Skip to main content
When you go to add a Google account to the hub, you get this.
The add account screen, with fields for an OAuth client ID and secret
An OAuth client ID and an OAuth client secret. Both come from Google, and this page is how you get them.

​
What it is, and why you have to make it

For the hub to read your Gmail, it has to prove to Google that you allowed it to. The OAuth client is that proof. We cannot make it for you. Google offers no way to create one automatically, so it has to be done in your own account, in the console. In return the client lives inside your own project. We never see it and never hold it. You make it once. Several accounts can share one client.
Allow about ten minutes. The installer’s Create your OAuth client card has a button for each step that opens the right console page, so you never have to go looking for one.
The consent screen is what Google shows when you connect an account, listing what is being asked for. It has to exist before a client can.
1

Get started

The installer’s Open consent screen button lands you here. Press Get started.
Google Auth Platform saying it is not configured yet, with a Get started button
2

Name it, and give an address

App name is for your own benefit. It is the name you will see when you connect an account. User support email is a dropdown; pick your own.
The first step, asking for an app name and a support email
3

Choose External

Choose External. Internal restricts it to your organization, which would stop you connecting a personal Gmail account at all.
Internal and External, with External selected
It says the app starts in testing mode. The next section deals with that.
4

Contact email

Your address again. This is where Google writes if something about the project changes.
The third step, asking for a contact email
5

Agree and create

Tick the policy box and press Create.
All four steps complete, with the Create button

​
2. Publish it

Skip this and your accounts will sign themselves out about once a week, every week, each time needing a Reconnect. Thirty seconds now avoids that.
1

Open Audience

This is the screen you land on. Go to Audience in the left menu.
The overview screen after the consent screen has been created
2

Press Publish app

The publishing status says Testing. That is the setting that expires sign-ins every seven days. Press Publish app.
Publishing status showing Testing, with a Publish app button
3

Confirm

You are warned that verification may be required. Press Confirm anyway. An unverified app works perfectly well for your own accounts.
The dialog asking whether to push to production
4

Check it took

It should now read In production.
Publishing status now reading In production
Publishing does not make this available to anyone else. The only person who can connect an account is still whoever gets through your Google sign-in.

​
3. Create the client

Now for the two values themselves.
1

Create client

Go to Clients in the left menu and press Create client.
An empty list of OAuth clients
2

Type, and the redirect address

Leave Application type as Web application and name it whatever you will recognise.Further down, under Authorized redirect URIs, press Add URI and paste the address the installer gave you. It is on the OAuth card, step 3, with a copy button beside it.
The create client form, showing the web application type and the authorised redirect URIs field
This address has to match exactly. Use the copy button rather than typing it. If it is wrong, Google refuses the connection later and says the redirect address does not match.
Then press Create.
3

Copy both, now

The Client ID and Client secret appear together.
Google's warning that the client secret cannot be viewed again once the dialog is closed
Copy both before closing that dialog. The secret is shown once. If you lose it, the only way forward is to delete the client and make another.
Paste them into the hub’s add account screen and you are done here.

​
How many projects you need

Almost always one. A personal Gmail account and a work Workspace account can share it. A second project comes up only when a Workspace account is involved, for one of two reasons. Either the organization blocks unverified apps, in which case that account cannot reach the consent screen at all, or you simply do not want people in the organization seeing the unverified warning. Either way the Workspace side gets its own project, owned by that organization, with its own client. Developer Preview has the fuller version, including why the setting is per project rather than per client. Both projects then need Developer Preview approval. The installer’s Does your Workspace org block unverified apps? card sets the second one up and gives you both project numbers in one line to paste into the application.

​
Next