> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/google-chat.md). # Google Chat Connect your company's Google Chat to Cakewalk's MCP Gateway. Every agent tool call against Google Chat passes through the gateway and is evaluated against your Policies. Cakewalk connects to Google Chat through one Cakewalk owned OAuth app with a fixed client ID. Before employees can connect, a Google Workspace super admin authorizes that client ID in the Google Admin Console. There are no credentials to create or paste: once the app is authorized, each employee signs in and approves access, and Google issues the access token. This is what sets the Google Connections apart from most of the catalog. Servers like Stripe and Atlassian register a new OAuth client automatically on each connection, so there is nothing to authorize ahead of time. Google Chat uses a fixed Cakewalk client ID, which is what lets your company's Workspace admin trust it once and scope what it can access. ## Requirements * A Google Workspace super admin who can open the Google Admin Console. * A Cakewalk Admin who can enable the Connection. ## Step 1: Enable the Connection in Cakewalk 1. Sign in to Cakewalk as an Admin at . 2. Go to All Connections. 3. Find Google Chat and enable it for your company. ## Step 2: Authorize Cakewalk in the Google Admin Console {% hint style="info" %} This authorization is one time for all Google Connections. If your Workspace admin already authorized Cakewalk's Google client ID for another Google product (Gmail, Google Drive, Google Calendar or the Google People API), it is already trusted and you can skip to Step 4. If you restricted it to specific scopes, add this product's scopes from Step 3. {% endhint %} Managed Workspace accounts cannot grant access to a third party app until an admin authorizes it. Authorize Cakewalk's app once for the whole domain. 1. Sign in at [admin.google.com](https://admin.google.com) as a super admin. 2. Go to **Security**, then **Access and data control**, then **API controls**. 3. Select **Manage third-party & internal app access**. 4. Select **Add app**, then **OAuth App Name Or Client ID**. 5. Search for Cakewalk's published Google client ID and select it. The Google Workspace Connections all share one client ID, so if you already authorized it for another Google Connection it is listed here: ``` 515823586954-dg0ptg9no12bjhb3g2j1gjnmrefdgh5r.apps.googleusercontent.com ``` 6. Choose the organizational units that may use the Connection. The default is **All Users**. 7. Set the access level to **Trusted**. 8. Select **Configure** and confirm. ## Step 3: Restrict to Specific Scopes (Optional) Instead of Trusted, you can hold Cakewalk's app to a named set of scopes. In step 7 above, choose **Specific Google services or scopes**, then add the scopes the Google Chat MCP server requires: | Scope | Access | | --------------------------------------------------------------- | ----------------------- | | `https://www.googleapis.com/auth/chat.spaces.readonly` | Read space information | | `https://www.googleapis.com/auth/chat.memberships.readonly` | View membership details | | `https://www.googleapis.com/auth/chat.messages.readonly` | Read messages | | `https://www.googleapis.com/auth/chat.messages.create` | Send messages | | `https://www.googleapis.com/auth/chat.users.readstate.readonly` | Read user read state | The Google Workspace MCP servers are in Google's Developer Preview Program, so this scope set can change before general availability. ## Step 4: Connect From Cakewalk No credentials change hands. Once the app is authorized, employees connect themselves: 1. From an agent platform connected to Cakewalk, an employee signs in to Google and approves access. 2. Google issues the access token scoped to that employee's own Chat spaces and messages. ## Verifying It Works The Google Chat Connection card flips to Active on All Connections. From an agent platform connected to Cakewalk, ask the agent to list recent spaces or messages. If Google Chat returns results, the Connection is live. ## Troubleshooting * Sign in is blocked or access is denied: confirm the Cakewalk client ID is listed under **Manage third-party & internal app access** in the Google Admin Console and set to **Trusted**, or that the scopes you allowed cover the ones above. * Access works for some employees but not others: check that their organizational unit is included in the app authorization. The default is **All Users**. * Each employee sees only the spaces and messages they belong to. Cakewalk's app carries no standing access of its own; access is scoped to the account that signs in. ## Learn More * [Control which third-party & internal apps access Google Workspace data](https://support.google.com/a/answer/7281227) * [Configure the Google Chat MCP server](https://developers.google.com/workspace/chat/api/guides/configure-mcp-server) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/google-chat.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.