Gmail setup

You're reading the new setupAlready have Gmail connected? →

Connecting Gmail takes one authorization. Authorize Google Tools and your setup gives you two things.

• Read and write tools work right away. Glean and Glean agents can search email threads, read messages, draft emails, and manage labels. Every tool runs as the person asking, using their own Google authorization, so it respects that user's Gmail permissions.
• Permission-aware search is available when you turn on data crawling and indexing. Glean builds a search index of your email that respects Gmail's permission model, so each person searches their own mailbox content.

1. Connect and authorizetoday — current step
2. Use read and write toolstoday — current step
3. Indexing runs in the backgroundtoday — happens automatically
4. Permission-aware search switches ontomorrow — happens automatically

Feature availability after setup

Read and write tools work as soon as you authorize the MCP connection. Search switches on once you begin indexing and the first crawl completes.

Capability	When it becomes available	Whose permissions apply
Read and write tools	Immediately after you authorize the MCP connection	Each user's own Google permissions, through their own Google authorization
Permission-aware search	Once you begin indexing and the first crawl completes	Gmail's permission model, so each person searches their own mailbox content

Connector setup

Prerequisites

Confirm the following before you begin.

Requirement	Why it is needed
A Glean admin who can add and configure connectors	Adds the Gmail connector and authorizes it in the Admin console
A Google admin who can authorize the connection	Authorizes the MCP connection and, for indexing, sets up domain-wide delegation

Step 1. Connect

In the Glean Admin console, go to Connectors and add the Gmail connector. This step authorizes Gmail's tools.

1. Enter a Name for the connector. This is the name your organization members see.

2. Under Select an authorization method, pick one option.

   • Central (recommended). Use Glean's managed OAuth app, which needs no configuration.
   • Custom. Use your own Google OAuth app. You provide a Client ID and Client secret.

   For Custom, always select Use this client for an AI-powered agent when creating the OAuth client in Google Cloud Console. See Create a custom OAuth client for the client setup steps.

   See Google tools setup for the full instructions.

3. Select Continue. You return to Glean to set up indexing.

Step 2. Set up indexing

To add permission-aware search, set up data crawling and indexing. Set up domain-wide delegation and the required scopes. Choose the indexing scope, which is the users, groups, or domains whose email you want indexed. By default, indexing covers approximately 6 months of history and up to 5,000 Inbox threads per user. Limits can vary by deployment, and the full content crawl runs about monthly.

Step 3. Review and begin

Review who can use the connector and any data access rules, then finish setup. Choose whether the connector is available to all users or a test group, set inclusion and exclusion rules, and begin indexing or skip it for later.

Create a custom OAuth client

Complete these steps if you select Custom when connecting Gmail.

When replacing an existing OAuth client, repeat the allowlisting and verification steps for the new client ID before reconnecting.

Use this setup when your organization requires a customer-owned OAuth app instead of the Glean central app. You will create an OAuth 2.0 client in Google Cloud Console and enter the credentials in Glean.

1. Enable the Gmail API

1. Go to the Google Cloud Console and select your project.
2. Navigate to APIs & Services → Library.
3. Search for and enable the Gmail API.

2. Enable the Gmail MCP API

1. In the same project, go to APIs & Services → Library.
2. Search for and enable the Gmail MCP API (gmailmcp.googleapis.com).

Note: The Gmail MCP API is currently part of the Google Workspace Developer Preview Program. Your project must be enrolled in the Developer Preview to enable this API.

3. Configure the OAuth consent screen

1. In the same project, go to APIs & Services → OAuth consent screen (or Google Auth Platform → Branding in newer console layouts).
2. If not already configured, set the User type to Internal (recommended for organization-only access) or External (Audience page when configured).
3. Fill in the required fields (app name, support email) and click Save and Continue.
4. On the Data Access page, click Add or Remove Scopes and add:
   • https://mail.google.com/
5. Click Update, then Save and Continue.

Note: This single scope covers both reading and writing Gmail messages and is used for MCP tools as well as other Gmail actions in Glean.

4. Create the OAuth client credentials

Always select Use this client for an AI-powered agent when creating a custom OAuth client for Glean, so you can use it with Google Workspace MCP servers in the future. If you leave it unselected, you will need to create another client to set up MCP later.

