~20 min setup

Connect Google Workspace

Give Sandra access to your organization’s Gmail, Calendar, Drive, Tasks, Forms, and Contacts. This is the most impactful integration.

What Sandra can do with Google Workspace

Service	Capabilities
Gmail	Send emails, create drafts, read & search messages, reply to threads
Calendar	Create events (with Google Meet), list upcoming events, update & cancel events
Drive	Search files, read documents, create Google Docs & Sheets, share files
Tasks	Create to-do items, list tasks, mark complete, delete tasks
Forms	Create forms with questions, read form responses
Contacts	Look up team members by email, list directory users, find birthdays

Prerequisites: Google Workspace admin access (Super Admin), Google Cloud Console access, and Sandra Admin Portal access.

1. Create a Google Cloud project

Go to Google Cloud Console

Click the project selector → New Project

Name it Sandra AI Assistant, select your organization, and click Create

2. Enable required APIs

In your Cloud project, go to APIs & Services → Library and enable each of these:

API	Required for
Gmail API	Email sending, reading, drafts
Google Calendar API	Event management
Google Drive API	File search, reading, creation
Google Tasks API	Task management
Google Forms API	Form creation and responses
Admin SDK API	Directory / contacts lookup
Google Sheets API	Spreadsheet reading
People API	Contact details, birthdays

3. Create a service account

Sandra uses a service account to access your Workspace. No individual user sign-in needed.

Go to APIs & Services → Credentials

Click + Create Credentials → Service Account

Name: Sandra AI, ID: sandra-ai

Click Create and Continue → skip optional steps → Done

Download the key file

Click on your new service account → Keys tab → Add Key → Create new key

Select JSON format → Create. A .json file downloads.

⚠️ Keep this file safe! It contains the private key. You’ll upload it to Sandra later. Note the client_id value — you need it in the next step.

4. Set up domain-wide delegation

This authorizes your service account to act on behalf of users in your Workspace domain.

Go to Google Workspace Admin Console

Navigate to Security → Access and data control → API controls

Click Manage Domain Wide Delegation → Add new

Enter the client_id from your service account JSON (numeric, e.g. 123456789)

Paste the full OAuth scopes list below → click Authorize

Required OAuth scopes

Copy this entire comma-separated list:

text

https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/gmail.send,https://www.googleapis.com/auth/gmail.compose,https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/calendar.events,https://www.googleapis.com/auth/tasks,https://www.googleapis.com/auth/forms.body,https://www.googleapis.com/auth/forms.responses.readonly,https://www.googleapis.com/auth/contacts.readonly,https://www.googleapis.com/auth/spreadsheets.readonly

5. Configure Sandra

Bring the credentials into Sandra via environment variables or the Admin Portal.

Option A: Environment variables

bash

# Entire JSON key file, base64 encoded:
GOOGLE_SA_KEY_JSON=$(cat your-service-account-key.json | base64)

# Your Workspace domain
GOOGLE_WORKSPACE_DOMAIN=yourcompany.com

# Admin email (for directory lookups)
GOOGLE_ADMIN_EMAIL=admin@yourcompany.com

# Sandra's email (for sending)
GOOGLE_DRIVE_IMPERSONATE_EMAIL=sandra@yourcompany.com

# Optional: specific Drive folder IDs
GOOGLE_DRIVE_FOLDER_IDS=folder-id-1,folder-id-2

Option B: Admin Portal

Under Google Workspace Connection: upload or paste the service account JSON key, enter your domain, admin email, and Sandra’s email

Click Save → Test Connection

6. Verify the connection

In the Admin Portal, go to Dashboard → System and check for a green indicator next to Google Workspace

In the Sandra chat, try: “What meetings do I have this week?”

Or: “Search my Drive for the quarterly report”

Scope reference

Scope	Level	Why needed
drive.readonly	Read-only	Search and read files in Google Drive
drive.file	Read/write (created files)	Create Google Docs and Sheets
gmail.send	Send only	Send emails on behalf of users
gmail.compose	Create drafts	Save email drafts
gmail.readonly	Read-only	Search and read email messages
gmail.modify	Mark read / labels	Mark emails as read after processing
admin.directory.user.readonly	Read-only	Look up team members in the directory
admin.directory.group.readonly	Read-only	Look up groups / teams
calendar	Full access	Create, read, update, delete calendar events
calendar.events	Events only	Manage calendar events
tasks	Full access	Create, list, complete, delete tasks
forms.body	Create / edit	Create Google Forms with questions
forms.responses.readonly	Read-only	Read form submission responses
contacts.readonly	Read-only	Look up contact details and birthdays
spreadsheets.readonly	Read-only	Read data from Google Sheets

Troubleshooting

Insufficient permissions

Go back to the Workspace Admin Console and verify the scopes are correctly configured for the numeric client_id.

Token exchange failed

Ensure the full JSON key file was uploaded correctly. If you rotated the key in Cloud Console, generate a new one.

User not found

The configured admin email must be a real Super Admin in your Workspace.

Sandra can’t find Drive files

Trigger reindexing from Dashboard → System. If you specified folder IDs, verify they are correct.

shieldSecurity notes

• Service account JSON key is encrypted at rest
• Access tokens are short-lived (1 hour) and automatically refreshed
• Sandra accesses Workspace via impersonation of a designated admin user
• Revoke access anytime by deleting the key or removing Domain-Wide Delegation

Connect Zoom →

Schedule meetings automatically.

Agent Settings →

Customize Sandra’s email behavior.