Connect Google for your Workspace (admin steps)

SmartMemory connects to Google (Sheets, and other Google apps as they become available) through an OAuth client. By default every workspace uses SmartMemory's shared client. If your organization runs Google Workspace, an admin can create an OAuth client inside your own Google Cloud project and give it to SmartMemory. Your team's new Google connections then use your client.

Why use your own client

Google asks apps that read user data to go through its app verification. A client whose consent screen is set to Internal is only usable by accounts in your own Google Workspace organization, and Google does not require verification for it. Your users see your organization's app name on the consent screen and no unverified app warning.

This applies only to users of your organization. People outside it cannot use an Internal client. Any SmartMemory workspace that has not saved its own client keeps using SmartMemory's shared client, so nothing changes for anyone else.

What you need

• A Google Workspace account with permission to create Google Cloud projects (or an existing project you manage).
• Admin rights on the SmartMemory workspace you want to set up.

Step 1: Create a Google Cloud project

1. Open the Google Cloud console signed in with your Google Workspace account.
2. Create a new project for SmartMemory, or pick an existing one your organization owns.

Step 2: Set up the OAuth consent screen as Internal

1. In the console, open APIs & Services, then OAuth consent screen. Newer consoles call this area Google Auth Platform.
2. Set the user type (shown as Audience in newer consoles) to Internal.
3. Fill in the app name your users will see, a support email and a developer contact email, then save.

If Internal is not offered, either the account you are using is not part of a Google Workspace organization, or the Google Cloud project is not inside your organization. Use an account from your organization, and create the project under your organization's resource in Google Cloud.

Step 3: Create a Web application client

1. Open Credentials (or Clients), then choose Create credentials and OAuth client ID.

2. Choose Web application as the application type and give it a name, for example "SmartMemory".

3. Under Authorized redirect URIs, add exactly:

   https://api.smartmemory.ai/memory/adapters/oauth/callback

4. Create the client. Google shows a client ID and a client secret. Keep this window open, or download the details, for Step 5.

The redirect URI must match exactly, including https and the path. SmartMemory always sends users back to this address, whichever client is used.

Step 4: Enable the Google APIs

In APIs & Services, open Library and enable the API for each Google app your team will connect:

Enable only the ones you plan to use. A connection to a Google app whose API is not enabled fails when it first reads data.

Step 5: Save the client in SmartMemory

Save the client with the SmartMemory API, signed in as yourself (your normal sign-in token). Send PUT /memory/adapters/oauth/clients/google with the workspace header and a body of {"client_id": "...", "client_secret": "..."}.

Only workspace admins can save or remove the client, and only when signed in as a person. An API key cannot, whatever its scopes. Every refusal gets the same message. To remove the client, send DELETE /memory/adapters/oauth/clients/google, and GET on the same address shows which client is active.

After saving, SmartMemory shows a short fingerprint of the client ID so you can confirm which client is active. The client secret is stored encrypted and is never shown again, in the app or through the API. The client ID is never shown again either, except that it appears in the Google sign-in address SmartMemory builds when someone connects, as Google requires.

SmartMemory checks only that the values look like a Google web client. It does not send your secret to Google to test it, so the first real check happens when someone connects. If Google rejects the client at that point, the connection stops with the message "This connection needs an operator to act." and an admin needs to fix the client.

What happens to existing connections

• New connections made after you save use your client.
• Connections made before keep working with the client that created them. Ask their owners to reconnect if you want them on your client.
• Changing only the secret (same client ID) keeps every existing connection working.
• Switching to a different client ID moves new connections to the new client. Connections made with the old one keep working while it is still valid in Google.
• Removing your client sends new connections back to SmartMemory's shared client. Connections made with your client stop refreshing and must be reconnected. SmartMemory tells you how many connections are affected when you remove it.

Troubleshooting

• "redirect_uri_mismatch" from Google: the redirect URI in Step 3 does not match exactly. Copy it again from this page.
• "Access blocked" or an org_internal error for a user: the user is signing in with an account outside your Google Workspace organization. Internal clients work only for your organization's accounts.
• A connection says "This connection needs an operator to act.": one common cause is that Google rejected the client ID or secret. Check that the client still exists in Google Cloud and save it again with the API call in Step 5.