Skip to main content
Adding a Google account to the hub asks which OAuth client to sign it in with. Both values behind that choice, an OAuth client ID and an OAuth client secret, come from Google, and this page is how you get them. A client is the key your hub signs accounts in with, and it is not Claude. Accounts and clients separates the two if the words are running together.
The add account screen, with fields for an OAuth client ID and secret
You only do this once. After the first time, adding an account offers the clients the hub already holds and picks the right one for you, so there is nothing to paste. Come back here only if you need a client from a second Google Cloud project, which is covered at the bottom of this page.

​
What it is, and why you have to make it

For the hub to read your Gmail, it has to prove to Google that you allowed it to. The OAuth client is that proof. We cannot make it for you. Google offers no way to create one automatically, so it has to be done in your own account, in the console. In return the client lives inside your own project. We never see it and never hold it. You make it once. Several accounts can share one client.
Allow about ten minutes. The installer’s Create your OAuth client card has a button for each step that opens the right console page, so you never have to go looking for one.
The consent screen is what Google shows when you connect an account, listing what is being asked for. It has to exist before a client can.
1

Get started

The installer’s Open consent screen button lands you here. Press Get started.
The Google Auth Platform overview, saying it is not configured yet, with a get started button
2

Name it, and give an address

App name is for your own benefit. It is the name you will see when you connect an account. User support email is a dropdown; pick your own.
The first step of project configuration, asking for an app name and a support email
3

Choose External

Choose External. Internal restricts it to your organization, which would stop you connecting a personal Gmail account at all.
Internal and External audience options, with External selected and its description highlighted
It says the app starts in testing mode. The next section deals with that.
4

Contact email

Your address again. This is where Google writes if something about the project changes.
The contact information step, asking for an email address
5

Agree and create

Tick the policy box and press Create.
All four configuration steps complete, with the policy checkbox ticked and a create button
The OAuth overview screen right after creation, with a confirmation toast reading OAuth configuration created

​
2. Publish it

Skip this and your accounts will sign themselves out about once a week, every week, each time needing a Reconnect. Thirty seconds now avoids that.
1

Press Publish app

Go to Audience in the left menu. The publishing status reads Testing; that is the setting that expires sign-ins every seven days. Press Publish app.
The Audience screen, with the publishing status reading testing and a publish app button highlighted
If Google says required information is missing instead of publishing, go to Branding in the left menu. It wants an app domain, and links for the application home page, privacy policy, and terms of service. This app is only for your own accounts, so what you put there is not checked; the installer’s Create your OAuth client card has this address ready to copy. Enter it as-is for the domain field, and with https:// in front for the other three links. Save, then come back here and press Publish app again.
2

Confirm

You are warned that verification may be required. Press Confirm anyway. An unverified app works perfectly well for your own accounts.
The dialog asking whether to push the app to production, with a confirm button
3

Check it took

It should now read In production.
The publishing status now reading production, with a note that this is the state to look for
Publishing does not make this available to anyone else. The only person who can connect an account is still whoever gets through your Google sign-in.

​
3. Create the client

Now for the two values themselves. Make the client in the project your hub runs in. The console can hold several projects, and a client only works for the project it was made in, so a client copied out of a different one is the usual reason a connected account cannot do anything. The one case where they legitimately differ is covered in Developer Preview; if it happens by accident, see connecting an account with the wrong OAuth client.
1

Create client

Go to Clients in the left menu and press Create client.
An empty list of OAuth clients, with a create client button
2

Choose the application type

Leave Application type as Web application.
The application type dropdown, open, with Web application highlighted at the top
3

Name it, and add the redirect address

Name it whatever you will recognise. Further down, under Authorized redirect URIs, press Add URI and paste the address the installer gave you. It is on the OAuth card, step 3, with a copy button beside it.
The create client form, with the name field and the redirect URI field, alongside the installer's own OAuth card showing exactly where that redirect address comes from
This address has to match exactly. Use the copy button rather than typing it. If it is wrong, Google refuses the connection later and says the redirect address does not match.
Then press Create.
4

Copy both, now

The Client ID and Client secret appear together.
The dialog confirming the OAuth client was created, showing the client ID and client secret side by side, each with a copy button
Copy both before closing that dialog. The secret is shown once. If you lose it, see below.
Paste them into the hub’s add account screen and you are done here.

​
Finding your client again

The client stays listed under Clients in the console for as long as you need it.
The clients list showing the newly created client by name
Opening it shows the client ID again, and any account you connected later can be checked against it.
The client's detail page, with the client ID visible and an Add secret button for issuing a new client secret
The secret itself is not shown again; that is Google’s own rule, not the hub’s. If you lost it, press Add secret to issue a new one, then update whichever accounts used the old client with the fresh value.

​
How many projects you need

Almost always one. A personal Gmail account and a work Workspace account can share it. A second project comes up only when a Workspace account is involved, for one of two reasons. Either the organization blocks unverified apps, in which case that account cannot reach the consent screen at all, or you simply do not want people in the organization seeing the unverified warning. Either way the Workspace side gets its own project, owned by that organization, with its own client. Both projects then need Developer Preview approval. The installer’s Does your Workspace org block unverified apps? card sets the second one up and gives you both project numbers in one line to paste into the application.

​
Next