Appearance
Google Connection
The Google Connection authorizes selected Google services for Cloud Flow, supported AI Agent capabilities, and authenticated Google SDK objects. A single Google Profile can include one or more supported services and scopes.
Google does not expose general Connection commands. Use Connection methods, the $io.google API, or a supported authenticated SDK object from Cloud Flow.
Capabilities
| Capability | Availability |
|---|---|
| Connection service identifier | google |
| Page Flow commands | Not available |
| Cloud Flow commands | Not available |
| Connection methods | Supported |
| Server API | $io.google |
| Authenticated SDK objects | Supported for documented Google service names |
| AI Agent Connection support | Supported |
Creating a Google Profile
The Google Profile uses a service-and-scope selector rather than a single generic scope field.
To create the Profile:
- Enter an alphanumeric Profile name.
- Add the Google services required by the Project.
- Choose read-only or fuller access where the selector provides that choice.
- Supply a custom Google client when a selected service requires one.
- Optionally add custom scopes as a JSON array when using a custom client.
- Save the Profile and complete Google authorization.
Grant the smallest set of services and scopes that supports the Project. A Profile can be reused, but creating a narrower Profile is safer than granting unrelated workflows access to the same Google account and permissions.
Available Service Selections
The Project Editor provides selections for:
| Selection | Scope Level | Notes |
|---|---|---|
| Google Drive | Files used with the application | Cannot be combined with Drive Full Access. |
| Google Drive (Full Access) | Full Drive create, read, update, and delete access | Requires a custom client. |
| Google Sheets (Read Only) | Read Sheets data | Requires a Drive selection. |
| Google Sheets (Full Access) | Read and modify Sheets | Requires a Drive selection. |
| Google Docs (Read Only) | Read Google Docs | Requires a Drive selection. |
| Google Docs (Full Access) | Read and modify Google Docs | Requires a Drive selection. |
| Gmail (Send) | Send messages without mailbox read or modify access | Cannot be combined with Gmail Full Access. |
| Gmail (Full Access) | Supported mailbox read and write operations | Requires a custom client. |
| Google Calendar | View and edit calendar events | Cannot be combined with Calendar Full Access. |
| Google Calendar (Full Access) | Broader calendar management | Requires a custom client. |
The editor prevents incompatible limited and full-access selections and prevents removing a Drive selection while a dependent Sheets or Docs selection remains.
Custom Google Client
Provide a Custom Client ID and Custom Client Secret when selecting a service marked as requiring a custom client or when adding custom scopes.
The custom OAuth application must have the required Google APIs enabled and must use the redirect configuration expected by the ioLoop authorization flow. Google consent-screen, testing-user, verification, and publishing requirements still apply to the external OAuth application.
Custom Scopes must be a valid JSON array. For example:
json
[
"https://www.googleapis.com/auth/example.scope"
]Custom scopes require a custom client. Only request scopes that the Project understands and is prepared to protect.
Connection Settings and Drive Files
When the Profile includes a Google Drive service, the Connection workflow provides a file picker for selecting Drive files for use with that Connection.
Use the file selection to keep a Connection focused on the files required by its workflow. A different Connection can reuse the Profile while selecting a different set of files.
Review selected files after replacing a Profile or changing its Drive scopes. The Google account used by the new Profile must be able to access the configured files.
Server Methods
The Google Server API provides methods across supported areas including:
- Drive file and folder creation, copying, moving, sharing, searching, export, download, and deletion.
- Sheets creation, reading, row and cell updates, formatting, and worksheet management.
- Docs template creation and content updates.
- Calendar and event listing, creation, updates, attendee changes, and deletion.
- Gmail labels, messages, threads, sending, archiving, updates, and deletion.
- Supported raw Google API requests.
Some methods are available only when the Profile includes the necessary service and provider scope. Use $io.google for exact methods, parameters, and return values.
Authenticated SDK Objects
Cloud Flow can request documented Google SDK objects with $io.system.sdkLibraryObjectFromConnection(...). Supported service names include:
google.auth.OAuth2google.drivegoogle.sheetsgoogle.docsgoogle.calendargoogle.oauth2
These SDK service names are passed to sdkLibraryObjectFromConnection; they are distinct from the Google Connection service identifier, google, used by Connection commands and methods.
The selected Profile must include the scopes required by the SDK operation. The presence of a Google library or API in the provider ecosystem does not mean its service name is supported by the helper.
Security
Google scopes can grant access to email, files, documents, spreadsheets, and calendars. Keep broad scopes in separate Profiles and use a custom client where required.
When exposing a Google operation through a Cloud Flow Web Hook:
- Validate the Project User and requested resource.
- Do not let browser input choose an arbitrary file, email recipient, calendar, or raw API path without server checks.
- Return only the data required by the Page.
- Avoid placing Google content or tokens in logs.
Testing
Authorize a controlled Google account and use test files, calendars, messages, and documents. Verify each selected service independently because successful Profile authorization does not prove that every API or scope is enabled.
Test missing file access, revoked authorization, insufficient scopes, pagination, provider rate limits, and deleted or moved resources.
Cloud Flow tests can send email and modify or delete real Google resources.