Google Suite - How do I set up my partner credentials for OAuth?

Last updated: July 29, 2026

Overview

This guide will walk you through the steps generate your client credentials within Google Workspace and input them into Merge. Note that partnership is required for Google Suite connectors to work.

This guide goes over setting up partner credentials for Google Drive, Gmail, and Google Calendar. Specific instructions for each connector will be found below.

Step 1: Generate OAuth credentials in Google

Create a Google Cloud Project here.
In your Dashboard, go to APIs & Services, and click on Credentials.
Create a Project for the partnership configuration.
Configure your OAuth Consent Screen with User Type: External and Published.
Click +Create Credentials and begin steps to create an OAuth Client ID.
Mark the Application type as Web Application.
Add the Merge Redirect URI as https://ah.merge.dev/oauth/callback
Click CREATE. You will see a screen that shows the OAuth Client ID and Secret for your account.
Add the Merge Redirect URI as https://ah.merge.dev/oauth/callback
Click CREATE. You will see a screen that shows the OAuth Client ID and Secret for your account.

Step 2a: Google Drive

If you want to build an OAuth app for the Google Drive connector, follow these steps.

Under Data Access, you'll need to add scopes. Please include the following scopes based upon the authentication method your end users will select in Merge Link:
1. User account (read-only)
  1. https://www.googleapis.com/auth/drive.readonly
2. Admin account (read-only)
  1. https://www.googleapis.com/auth/drive.readonly
  2. https://www.googleapis.com/auth/admin.directory.group.readonly
3. Admin account (read and write)
  1. https://www.googleapis.com/auth/drive
  2. https://www.googleapis.com/auth/admin.directory.group.readonly
Once the scopes are set, fill out any other required questions about your product and submit your application.
Save your Google Drive OAuth credentials in Agent Handler via the Connectors page, by hitting the "+ Add credential" button

Step 2b: Gmail

If you want to build an OAuth app for the Google Gmail connector, follow these steps.

Under data access, you'll need to add scopes. The exact scopes that need to be added will depend on the tools you plan to offer via Agent handler. A breakdown of each tool call and the require Google scope can be found in the table below.

If you want to easily enable all tool calls, the https://mail.google.com/

scope grants full read and write privileges in a single scope

Tool	Required OAuth Scope(s)
get_attachment	Minimal: `https://www.googleapis.com/auth/gmail.readonly`
list_drafts	Minimal: `https://www.googleapis.com/auth/gmail.readonly`
get_draft	Minimal: `https://www.googleapis.com/auth/gmail.readonly`
create_draft	Minimal: `https://www.googleapis.com/auth/gmail.compose`
update_draft	Minimal: `https://www.googleapis.com/auth/gmail.compose`
delete_draft	Minimal: `https://www.googleapis.com/auth/gmail.compose`
send_draft	Minimal: `https://www.googleapis.com/auth/gmail.compose`
list_labels	Minimal: `https://www.googleapis.com/auth/gmail.labels`
get_label	Minimal: `https://www.googleapis.com/auth/gmail.labels`
create_label	Minimal: `https://www.googleapis.com/auth/gmail.labels`
update_label	Minimal: `https://www.googleapis.com/auth/gmail.labels`
delete_label	Minimal: `https://www.googleapis.com/auth/gmail.labels`
list_messages	Minimal: `https://www.googleapis.com/auth/gmail.readonly`
get_message	Minimal: `https://www.googleapis.com/auth/gmail.readonly`
send_message	Minimal: `https://www.googleapis.com/auth/gmail.send`
modify_message_labels	Minimal: `https://www.googleapis.com/auth/gmail.modify`
delete_message	Full Access Only: `https://mail.google.com/` – The full Gmail scope is required for permanently deleting a message.
batch_delete_messages	Full Access Only: `https://mail.google.com/` – This operation permanently deletes multiple messages, which requires the full mail scope.
batch_modify_messages	Minimal: `https://www.googleapis.com/auth/gmail.modify`
list_threads	Minimal: `https://www.googleapis.com/auth/gmail.readonly`
get_thread	Minimal: `https://www.googleapis.com/auth/gmail.readonly`
modify_thread_labels	Minimal: `https://www.googleapis.com/auth/gmail.modify`
delete_thread	Full Access Only: `https://mail.google.com/` – Permanently deleting an entire thread requires the full Gmail access scope.

Step 2c: Google Calendar

If you want to build an OAuth app for the Google Calendar connector, follow these steps.

Under data access, you'll need to add scopes. The exact scopes that need to be added will depend on the tools you plan to offer via Agent handler. A breakdown of each tool call and the require Google scope can be found in the table below.

If you want to easily enable all tool calls, the https://www.googleapis.com/auth/calendar scope grants full read and write privileges in a single scope