1. Go to Google Auth Platform → Clients (or APIs & Services → Credentials).
2. Click Create client (or Create credentials → OAuth client ID).
3. For Application type, select Web application.
4. Enter a Name (e.g., "Glean Gmail MCP").
5. Under Authorized redirect URIs, click + Add URI and paste the Callback URL from this setup page: Copy the Callback Url from the Glean Admin Console setup panel.
6. Select Use this client for an AI-powered agent.
7. Click Create.
8. Copy the Client ID and Client Secret — you will need them in the following steps.

5. Allowlisting your OAuth app

1. Go to the Google Admin Console.
2. Navigate to Security → Access and data control → API controls.
3. Click Manage App Access.
4. Under Configured apps, click Configure new app.
5. Enter your OAuth app Client ID into the search field and click Search.
6. Select your OAuth app from the search results.
7. Under Scope, keep the top-level organization selected, or click Select org units → Include organizations to scope to specific OUs, then click Select.
8. Click Continue.
9. Under Access to Google data, choose Trusted.
10. Click Continue, review the configuration, and click Finish.

Changes can take up to 24 hours to propagate, but typically take effect within a few minutes.

6. Verify your OAuth app

Return to the Configured apps list and confirm your OAuth app appears with a Trusted status.

7. Enter credentials and connect

1. On this setup page, locate the Client ID and Client Secret fields under Custom app setup.
2. Paste the Client ID and Client Secret from the Google Cloud Console into the matching fields.
3. Click Connect to authenticate with your Google account.

Troubleshooting

• MCP requests rejected — In Google Auth Platform → Clients, open the OAuth client used by Glean and confirm Use this client for an AI-powered agent is selected. If you cannot change the setting, create a new OAuth client with it selected, update the credentials in Glean, and reconnect. Google starts rejecting unmarked clients on November 11, 2026. Existing clients not marked by November 12, 2026 require replacement for MCP access. See Google's announcement.

• "Access blocked" or "unverified app" error — If your OAuth consent screen is set to External and the app is not yet verified by Google, add test users under OAuth consent screen → Test users, or switch to Internal if only your organization needs access.

• "Redirect URI mismatch" — Verify the Authorized redirect URI saved on the OAuth client in Google Cloud Console matches the Callback URL shown on this page exactly, including scheme and trailing path.

• "Gmail MCP API not found" — Ensure your Google Cloud project is enrolled in the Google Workspace Developer Preview Program before enabling the API.

Quick checklist

• Enable the Gmail API in your Google Cloud project
• Enable the Gmail MCP API (requires Developer Preview enrollment)
• Configure the OAuth consent screen with the required scopes
• Create a Web application OAuth client with the Glean callback URL as the redirect URI
• Select Use this client for an AI-powered agent before creating the client
• Allowlist your OAuth app
• Verify your OAuth app
• Copy the Client ID and Client Secret into Glean
• Click Connect to authenticate

Manage tools

Connecting Gmail makes its tools available. You can see all available tools on the Tools tab of your connector and edit permissions through Advanced settings. Gmail's write tools create drafts and manage labels — there is no tool that sends email on a user's behalf.

Tool settings you can change afterwards

• Which tools are on. Keep read tools enabled and leave write tools off until you are ready for agents to act in Gmail. See Enabling or disabling individual tools.
• Where they appear. Across Glean Assistant, Agents, and the Glean MCP server. See Enabling tools for Chat and Agents.
• Who can use them. Scope each tool to specific users or groups. See Tool visibility scoping and role-based access to tools.
• How write tools run. Control whether a tool runs without user confirmation. See Run tools without user confirmation and Allowing in-line execution of write tools.

For the full guide, see Tools overview.

Per-user authorization

Setup authorizes Glean to Gmail at the connector level. From there, two identities decide what each person sees.

Capability	Runs as	What it enforces
Indexed search	The connector's indexing identity, through domain-wide delegation	Gmail's permission model, so each person searches their own mailbox content
Read and write tools	Each user's own Google account	That user's own Gmail permissions, checked by Google on every call

Each teammate authorizes their own Google account over OAuth the first time they use a tool.

After setup

• Refine what is indexed with indexing scope and inclusion and exclusion rules.
• Check progress any time from the Gmail connector page in the Admin console.

See also

• Choose your Gmail setup shows which setup is yours and how tools and indexed search fit into each.
• Connect Gmail with Glean is the existing connector setup reference.