Skip to content
Merulan

Google mailbox setup

What an operator supplies to connect the Google mailbox Source, and the verification the provider requires.

Connecting Google mailbox redirects the operator to the provider and returns with a grant. Merulan holds the credential directly. An operator who holds the material below connects in one pass.

Prerequisites

Google mailbox refuses the connection until every item holds.

  • A Google mailbox the operator may sign in to, or a delegated mailbox the operator already holds.
  • A Workspace administrator who allows the connected application when the domain restricts third-party access.

Credentials

Google mailbox stores the credential under the direct custody the registry declares, so Merulan never shows the secret again once the connection is saved.

  • No secret is typed into Merulan. The browser grant returns an access token and a refresh token, and Merulan seals both.

Scopes

Google mailbox requests the scopes the registry declares, and a grant missing one of them fails the first collection read.

  • https://www.googleapis.com/auth/gmail.modify
  • https://www.googleapis.com/auth/gmail.send
  • https://www.googleapis.com/auth/calendar.readonly

The mailbox scopes cover reading, labelling and sending. The calendar scope is read-only.

Verification

Provider verification with a CASA assessment governs the Google mailbox connection. Google classes the Gmail scopes as restricted, so the application carries a Google verification with a yearly CASA security assessment before a production mailbox connects.

  • Connect and map a Source runs the connect ceremony and binds collections once the credential is in hand.
  • Integrations lists every Source that carries a setup page, with its ceremony and verification posture.