Choose OAuth or a service account
The Add a connector dialog offers two routes to Google:
Both routes create a credential and an allowed-websites rule for the Google hosts the connector uses.
Add the connector with Google sign-in
Go to Organization settings > Claude Tag > Connectors, click Add, and select Google Drive, Google Calendar, or Gmail. The connect form lists the Google hosts the connector can reach; there are no scopes to choose. The first credential you add for a service from the Connectors tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see where a new connector applies before you sign in. Click Sign in with Google Drive (or Sign in with Google Calendar, or Sign in with Gmail), approve the Google consent screen, and the credential is saved. The connector’s reach is whatever the signed-in Google account can see. Share the relevant folders and calendars with that account in Google before testing.Add the connector with a service account
Go to Organization settings > Claude Tag > Connectors, click Add, and select Custom connector. Fill in these fields in the connect form.
The first credential you add for a service from the Connectors tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see where a new connector applies before you save the connector. Click Connect to save the connector.
For Google Workspace data (Drive, Calendar, Gmail, Docs), the service account needs domain-wide delegation configured in your Google Admin console. In the service account’s domain-wide delegation entry, list every scope you entered in Scopes, or
https://www.googleapis.com/auth/cloud-platform if you left Scopes empty. Google’s guide is at developers.google.com/identity/protocols/oauth2/service-account.
Google refuses the token request when the domain-wide delegation entry is missing one of the requested scopes. Claude then reports HTTP 502 with a reason that starts with injection failed ("<connection name>").
The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See how Agent Proxy works.
Verify the connection
In a channel where the connector is on, in a new thread:Related resources
- What this connection adds: grounding answers in your team’s documents
- Give Claude access: the full credential-type and allowed-hosts reference