Skip to main content
Built by Runlayer. Runlayer builds and maintains this connector. It runs on Runlayer Deploy, which must be enabled for your workspace.
Connect your AI assistant to Google Workspace services. All Google servers share the same Google OAuth setup process.

Available Tools

Google Calendar

Gmail

Google Drive

Google Docs

Google Sheets

Google Slides

Google Forms

Setup

1

Create Google Cloud Project

  1. Go to Google Cloud Console
  2. Create a new project or select an existing one
2

Enable APIs

Go to APIs & Services > Library and enable the APIs you need:
  • Google Calendar API
  • Gmail API
  • Google Drive API
  • Google Docs API
  • Google Sheets API
  • Google Slides API
  • Google Forms API
3

Configure OAuth Consent Screen

  1. Go to APIs & Services > OAuth consent screen
  2. Select External or Internal
  3. Fill in app name, support email, and developer contact
  4. Add required scopes (see below)
  5. Add test users if using External mode
4

Create OAuth Credentials

  1. Go to APIs & Services > Credentials
  2. Click Create Credentials > OAuth client ID
  3. Select Web application
  4. Add redirect URI: https://<your-tenant>.runlayer.com/oauth/callback
  5. Copy the Client ID and Client Secret
5

Add Server in Runlayer

  1. In Runlayer, go to My connectors, select a Google service, and click Add connector
  2. Check Custom OAuth credentials
  3. Enter your Client ID and Client Secret
  4. Click Deploy Server
6

Authorize

  1. Click Connect on the server page
  2. Sign in with Google and grant permissions

OAuth Scopes

Add these scopes when configuring OAuth consent: All connectors additionally request openid and https://www.googleapis.com/auth/userinfo.email for user identity.

Changing scopes on an existing connector

When a connector’s scopes change (for example, Google Forms moving from read-only access to read and write, so it can create and edit forms), an already-deployed connector needs these steps in this order:
1

Add the new scope to your OAuth consent screen (External apps only)

If your app’s user type is External, add the new scope(s) in APIs & Services > OAuth consent screen so users can consent to them. Internal (Google Workspace) apps can request any scope without listing it here, so you can skip this step. You can remove any scope the new one supersedes (e.g. forms.body covers forms.body.readonly).
2

Redeploy the connector

Redeploy the server so it picks up the new image and requests the new scope set. Until you redeploy, nothing changes for your users. By default the connector requests its built-in scopes, so a redeploy is enough — unless you’ve overridden them (see the note below).
3

Users re-authorize

Each user re-authorizes through their own MCP client, the same way they first connected (signing in with Google and granting access). Existing authorizations keep their previously granted scopes until the user re-authorizes, so users pick up the new capability individually as they reconnect — it isn’t something an admin does on each user’s behalf.
The connector requests its built-in scopes by default, so most deployments only need the redeploy. The exception is if you set a GOOGLE_OAUTH_SCOPES environment variable on the connector, which overrides the built-in scopes. To check, open your connector in Runlayer and look at its environment variables: if GOOGLE_OAUTH_SCOPES is set, add the new scope to it (otherwise a redeploy won’t change what’s requested); if it isn’t set, there’s nothing to do.
Each user will need to re-authorize before they can use the new tools. Until they do, tools that need the added scope return permission errors for that user, while their existing capabilities keep working.
Adding a sensitive or restricted scope to a published/verified External app may require re-verification by Google (verification of a related scope does not carry over). Internal (Google Workspace) apps do not need re-verification.

Troubleshooting

Verify the redirect URL in Google Cloud Console matches exactly: https://<your-tenant>.runlayer.com/oauth/callback (no trailing slash).
Ensure OAuth consent screen is configured. Add yourself as a test user if using External mode.
Enable the specific API in Google Cloud Console > APIs & Services > Library.
Tokens may have expired. Disconnect and reconnect the server in Runlayer.
Re-authorize with updated scopes. Ensure the API is enabled in your project.