Google

Call Google APIs (Gmail, Calendar, Drive, Sheets) as the signed-in Google user.

Workspace Suites
OAuth 2.0 + PKCE
Works on Free plan
Bundled in Kirak
Maintained by Kirak

How to use it

This profile ships with Kirak. Add "integrations" to modules in kirak.json, then name the profile as below. There is nothing to download, and a copy in your project's integrations/ folder is an error.

Environment variables

Variable	Holds
`KIRAK_INTEGRATION_GOOGLE_CLIENT_SECRET`	The OAuth client secret from the vendor's console. Secret: keep it out of kirak.json and out of source control.
`KIRAK_AUTH_ENCRYPTION_KEYS`	Encrypts stored tokens. Shared by every integration; the module refuses to start without it.

The names follow the integration's name in kirak.json (google here). Name it something else, such as google_sales, and the variables change to match.

Redirect URL

Register this as the redirect (callback) URL in the vendor's console, with your app's address in place of <your-app> (the base_url in kirak.json):

https://<your-app>/integrations/google/callback

How to get your keys

In the Google Cloud console, pick or create a project.
Under APIs & Services > Library, enable each API your app calls (Gmail, Drive, Calendar, Sheets, …).
Configure the OAuth consent screen: app name, support email, and the scopes your app asks for. The default scopes are: openid (Sign in with an OpenID Connect identity), email (See the user’s email address)
Under Credentials, choose Create credentials > OAuth client ID > Web application, and add https://<your-app>/integrations/google/callback under Authorized redirect URIs.
Copy the client ID and the client secret.
Put the client ID in kirak.json as integrations.providers.google.client_id, and the client secret in the environment as KIRAK_INTEGRATION_GOOGLE_CLIENT_SECRET. Never put the secret in kirak.json.
Sensitive and restricted scopes (Gmail, most of Drive) need Google’s app verification before people outside your test users can connect.

The vendor's own guide · Instructions out of date? ·Suggest an edit

kirak.json

Scopes openid Sign in with an OpenID Connect identity email See the user's email address profile See the user's basic profile https://www.googleapis.com/auth/drive.file Per-file access to files the app creates or opens https://www.googleapis.com/auth/calendar.readonly Read-only access to calendars https://www.googleapis.com/auth/gmail.readonly Read Gmail messages and settings https://www.googleapis.com/auth/spreadsheets Read and write Google Sheets

{
  "integrations": {
    "providers": {
      "google": {
        "type": "oauth2",
        "profile": "google",
        "client_id": "your-client-id",
        "scope": [
          "openid",
          "email"
        ]
      }
    }
  }
}

Merged into the profile: scope replaces the profile's default scopes.

Good to know

A refresh token is returned only on the first authorization, and only with access_type=offline. prompt=consent makes the consent screen show again, so a refresh token comes back.
The account comes from the id_token, which needs the openid scope (kept by default).
The verify path is the userinfo endpoint. The Discovery document names openidconnect.googleapis.com/v1/userinfo as the userinfo endpoint; the live check confirms the path on the base_url host before a release.
Scope meanings are short summaries; check Google's scopes reference before a release.

Example calls

GET /drive/v3/files: List the user's Drive files the app can see

Help improve this profile

Report a problem ·Suggest an edit to profile.json ·Add a profile ·Vendor docs the profile was checked against

Product names and logos are trademarks of their respective owners. Their use does not imply endorsement. To ask for this icon to be removed, email trademark@kirak.io.