Skip to main content

Google Workspace Accounts

Personal Gmail accounts (@gmail.com and @googlemail.com) can usually connect Gravity Rail's Google integrations on their own. Google Workspace accounts (you@radiusclinic.com, you@yourhospital.org, and any other company-managed Google domain) often cannot — not because Gravity Rail rejects those accounts, but because the Workspace admin has blocked unverified third-party apps from reading Gmail, Drive, Sheets, or Calendar.

This page is the allowlist your Google Workspace administrator needs. Send it to whoever owns admin.google.com for your domain.

Why Sign-In Works but Connectors Don't​

Sign in with Google only asks Google who you are (openid, email, and profile). Those are identity scopes. Most Workspace domains allow them, which is why people can log into Gravity Rail with a Workspace account even when Gmail or Sheets later fail.

Gmail, Calendar, Drive, and Sheets ask Google for the mailbox, calendar, or files themselves. Google classifies those scopes as sensitive or restricted. Until Gravity Rail completes Google's OAuth verification for each connector, Workspace treats the apps as unverified. A domain that blocks unverified third-party API access then shows one of these:

  • "This app is blocked"
  • "Access blocked: This app's request is invalid"
  • "Error 400: admin_policy_enforced"
  • "The app is requesting access to sensitive info in your Google Account" and then a hard stop
  • The Google picker never lists the Workspace account, or consent succeeds and Gravity Rail still has no grant

A personal Gmail account has no Workspace admin, so the same connector works there.

What Your Google Workspace Admin Should Do​

A Google Workspace Super Admin (or someone with the Service Settings privilege) completes this once per domain. After it propagates, every member on that domain can connect Gmail, Calendar, Drive, and Sheets.

  1. Sign in to the Google Admin console.
  2. Go to Security → Access and data control → API controls. Direct link: admin.google.com/ac/owl.
  3. Click Manage third-party app access (some consoles label this Manage App Access).
  4. Click Configure new app.
  5. Choose OAuth App Name or Client ID.
  6. Paste one of the client IDs from the table below and click Search.
  7. Select the Gravity Rail app Google returns.
  8. Apply it to the whole organization (leave the top organizational unit selected), unless you intentionally want only a test OU.
  9. Set Access to Google data to Trusted.
    • Trusted is required for Gmail. Gmail uses restricted scopes; Limited is not enough.
    • Calendar, Drive, and Sheets can use Trusted or Specific Google data with the scopes listed below. Trusted is the simplest choice and covers every Gravity Rail Google connector.
  10. Click Continue, then Finish.
  11. Repeat steps 4–10 for each remaining client ID. Gravity Rail uses a separate OAuth client per connector. Allowlisting Gmail does not allow Sheets.

Changes usually take a few minutes. Google documents up to 24 hours.

Then the Gravity Rail member retries Connect (or Add account) on the connector. Use a private/incognito window if the previous attempt is still showing the blocked-app screen.

Production client IDs​

These are the production Gravity Rail OAuth client IDs. They are public identifiers (they appear in the Google consent URL). They are not secrets.

ConnectorOAuth client ID
Gmail567997448812-q56fkpbbl16qlgo39f2f2rot735t5a5p.apps.googleusercontent.com
Google Calendar567997448812-7lmu8c8ej97ehj8njdp9iralidur35m5.apps.googleusercontent.com
Google Drive567997448812-hc8mtb5jrg5elobrdk2l9e95169c4gem.apps.googleusercontent.com
Google Sheets567997448812-27qlmk03sienqofegt74d56psgmogiop.apps.googleusercontent.com

Search by client ID, not by the name "Gravity Rail". Several Gravity Rail clients exist (login plus each connector), and name search can return the wrong one.

Scopes each connector requests​

If the admin prefers Specific Google data instead of Trusted, allow exactly these Google scopes for that client. Always include the three identity scopes — Google Sign-In needs them to tell Gravity Rail which account connected.

ConnectorGoogle scopes
Gmailopenid, userinfo.email, userinfo.profile, gmail.readonly, gmail.send, gmail.modify
Google Calendaropenid, userinfo.email, userinfo.profile, calendar
Google Driveopenid, userinfo.email, userinfo.profile, drive.readonly, drive.file
Google Sheetsopenid, userinfo.email, userinfo.profile, spreadsheets, drive.readonly

Sheets includes drive.readonly because the Sheets API has no search endpoint. Finding a spreadsheet by name uses Drive's file list, filtered to spreadsheets.

Also check these if Trusted still fails​

  • Settings for unconfigured third-party apps (on the same API controls page). If this is Don't allow users to access any third-party apps, only apps you have explicitly configured will work — which is why the steps above matter.
  • Manage Google Services. If Gmail, Drive, or Calendar is set to Restricted, only Trusted or Specific Google data apps can use them. Confirm the Gravity Rail client is Trusted, not merely Limited.
  • Context-Aware Access. If the domain uses CAA levels that block API access, either exempt the Gravity Rail client or add it to the allowed apps for that level.
  • The person connecting must already be able to open the mailbox, calendar, or file in Google itself. Gravity Rail cannot see more than that Google account can.

After the Admin Finishes​

  1. In Gravity Rail, open App Connections → Active (or Directory if the connector is not installed yet).
  2. Open Gmail, Google Calendar, Google Drive, or Google Sheets.
  3. Click Connect or Add account.
  4. Sign in with the Workspace account and approve the permissions.

You can connect more than one Google account per connector (for example a personal Gmail and a Workspace account) with Add account.

Healthcare and PHI​

Spreadsheet cells, Drive files, Gmail bodies, and Calendar event text can contain Protected Health Information. Only connect a Google account whose contents your organization is allowed to process in Gravity Rail. Do not put patient names, diagnoses, or clinical notes in Google Calendar titles if your Google Workspace is not covered by a Business Associate Agreement.