Google

Amp can read and act on your Gmail, Google Calendar, Docs, Sheets, and Drive when you connect your Google account. You choose the access level for each service, and Amp asks Google only for the permissions those levels need.

Connect Google

Amp connects Google through an OAuth client from your workspace’s own Google Cloud project, so a workspace admin first sets up the client. Then open Settings → Integrations & MCP, find the Google card, and choose an access level for each service. Then click Connect Google and approve the request in Google.

A new connection starts with Gmail at Read, Organize, and Draft, Calendar at Read and Write with Approval, and Docs, Sheets, and Drive at Read. Change any of them before you connect. To change access after you connect, choose new levels and click Change Access.

To lower an access level later, Amp removes the whole Google connection and asks you to approve the smaller set of permissions again. Google does not let an app give back only some of its permissions.

You can also ask Amp in a thread what access it has, to lower it, or to change the multiplayer setting below. Amp makes each change only after you approve it in a dialog. To raise access, Amp sends you to the Google card, because Google asks you to approve it there.

Workspace admins can turn off Google connections for every member in Workspace Settings → Integrations.

Ask Before Sending Email or Changing Your Calendar

Gmail and Calendar each have an access level that asks you first:

• Gmail Read, Organize, and Draft: Amp writes email, but shows you each message to review, edit, and approve before it is sent.
• Calendar Read and Write with Approval: Amp shows you each new event, change, deletion, or reply to an invitation, and makes it only after you approve it.

These are the levels a new connection starts with. Amp sends email or changes your calendar without asking only if you choose Gmail Read, Organize, and Send or Calendar Read and Write. Even then, you can tell Amp in a thread to check with you first.

Each pair of levels needs the same Google permissions, so moving between asking first and not asking only saves your choice in Amp. It does not send you back to Google.

Multiplayer Threads

In a multiplayer thread, other workspace members can prompt the agent, and the agent’s Google tools act as the thread owner. So Amp turns off Google tools in a thread while it is multiplayer, including for the owner. They work again when multiplayer ends.

To let contributors use your Google tools, check

Set Up Your Workspace’s Google OAuth Client

Members connect Google with an OAuth client from your workspace’s own Google Cloud project. Your organization owns the client, controls who can use it, and can turn it off in Google Cloud at any time.

Amp walks a workspace admin through the steps below. Open Workspace Settings → Integrations, open the Google card, and click Set Up Client. Enter your project ID, and Amp fills it into each command and link.

Choose Which Accounts Can Connect

First decide whether members connect only with their Google Workspace accounts, or also with personal Google accounts, such as @gmail.com accounts. You choose this with the Audience of the client’s project in Google Cloud:

• Google Workspace accounts only: choose Internal. Only people in your Google Workspace organization can connect. Google does not need to review or verify the client, shows no warnings, and has no user limit. The project must belong to your organization.
• Personal accounts too: choose External. Any Google account you allow can connect, and the project does not need to belong to an organization. Google requires a security review before it verifies a client that reads Gmail or Drive, so an External client usually stays unverified, with one of these publishing statuses:
  • Testing: only the test users you add can connect, at most 100. Google shows a warning that the app is in testing, and ends each connection after 7 days, so members connect Google again each week.
  • In production: click Publish App without submitting it for verification. Any Google account can connect and connections do not expire, but Google shows an unverified app warning when someone connects, and at most 100 people can ever connect.

Whoever controls the Google Cloud project controls the client. A member who connects a personal account trusts your workspace’s admins with it, as they would with a work account.

Choose a Project and Turn On the APIs

You can use an existing project or create a new one. For Internal, the project must belong to your Google Workspace organization. The audience applies to every OAuth client in the project.

You can do this part with the gcloud CLI. To create a new project, pick an ID that is not taken and run this command. Find your organization ID with gcloud organizations list. For External, leave out --organization.

gcloud projects create my-org-amp-google --organization=ORGANIZATION_ID

Then turn on the APIs in the project. In the Cloud Console they are named Gmail API, Google Calendar API, Google Docs API, Google Sheets API, and Google Drive API.

gcloud services enable --project my-org-amp-google \
  gmail.googleapis.com \
  calendar-json.googleapis.com \
  docs.googleapis.com \
  sheets.googleapis.com \
  drive.googleapis.com

You only need the APIs for the services you want members to use.

Create the OAuth Client

Google only lets you set up the consent screen and create web OAuth clients in the Google Cloud console. Open Google Auth Platform for the project and follow these steps:

1. On the Branding page, enter an app name, such as “Amp for Acme”, and a support email. If the project already has a consent screen, you can keep its branding.
2. On the Audience page, choose Internal or External. For External, either add each member’s Google account under Test users, or click Publish App.
3. On the Clients page, create a client with the application type Web application.
4. Under Authorized redirect URIs, add https://ampcode.com/auth/gmail/callback. Amp also shows this URI next to the client fields in workspace settings.
5. If Google asks whether an AI agent uses the client, say yes.
6. Copy the client ID and the client secret.

You do not need to add scopes on the Data Access page. Amp asks for the scopes that each member’s chosen access levels need when the member connects.

Add the Client to Amp

Paste the client ID and client secret in the last step of Set Up Client. Amp stores the secret encrypted and never shows it again.

You can also ask Amp in a thread to set the client. Amp asks you to enter the client secret in a private dialog, so the secret never appears in the thread.

Amp uses the workspace’s client for a member when this workspace is the member’s only workspace, or when it is the member’s exclusive workspace.

Change or Remove the Client

You can enter a new client secret for the same client ID at any time, and members stay connected.

If you save a different client ID or remove the client, Amp disconnects every member who connected with the old client and revokes their Google grants. Each member must then connect Google again. When a person leaves the workspace, Amp deletes their Google connection made with the workspace’s client and revokes its Google grant.