Skip to content

Google Services OAuth (Admin Setup)

This is the one-time setup for a shared Google OAuth app in MindRoom. After you finish these steps, users only click Login with Google in the frontend.

Who This Is For

Use this guide if you are running MindRoom for a team, organization, or hosted deployment.

If you are a single local user and want to bring your own Google OAuth app, see Google Services OAuth (Individual Setup).

What You Need Before Starting

  • Your MindRoom URL (local example: http://localhost:8765, production example: https://mindroom.example.com)
  • Access to Google Cloud Console
  • Access to set MindRoom environment variables

The MindRoom callback path is always:

/api/google/callback

Your full callback URL is:

<your-mindroom-origin>/api/google/callback

Step 1: Create a Google Cloud Project

  1. Open Google Cloud Console.
  2. Create a new project (or select an existing one).
  3. Save the project ID. You will use it as GOOGLE_PROJECT_ID.

Step 2: Enable APIs

  1. In Google Cloud Console, go to APIs & Services → Library.
  2. Enable:
  3. Gmail API
  4. Google Calendar API
  5. Google Drive API
  6. Google Sheets API
  1. Go to APIs & Services → OAuth consent screen.
  2. User type:
  3. External for public or mixed users
  4. Internal for Google Workspace-only
  5. Fill required app info and save.
  6. Add test users if app is still in testing mode.
  7. Add scopes:
  8. https://www.googleapis.com/auth/gmail.readonly
  9. https://www.googleapis.com/auth/gmail.modify
  10. https://www.googleapis.com/auth/gmail.compose
  11. https://www.googleapis.com/auth/calendar
  12. https://www.googleapis.com/auth/spreadsheets
  13. https://www.googleapis.com/auth/drive.file
  14. openid
  15. https://www.googleapis.com/auth/userinfo.email
  16. https://www.googleapis.com/auth/userinfo.profile

Step 4: Create OAuth Client ID

  1. Go to APIs & Services → Credentials.
  2. Click Create Credentials → OAuth client ID.
  3. Choose Web application.
  4. Under Authorized redirect URIs, add:
  5. Local: http://localhost:8765/api/google/callback
  6. Production: https://<your-domain>/api/google/callback
  7. Copy the generated client ID and client secret.

Step 5: Configure MindRoom Environment

Set these env vars in your MindRoom deployment (.env, Kubernetes secret, or hosting config):

GOOGLE_CLIENT_ID=your-app-client-id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your-app-client-secret
GOOGLE_PROJECT_ID=your-project-id
GOOGLE_REDIRECT_URI=http://localhost:8765/api/google/callback

Notes: - GOOGLE_REDIRECT_URI must match one of your Google Console redirect URIs exactly. - If omitted, MindRoom defaults to http://localhost:8765/api/google/callback.

Restart MindRoom after setting env vars.

Step 6: Verify MindRoom Is Configured

Run:

curl -s http://localhost:8765/api/google/status

Expected result includes: - "has_credentials": true

If connected is false at this point, that is normal until a user authorizes.

Step 7: Verify Frontend User Flow

  1. Open Integrations → Google Services.
  2. If setup is correct, the card shows Ready to Connect.
  3. Users can now click Login with Google and authorize access.

End User Steps (After Admin Setup)

Each user does only this: 1. Open Integrations → Google Services. 2. Click Login with Google. 3. Approve scopes. 4. Confirm status shows Connected.

Production Notes

  • Apps in testing mode are limited to test users.
  • For broad public usage, complete Google OAuth verification (consent screen, policies, branding, etc.).
  • Never commit GOOGLE_CLIENT_SECRET to git.

Security Notes

  • OAuth access/refresh tokens are stored in MindRoom credentials storage, typically:
  • mindroom_data/credentials/google_credentials.json
  • Restrict filesystem access to your MindRoom data directory.
  • Revoke app access from Google account settings if needed.

Troubleshooting

"Google OAuth is not configured"

GOOGLE_CLIENT_ID or GOOGLE_CLIENT_SECRET is missing in the MindRoom environment.

"Redirect URI mismatch"

Ensure all three are identical: - GOOGLE_REDIRECT_URI in the MindRoom environment - Redirect URI in Google Console - Actual MindRoom callback URL

Users cannot authorize while app is in testing mode

Add those users to OAuth consent screen test users.