# Google Workspace setup

This guide is for the Google Workspace Administrator setting up domain-wide delegation for Connect The Dots. Once complete, CTD can process email accounts for users in your organization — no action required from individual employees.

**Who does this:** Your Google Workspace super administrator. The whole process takes under five minutes.

## Steps

1. Go to [admin.google.com → Security → API controls → Domain-wide delegation](https://admin.google.com/ac/owl/domainwidedelegation)
2. Click **Add new**
3. Enter the following:
   - **Client ID:**`112764625517011504363`
   - **OAuth scopes** (see table below for your access level)
4. Click **Authorize**
5. You're done — let your CTD Account Executive know and they'll verify the connection

## OAuth scopes by access level

Choose the row that matches the access scope you agreed on with your Account Executive. Copy the full list of scopes and paste them into the OAuth scopes field, one per line or comma-separated.

| Scope | OAuth scopes to enter |
| --- | --- |
| **Metadata only** | `https://www.googleapis.com/auth/gmail.metadata`<br>`https://www.googleapis.com/auth/admin.directory.user.readonly` |
| **Metadata + Send** | `https://www.googleapis.com/auth/gmail.metadata`<br>`https://www.googleapis.com/auth/admin.directory.user.readonly`<br>`https://www.googleapis.com/auth/gmail.send` |
| **Read-only** | `https://www.googleapis.com/auth/gmail.readonly`<br>`https://www.googleapis.com/auth/admin.directory.user.readonly` |
| **Read-only + Send** | `https://www.googleapis.com/auth/gmail.readonly`<br>`https://www.googleapis.com/auth/admin.directory.user.readonly`<br>`https://www.googleapis.com/auth/gmail.send` |

**What these scopes allow:** CTD is authorized to read the list of users in your workspace (`admin.directory.user.readonly`) and fetch their emails — and, if you chose a Send scope, send emails on their behalf for ghost email workflows. Nothing beyond what's listed here.

## More information

Google's own documentation on domain-wide delegation: [Delegate domain-wide authority to your service account](https://developers.google.com/admin-sdk/directory/v1/guides/delegation), section "Delegate domain-wide authority to your service account."

## Revoking access

Return to [domain-wide delegation](https://admin.google.com/ac/owl/domainwidedelegation), find Client ID `112764625517011504363`, and click **Delete**. CTD immediately loses all access.

Have a question or running into an issue? Email us at [support@ctd.ai](mailto:support@ctd.ai) — we're happy to help.