-domains) feature, your Auth0 domain is the custom domain. You can find this under **Branding > Custom Domains**.
    </Info>
  </Step>

  <Step title="Complete">Select **Create**.</Step>
</Steps>

### Enable Google APIs

Enable Google APIs for your OAuth 2.0 Client:

<Steps>
  <Step title="Search the Google API Library">
    Navigate to the [Google API Library](https://console.cloud.google.com/apis/library). Then, search for your Google API and select it from the results.
  </Step>

  <Step title="Enable Google API">
    For each Google API you want to enable, select **Enable**.
  </Step>
</Steps>

## Auth0 Dashboard

Use the Auth0 Dashboard to create and configure a Google social connection with the proper OAuth credentials.

### Create Google social connection

Use the [Auth0 Dashboard](https://manage.auth0.com/) to create a new Google social connection.

<Steps>
  <Step title="Create Connection">
    Navigate to **Authentication > Social**. Select **Create Connection** and
    then **Google/Gmail**.
  </Step>

  <Step title="Configure Client credentials">
    In **General**, enter the client credentials from the Google OAuth 2.0
    Client you created:

    <ul>
      <li>**Client ID**: The unique identifier for your application.</li>

      <li>
        **Client Secret**: The secret used by the application to authenticate
        with Auth0. To learn more, read [Client secret
        authentication](https://auth0.com/docs/secure/application-credentials#client-secret-authentication).
      </li>
    </ul>
  </Step>

  <Step title="Enable Connected Accounts for Token Vault">
    In **Purpose**, toggle on **Connected Accounts for Token Vault**. This allows the connection
    to retrieve and securely store access tokens for external APIs. To learn
    more, read [Connected Accounts for Token Vault](https://auth0.com/docs/secure/tokens/token-vault/connected-accounts-for-token-vault).
  </Step>

  <Step title="Select Permissions">
    In **Permissions**, select <strong>Offline Access</strong>, allowing your client application to obtain a refresh token from the external provider. When you get an access token for the Google social connection, it will contain the appropriate
    scopes so you can use it to call the required Google APIs.
  </Step>

  <Step title="Enable Applications">
    After saving, go the **Applications** tab and select the applications that
    should use this connection.
  </Step>
</Steps>

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  If your application uses [Organizations](https://auth0.com/docs/manage-users/organizations), authenticate the user with the target organization before initiating the Connected Accounts flow. Token Vault still stores the Google connected account on the user's Auth0 profile, so each organization member authorizes their own Google account.
</Callout>

### Test connection

Once you have created your Google social connection, [test your connection](https://auth0.com/docs/dashboard/guides/connections/test-connections-social).

## Token Vault configuration Example

To configure the Token Vault for your Google connection, you can use the following code snippet in your application:

<Tabs>
  <Tab title="JavaScript" icon="js">
    ```tsx wrap lines theme={null}
    const auth0AI = new Auth0AI();

    export const withGoogleConnection = auth0AI.withTokenVault({
      connection: "google-oauth2",
      scopes: ["openid", "https://www.googleapis.com/auth/calendar.freebusy", ...],
      refreshToken: getAuth0RefreshToken(),
    });
    ```
  </Tab>

  <Tab title="Python" icon="python">
    ```python wrap lines theme={null}
    auth0_ai = Auth0AI()

    with_google_connection = auth0_ai.with_token_vault(
        connection="google-oauth2",
        scopes=["openid", "https://www.googleapis.com/auth/calendar.freebusy", ...],
        refresh_token=get_auth0_refresh_token,
    )
    ```
  </Tab>
</Tabs>

## Learn more

* Auth0 stores the access and refresh tokens for each connected account in the [Token Vault](https://auth0.com/docs/secure/tokens/token-vault). Applications can then access the Token Vault to retrieve access tokens to call external APIs. To learn more, read [Configure Token Vault](https://auth0.com/docs/secure/tokens/token-vault/configure-token-vault).
* If your application uses [Organizations](https://auth0.com/docs/manage-users/organizations), authenticate the user with the target organization before initiating the Connected Accounts flow. Each user still connects their own external account.
* Learn how to get an access token to make a tool call by completing the [Call other's APIs on user's behalf quickstart](/ai/docs/get-started/call-others-apis-on-users-behalf).