- Internal: gives access only to people in the organisation
- then push Create
- then configure the required fields
- and below
Application Type : Web Application
Name : The Name of your client
Authorized redirect URIs :
```text
https://credentials-/oauth2/callback
```
Once created, you must keep the values on the screen under Client ID/Client Secret. If you don't want to lose them, you can use Download JSON to store them in a text file on your computer.
### 4. Creating a credential on Mindflow
:::note
To use the **`OAuth2 Authorization Code`** credential type for services like Gmail, you need to specify in the Authorization URL **`access_type=offline&prompt=consent`** to avoid having to authenticate every time the token expires (cf _screenshot)_
:::
When you press Create, a window will open allowing you to choose the Google account from which the OAuth client will be able to retrieve the data.
---
## 2. Create Service Account
:::note
Reference: [https://developers.google.com/identity/protocols/oauth2/service-account](https://developers.google.com/identity/protocols/oauth2/service-account)
:::
The Google OAuth 2.0 system supports server-to-server interactions such as those between a web application and a Google service. For this scenario you need a _service account_, which is an account that belongs to your application instead of to an individual end user.
**1.** Start with opening the [Google Cloud console](https://console.cloud.google.com/)
**2.** If you don’t have one already, create a Google Cloud Project: at the top-left, click `Menu` > `IAM & Admin` > `Create a project`.
[](https://docs.mindflow.dev/_next/image?url=https%3A%2F%2Fsuper-static-assets.s3.amazonaws.com%2F89012ca9-c2a6-46d0-a17c-45bb31cdc869%2Fimages%2F60338b73-6c67-49a6-bfdc-48925bf8787e.png&w=828&q=80)
**3.** In the `Project name` \***\*field, enter a descriptive name for your project. Then, in the `Organization & Location` \*\***fields, choose your domain, then click on **Create**. The console navigates to the Dashboard page and your project is created within a few minutes.
[](https://docs.mindflow.dev/_next/image?url=https%3A%2F%2Fsuper-static-assets.s3.amazonaws.com%2F89012ca9-c2a6-46d0-a17c-45bb31cdc869%2Fimages%2F1ab99419-5368-4138-b460-7a2ec762f225.png&w=828&q=80)
To access Google Alert Center, you need a Service account.
**4.** At the top-left, click on `Menu` > `IAM & Project` > `Service Accounts`
**5.** Click on `Create Service Account`
**6.** Fill in the details before clicking on `Create and Continue`
**7.** Select `Owner` Role and click on `Continue`.
**8.** Click on the `Done` button.
**9.** Click on the Service Account you just created.
**10.** Click on `Keys` > `Add key` > `Create new key`
After clicking on `Create new key`, select `Json` for the key type. Afterwards, your file is saved in your downloads.
## Enable APIs
**11.** Once in the project, you have to enable the APIs you need:
For example, to use Google Calendar API:
- Click on the search button and search “_Google Calendar API_”
- Click on the **`enable`** button :
- Then click on `Enable APIS and services`:
[](https://docs.mindflow.dev/_next/image?url=https%3A%2F%2Fsuper-static-assets.s3.amazonaws.com%2F89012ca9-c2a6-46d0-a17c-45bb31cdc869%2Fimages%2Faae7c5bb-2bee-4a60-9a1f-131b1c975754.png&w=3840&q=80)
You can add whichever ones like `Google Sheets API, Admin SDK API, etc.` if you think will be useful for you. Be careful to notify admin if you choose a new one so he can authorize it in domain wide-delegation.
## Set-up domain-wide delegation for a service account (Part for Google Admin)
**12.** Set-up domain-wide delegation for a service account:
- Still on your [Google Cloud console](https://console.cloud.google.com/)
- Click on `Menu` > `IAM & Admin` > `Service Account`.
- Select your service account and show **Advanced Settings**.
- Copy your `Client ID`, you’ll need it later.
- Click on **View Google Workspace Admin Console.**
- In the [Admin console](https://admin.google.com/), at the top-left, \*\*\*\*click on `Menu` > `Security` > `Access and data control` > `API controls`.
- Click on **Manage Domain Wide Delegation**.
- Click on **Add new**.
- Add the`Client ID` you copied earlier and enter the scopes you need such as [https://www.googleapis.com/auth/apps.alerts](https://www.googleapis.com/auth/apps.alerts) then click on `Authorize`.
**13.** Go back on the Mindflow platform.
- Go to **Vault**.
- Click on **Add a new credential**.
- Name your credential and choose **Google (Vendor)** as your attached service.
- Select **Google** as your credential type.
**14.** Dig up your Json file you downloaded in step 7.
- Copy your `Client email` \*\*\*\*you have in your Json file.
- Copy your `Private Key`. Make sure you include the entire field (everything that’s between quotes).
- Put this below in your `Scopes` according to the ones you wish to use. The scopes are separated with a space.
[https://www.googleapis.com/auth/spreadsheets](https://www.googleapis.com/auth/spreadsheets) [https://www.googleapis.com/auth/admin.directory.user](https://www.googleapis.com/auth/admin.directory.user) [https://www.googleapis.com/auth/calendar](https://www.googleapis.com/auth/calendar) [https://www.googleapis.com/auth/apps.alerts](https://www.googleapis.com/auth/apps.alerts)
- The `Subject` field’s **mandatory for Admin APIs** such as Admin SDK directory. The subject needs to be authorized to access the API. Otherwise, it’s not necessary.
**15.** Test those credentials in your playbook