Tool	Required OAuth Scope(s)
list_acl_rules	`https://www.googleapis.com/auth/calendar.acls.readonly`
get_acl_rule	`https://www.googleapis.com/auth/calendar.acls.readonly`
create_acl_rule	`https://www.googleapis.com/auth/calendar.acls`
update_acl_rule	`https://www.googleapis.com/auth/calendar.acls`
patch_acl_rule	`https://www.googleapis.com/auth/calendar.acls`
delete_acl_rule	`https://www.googleapis.com/auth/calendar.acls`
watch_acl_rules	`https://www.googleapis.com/auth/calendar.acls.readonly`
get_calendar	`https://www.googleapis.com/auth/calendar.calendars.readonly`
create_calendar	`https://www.googleapis.com/auth/calendar.calendars`
update_calendar	`https://www.googleapis.com/auth/calendar.calendars`
delete_calendar	`https://www.googleapis.com/auth/calendar.calendars`
clear_calendar	`https://www.googleapis.com/auth/calendar.calendars`
list_calendar_list	`https://www.googleapis.com/auth/calendar.calendarlist.readonly`
get_calendar_from_list	`https://www.googleapis.com/auth/calendar.calendarlist.readonly`
add_calendar_to_list	`https://www.googleapis.com/auth/calendar.calendarlist`
update_calendar_in_list	`https://www.googleapis.com/auth/calendar.calendarlist`
patch_calendar_in_list	`https://www.googleapis.com/auth/calendar.calendarlist`
remove_calendar_from_list	`https://www.googleapis.com/auth/calendar.calendarlist`
watch_calendar_list	`https://www.googleapis.com/auth/calendar.calendarlist.readonly`
list_events	`https://www.googleapis.com/auth/calendar.events.readonly`
get_event	`https://www.googleapis.com/auth/calendar.events.readonly`
create_event	`https://www.googleapis.com/auth/calendar.events`
update_event	`https://www.googleapis.com/auth/calendar.events`
patch_event	`https://www.googleapis.com/auth/calendar.events`
delete_event	`https://www.googleapis.com/auth/calendar.events`
move_event	`https://www.googleapis.com/auth/calendar.events`
import_event	`https://www.googleapis.com/auth/calendar.events`
quick_add_event	`https://www.googleapis.com/auth/calendar.events`
watch_events	`https://www.googleapis.com/auth/calendar.events.readonly`
get_event_instances	`https://www.googleapis.com/auth/calendar.events.readonly`
list_user_settings	`https://www.googleapis.com/auth/calendar.settings.readonly`
get_user_setting	`https://www.googleapis.com/auth/calendar.settings.readonly`
query_freebusy	`https://www.googleapis.com/auth/calendar.freebusy`
watch_user_settings	`https://www.googleapis.com/auth/calendar.settings.readonly`

Step 2d: Google Meet

If you want to build an OAuth app for the Google Drive connector, follow these steps.

Under data access, you'll need to add scopes. The exact scopes that need to be added will depend on the tools you plan to offer via Agent handler. A breakdown of each tool call and the require Google scope can be found in the table below.

If you want to easily enable all tool calls, the https://www.googleapis.com/auth/meetings.space.created scope grants full read and write privileges in a single scope

Tool	Required OAuth Scope(s)
create_space	`https://www.googleapis.com/auth/meetings.space.created`
get_space	`https://www.googleapis.com/auth/meetings.space.readonly`
update_space	`https://www.googleapis.com/auth/meetings.space.settings`
end_active_conference	`https://www.googleapis.com/auth/meetings.space.settings`
list_conference_records	`https://www.googleapis.com/auth/meetings.space.readonly`
get_conference_record	`https://www.googleapis.com/auth/meetings.space.readonly`
list_participants	`https://www.googleapis.com/auth/meetings.space.readonly`
get_participant	`https://www.googleapis.com/auth/meetings.space.readonly`
list_participant_sessions	`https://www.googleapis.com/auth/meetings.space.readonly`
get_participant_session	`https://www.googleapis.com/auth/meetings.space.readonly`
list_recordings	`https://www.googleapis.com/auth/meetings.space.readonly`
get_recording	`https://www.googleapis.com/auth/meetings.space.readonly`
list_transcripts	`https://www.googleapis.com/auth/meetings.space.readonly`
get_transcript	`https://www.googleapis.com/auth/meetings.space.readonly`
list_transcript_entries	`https://www.googleapis.com/auth/meetings.space.readonly`
get_transcript_entry	`https://www.googleapis.com/auth/meetings.space.readonly`
validate_credential	`https://www.googleapis.com/auth/meetings.space.readonly`

Step 2d: Google Tasks

If you want to build an OAuth app for the Google Tasks connector, follow these steps.

Under data access, you'll need to add scopes. The exact scopes that need to be added will depend on the tools you plan to offer via Agent handler. A breakdown of each tool call and the require Google scope can be found in the table below.

If you want to easily enable all tool calls, the https://www.googleapis.com/auth/tasks scope grants full read and write privileges in a single scope

Tool	Required OAuth Scope(s)
list_tasks	`https://www.googleapis.com/auth/tasks.readonly`
get_task	`https://www.googleapis.com/auth/tasks.readonly`
create_task	`https://www.googleapis.com/auth/tasks`
update_task	`https://www.googleapis.com/auth/tasks`
delete_task	`https://www.googleapis.com/auth/tasks`
move_task	`https://www.googleapis.com/auth/tasks`
clear_completed_tasks	`https://www.googleapis.com/auth/tasks`
list_tasklists	`https://www.googleapis.com/auth/tasks.readonly`
get_tasklist	`https://www.googleapis.com/auth/tasks.readonly`
create_tasklist	`https://www.googleapis.com/auth/tasks`
update_tasklist	`https://www.googleapis.com/auth/tasks`
delete_tasklist	`https://www.googleapis.com/auth/tasks`
validate_credential	`https://www.googleapis.com/auth/tasks.readonly`

Troubleshooting Blocked Access

If you run into an issue at Google sign-in for "Access blocked" for an individual user, run through the following steps using administrator access to the Google Workspace environment:

Log in to the Google Admin Console using an admin account.
Go to Security > Access and data control > API controls.
Inside the App access control section, click Manage Third-Party App Access.
Click Add app and select OAuth App Name Or Client ID from the dropdown menu using the same client configured in Merge.
Check the box next to the correct client ID/app version and click select.
Choose the organizational units that need access (or select "All users") and click continue.
Select Trusted (which gives full access to requested scopes) and click Finish.