MCPWhy we built it this way
Most tools ask you to trust one vendor-owned app that every customer shares. We think that is the wrong shape for mailbox access, and Google’s own rules push the same direction: reading Gmail uses scopes Google classifies as restricted, and a shared public app requesting them carries a much larger blast radius. An OAuth client you own changes five things:To be precise about what this does and does not cover: owning the client controls authorization, who may connect and how access is revoked. It does not change where matched email is stored. GainTrace still holds the customer email it captures, under the rules described in Connect email and calendar. Client ownership makes the door yours; it does not make the room empty.
Before you start
You need all three:What GainTrace asks for
Review these before you create the client. Your organization owns the consent decision, so it is worth knowing exactly what you are granting:
Nothing here writes to your mailbox except
gmail.send, and that only fires when a person clicks send in GainTrace. Nothing deletes, and nothing changes settings.
GainTrace also discards most of what it reads. Only email involving a known Company domain or a saved Person is stored; everything else is dropped during sync.
Set up your client
1
Open the setup in GainTrace
Go to Settings > Email & Calendar and click the Google Workspace tile under Add Connection. The guided setup opens in place, with a link to the right Google Cloud Console page at every step. Keep it open, you will copy a redirect URI from it in step 5.
2
Create a Google Cloud project
In Google Cloud Console, create a project owned by your organization, then enable the Gmail API and the Google Calendar API.
3
Set the consent screen to Internal
Under APIs & Services > OAuth consent screen, choose Internal. This is what confines the app to your organization, so do not skip it.
4
Create the OAuth client
Under Credentials, create an OAuth client ID of type Web application.
5
Add the redirect URI
Copy the URI shown under Authorized redirect URI in the GainTrace panel and paste it into Authorized redirect URIs on your client. This stays a GainTrace URL. Your client points back to GainTrace after someone consents, so there is nothing to host on your side.
6
Save it in GainTrace
Paste the client ID and client secret into the setup, then click Save and continue. The secret is encrypted before it is stored and is never shown again.
7
Connect your mailbox
Saving takes you straight to Connect your mailbox, so setup ends in a working connection rather than a saved form. Everyone else connects from the same Google Workspace tile.
Rotate your client
Open the Google Workspace tile, click Replace, then paste a new client ID and secret. Existing connections keep working. Google ties a refresh token to the client that issued it, so GainTrace keeps refreshing each connection against the client it was authorized under, not whichever client is current. Nobody is logged out and no sync breaks. Those connections stay on the previous client until each person reconnects, though. The panel shows how many are in that state as still on a previous client.Remove your client
Open the Google Workspace tile, click Remove, and confirm. There is nothing to fall back to, so this ends the workspace’s ability to connect Google entirely. Every mailbox authorized through the client is disconnected, because those tokens are only valid for the client being removed and leaving them connected would mean syncs that quietly stop working. The confirmation dialog tells you exactly how many connections will be disconnected before you commit. Email already captured stays on your Company timelines.Good to know
- Gmail and Google Calendar share one client. Setting it up covers both.
- Microsoft 365 needs none of this. Microsoft has no equivalent restriction, so Outlook connects with no extra setup.
- The client ID is not a secret. It appears in the consent URL, so every member can see it in the panel. The client secret is encrypted at rest and never returned to the browser after you save it.
- One client serves the whole workspace. Each person still connects their own mailbox individually.
- Google sets the rules for consent screens and scopes, and can change them. The behavior described here reflects Google’s documentation as of August 2026.
FAQ
Can I use GainTrace’s client instead? There isn’t one. Every workspace connects Google through a client it owns. Can I use a personal Gmail account? No. Only a Google Workspace organization can set a consent screen to Internal. Without it, Google expires refresh tokens after 7 days and everyone reconnects weekly. How do I cut off GainTrace’s access immediately? Disable or delete the OAuth client in your Google Cloud Console. Every token stops working at once, with no action needed from us. You can also remove the client inside GainTrace, which disconnects every mailbox. Will people have to reconnect after I rotate the client? Not immediately. Existing connections keep syncing on the client that authorized them, and move across the next time each person reconnects. Can regular members set this up? No. Saving or removing the client requires Owner or Admin. Members see the panel read-only. Does this mean GainTrace cannot read my email? It means GainTrace can only read it while your client grants access, and only the messages involving your Companies and People. Everything else is discarded at sync time.Related articles
Email & Calendar
Connect a mailbox, and what GainTrace does and does not store.
Members and roles
Owner and Admin roles, and who can change workspace settings.
Governance
How GainTrace handles your workspace data.
Integrations
Browse the catalog and manage your connected sources.