Google actions setup

• Export assistant responses to Google Docs with formatting preserved.
• Export tables to Google Sheets with headings preserved.
• Export responses to Gmail as draft emails with formatting preserved.

​

Prerequisites

• The Google Drive datasource must be configured (the instance where docs and sheets will be created).
• You must be able to access the Glean Admin Console.
• For Domain-wide Delegation: Google Workspace admin access to configure domain-wide delegation.
• For custom OAuth: Sufficient permissions in Google Cloud Console to create OAuth credentials.

​

Setup instructions

1. In Glean, go to Admin → Platform → Actions.
2. Click Add.
3. From the list in the Add pre-set actions section, select Google Actions under Action templates.
4. In the Configuration tab:
   1. Add the Instance Name.
   2. Select the Data Instance you want to link these actions to. This is the instance where docs and sheets will be created.
   3. Configure authentication. Google actions support two authentication modes, depending on how the actions are configured:
   • Domain‑wide Delegation (DWD): supported only when Google actions are configured to use a central service account that can act on behalf of users across the domain.
   • OAuth user authentication: used when Google actions run as the signed‑in user or on their behalf. The newer actions like Google Calendar, Google Docs, Google Sheets, and Gmail actions use OAuth user authentication and do not support Domain‑wide Delegation.
   Using Domain-wide Delegation (recommended)

   Use Domain-wide Delegation only for legacy Google actions that are enabled to run through a central service account.
   The new Google Calendar, Docs, Sheets, and Gmail actions are OAuth-only and do not use Domain‑wide Delegation.Use Domain-wide Delegation if you want a central service account to act on behalf of users. A dedicated service account is used for Google actions (separate from the Google Drive connector). Google’s Domain-wide Delegation allows Glean to act on behalf of the logged-in Glean user to create documents, sheets, or emails.Steps:

   1. Select Domain-wide Delegation under Authenticate on the Google Actions setup page in the Glean Admin console.
   2. Copy the 21-digit Client ID under How to authenticate Drive instructions.
   3. Go to the Domain-wide Delegation section in Google Admin Console. You must be signed in as an admin.
   4. Click Add new and paste the 21-digit Client ID into the Client ID field.
   5. In the OAuth scopes (comma-delimited) field for this Domain‑wide Delegation client, paste the following and click Authorize:
      https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/gmail.compose,https://www.googleapis.com/auth/spreadsheets
   6. Navigate to the Google Cloud Console and go to APIs & Services → Library.
   7. Enable the Google Drive API, Google Sheets API, and Gmail API. For Gmail API, also enable the People API.

   To use only Google Docs and Sheets (no Email action) with Domain‑wide Delegation, add only:

   • https://www.googleapis.com/auth/drive.file
   • https://www.googleapis.com/auth/spreadsheets

   Omit https://www.googleapis.com/auth/gmail.compose; the email export option will not appear without the Gmail scope.
   Using OAuth user authentication

   Use OAuth User for the new Google Calendar, Google Docs, Google Sheets, and Gmail actions.
   These actions run as the logged‑in user and are not available via Domain‑wide Delegation.With OAuth user authentication, documents, sheets, events, and emails are created on behalf of the user and stored in the user’s Google account (for example, in their Drive or Calendar).

   Using the central Google app for authentication (recommended)

   Use the central option if:

   • Your organization is Glean‑hosted, and
   • Central apps are available for Google in your environment.

   Steps:

   1. Select Central under Authenticate section on the Google Actions setup page.
   2. Click Save.

   End users are prompted to connect their Google account the first time they run an action, and tokens are managed centrally thereafter.

   Glean’s OAuth app may show as unverified during Google’s review. Until verified, admins can authorize the unverified app. Otherwise users may see an unverified app message when authenticating.

   Using a custom Google OAuth app for authentication

   Use the custom option if:

   • You want to use your own Google Cloud project and OAuth client for Google actions, or
   • Your security model requires a customer-owned OAuth app in Google Cloud Console.

   Steps:In order to setup OAuth for Google actions, follow these steps:Step 1: Choose the project in Google Cloud Console

   1. Go to the Google Cloud Console.
   2. In the top bar, click the project selector (it usually shows your current project name).
   3. Either select an existing project your org uses for Google Workspace integrations, or create a new project dedicated to Glean Google Actions (for example, Glean Google Actions).
   4. Ensure all three APIs (Drive, Sheets, Gmail) will be enabled in this project. Make sure everyone agrees which project will own the OAuth client.

   Step 2: Enable the required Google APIs

   1. In the left navigation, go to APIs & Services → Library.
   2. Open the details page, search for Google Drive API, click **Enable.
   3. Repeat for Google Sheets API and Gmail API.
   4. If you want to want enable the Gmail action pack, add the person API.

   You must enable all three APIs in the same project for Docs, Sheets, and Email export to work. If Gmail or Sheets are not enabled, users will see “API not enabled” errors when exporting from Glean.Step 3: Configure the OAuth consent screen (if not already configured)

   1. In the left navigation, go to APIs & Services → OAuth consent screen.
   2. Choose the user type: Internal (recommended for most Workspace domains) or External (only if you must allow accounts outside your domain).
   3. Fill in the required fields: App name (for example, Glean Google Actions), User support email, and Developer contact information.
   4. Click Create.

   You only need to complete this once per project; subsequent OAuth client IDs reuse the same consent configuration.Step 4: Create the OAuth client credentials (Web application)

   1. In the left navigation, go to APIs & Services → Credentials.
   2. Click Create credentials → OAuth client ID. If Google prompts you to configure the consent screen, complete Step 3 first, then return here.
   3. For Application type, select Web application.
   4. Enter a descriptive Name (for example, Glean Google Actions OAuth Client).
   5. Leave Authorized redirect URIs empty for now; you will add the Callback URL from Glean in Step 6.
   6. Click Create. Keep this page open or copy the Client ID and Client secret when shown. This information is required in Step 7.

   Step 5: In Glean Admin Console – copy the Callback URL

   1. Go to the Glean Admin Console and navigate to Platform → Actions.
   2. Open your Google Actions action configuration page.
   3. Under Authentication, select OAuth User → Custom App.
   4. Locate the Callback URL on the Google Actions setup page and copy it.

   This Callback URL is the exact redirect URI that must be added to your OAuth client in Google Cloud Console.Step 6: Back in Google Cloud Console – add the redirect URI

   1. Return to the Credentials page in Google Cloud Console and open your OAuth client.
   2. In Authorized redirect URIs, click Add URI and paste the Callback URL you copied from the Glean Google Actions setup page.
   3. Click Create.

   Step 7: In Glean Admin Console – paste Client ID and Client Secret

   1. Go back to the Google Actions setup page in the Glean Admin Console.
   2. In the Custom App , locate the Client ID and Client Secret fields.
   3. Paste the Client ID and Client Secret from the Google Cloud Console into the matching fields in Glean.
   4. Click Save on the Google Actions setup page.
5. Click Save.
6. Click Edit settings under Enable Actions to control which teammates can use these actions in Glean Chat and Assistant.