ClearFoxGoogle OAuth Setup
- 1
What this creates: one Google Cloud project and one Web application OAuth client. That single app powers portal sign-in (SSO) and every Google integration (Gmail, Calendar, Sheets, Drive, Docs, Slides, Analytics OAuth, BigQuery). ClearFox customers use Google Workspace — set the consent screen to Internal so only accounts in your org can connect (no “unverified app” warning, no weekly re-auth).
- 2
Prerequisite — HTTPS: Google rejects non-HTTPS redirect URIs in production. Your Portal URL in Admin → Settings must be
https://…. If it is still HTTP, finish HTTPS Requirement first. - 3
1. Create or select a Google Cloud project. Open Google Cloud Console. Click the project picker at the top bar → New project. Name it e.g.
ClearFox→ Create. When it finishes, select that project in the picker so every later step applies to it. - 4
2. Configure the OAuth consent screen (Internal). Go to APIs & Services → OAuth consent screen. If Google shows a wizard, click Get started. Set App name (e.g. ClearFox), User support email, and Developer contact email. Under Audience (or User type), choose Internal → Create / Save. Internal only appears when you are signed in with a Workspace account that can manage the org. If you only see External, you are on a personal Google account — switch to a Workspace admin account and use a project owned by that org.
- 5
3. Enable the Google APIs you need. Open APIs & Services → Library. For each API below: open the link → click Enable. Recommended: enable all once so later integrations just work.
Gmail API
Google Calendar API
Google Sheets API
Google Drive API
Google Docs API
Google Slides API
Google Analytics Data API (only if you use Analytics)
BigQuery API (only if you use BigQuery) - 6
4. Add OAuth scopes (Data Access). Back on OAuth consent screen → open Data Access (or Scopes) → Add or remove scopes. Use the filter box to find each scope, tick it, then Update → Save. ClearFox still requests scopes when a user clicks Connect; listing them here documents what the app needs and avoids surprises on the consent screen.
- 7
Path A — enable everything (recommended). Add all of the scopes below: paste one line into the scope picker’s filter box, tick the matching row, then move on to the next line.
openid profile email https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/gmail.readonly https://www.googleapis.com/auth/gmail.send https://www.googleapis.com/auth/gmail.compose https://www.googleapis.com/auth/gmail.labels https://www.googleapis.com/auth/gmail.modify https://www.googleapis.com/auth/calendar.readonly https://www.googleapis.com/auth/calendar.events https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/spreadsheets.readonly https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/documents.readonly https://www.googleapis.com/auth/documents https://www.googleapis.com/auth/presentations.readonly https://www.googleapis.com/auth/presentations https://www.googleapis.com/auth/drive.metadata.readonly https://www.googleapis.com/auth/analytics.readonly https://www.googleapis.com/auth/bigquery.readonly - 8
Path B — only the integrations you will use. Always keep the SSO scopes, then add only the groups you need: Gmail, Calendar, Sheets, Drive, Docs, Slides, Analytics (OAuth), BigQuery (OAuth). Lines starting with # below are group labels, not scopes. Short names are enough — type one into the scope picker’s filter box and tick the matching row (the full URLs are the same as in Path A).
# SSO — always openid profile email userinfo.email # Gmail gmail.readonly gmail.send gmail.compose gmail.labels gmail.modify # Calendar calendar.readonly calendar.events calendar # Sheets spreadsheets.readonly spreadsheets # Drive drive.readonly drive # Docs documents.readonly documents drive.metadata.readonly # Slides presentations.readonly presentations drive.metadata.readonly # Analytics (OAuth) analytics.readonly # BigQuery (OAuth) bigquery.readonly - 9
5. Create the OAuth client (Web application). Go to APIs & Services → Credentials → Create credentials → OAuth client ID. Application type: Web application. Name: e.g.
ClearFox Portal. Under Authorized redirect URIs click Add URI twice and paste both (replace with your real portal host):https://ai.yourcompany.com/api/auth/callback/google https://ai.yourcompany.com/api/oauth/callback Click <strong>Create</strong>. Copy the <strong>Client ID</strong> and <strong>Client Secret</strong> immediately (the secret is shown once). Both URIs are also listed in ClearFox Admin → OAuth when Google is in “My own OAuth app” mode. - 10
6. Paste credentials into ClearFox. In ClearFox open Admin → OAuth → Google subtab → switch mode to My own OAuth app → paste Client ID and Client Secret → Save. The same Google app is used for integrations and portal SSO — do not create a second client.
- 11
7. Smoke-test Connect. Still in Admin → OAuth (or open Integrations → Gmail), click Connect Google Account. Sign in with a Workspace account from your org and approve the permissions. Success = the account appears as connected. Common failures: API not enabled (“accessNotConfigured”) → finish step 3; wrong redirect URI → URI must match Portal URL exactly including https; External audience by mistake → switch consent screen to Internal (step 2).
- 12
Next: connect each integration you need — start with Gmail, or jump to Calendar, Sheets, Drive, Docs, Slides, BigQuery from the docs list. Each guide assumes this OAuth app is already saved.