Pangea Docs FAQ Get early access

Docs / Connectors

Connect Gmail and Google Drive

Each member connects their own Gmail and Google Drive, so the agent can read, draft and file things as them. The connection goes through a Google OAuth client that your team owns. An admin sets it up once, in about ten minutes.

Who sets it upA workspace administrator, once per team
Who connectsEach member, with their own Google account
TimeAbout 10 minutes in Google Cloud

How it works

Is the client optional for you?On Pangea Cloud, the Google OAuth client card may show Optional. In that case members can already connect Gmail and Google Drive through Composio, without any setup. Add your own client if you'd rather keep the grant in your own Google Cloud project. Once you save it, new connections go through your client.

Set up the OAuth client

  1. Pick a Google Cloud project

    Open the Google Cloud console and create a project, for example pangea-google, or pick an existing one. If your company uses Google Workspace, create it inside your organization.

  2. Enable the Gmail API and the Google Drive API

    In the same project, enable both APIs:

    You can enable only one of them if your team only needs Gmail or only Drive.

  3. Configure the consent screen

    Go to Google Auth Platform and click Get started.

    • App name: something your team will recognize, such as Pangea or Acme agents.
    • Support email and developer contact: an address on your team.
    • Audience: choose Internal if everyone who will connect is in your Google Workspace. This is the recommended setup: no Google verification is needed.

    Then, under Data Access → Add or remove scopes, add the scopes Pangea requests:

    ScopeUsed for
    openid, …/auth/userinfo.emailShowing which Google account is connected
    …/auth/gmail.modifyGmail: search, read, label, archive, trash, draft and send. Permanent delete is not possible with this scope.
    …/auth/driveGoogle Drive: search, read, upload and share files, and export Docs and Sheets
    Using an External audience?Gmail and Drive scopes are restricted by Google. While the app is in Testing, only the test users you add can connect, and Google expires their connection after 7 days, so they'll need to reconnect. Publishing an External app with these scopes requires Google's verification. For a single company, Internal avoids all of this.

  4. Create the OAuth client

    Go to Clients → Create client:

    • Application type: Web application
    • Name: Pangea
    • Authorized redirect URIs: add both, exactly as written:
    https://api.pangea.build/personal-credentials/gmail/callback
    https://api.pangea.build/personal-credentials/google-drive/callback

    Leave Authorized JavaScript origins empty and click Create. Google shows the Client ID (ending in .apps.googleusercontent.com) and the Client secret. Keep this window open for the next step.

  5. Save the client in Pangea

    In the Pangea app, open Settings → General and scroll to Google OAuth client. Paste the Client ID and the Client secret, then click Save.

    Only administrators see this form. Other members see whether a client is configured and who to ask. To rotate the secret, create a new one in Google Cloud and save it here. To stop using your client, click Remove.

  6. Each member connects their account

    Every member opens Settings → Personal Credentials and clicks Connect next to Gmail or Google Drive. Google asks them to sign in and approve. When they come back, the row shows Connected as their address.

    Gmail and Drive are separate grants, so a member can connect one without the other. Members connect from the team they're working in.

Try itStart a conversation and ask: "Summarize my unread email from the last two days," or "Find the Q4 roadmap in my Drive and list the open questions."

What the agent can do

Can doWill not do
GmailSearch and read mail and threads, add and remove labels, archive, move to trash, write drafts, send mailPermanently delete mail. It prefers a draft over sending unless you asked to send, and never adds recipients you didn't name.
Google DriveSearch and read files, export Google Docs and Sheets as text or CSV, upload files, share filesShare, trash or delete anything unless you asked for that specific action

Sending mail, trashing, deleting and sharing reach outside your account, so the agent only does them when you asked for that exact action. Your workspace's approval rules still apply on top of that.

Privacy and revoking access

Read the full privacy policy.

Troubleshooting

Google says "Error 400: redirect_uri_mismatch"

The redirect URI in your OAuth client doesn't exactly match the one Pangea sent. Open the client in Google Cloud and check that both URIs from step 4 are there, with https://, no trailing slash, and google-drive with a hyphen. Changes can take a few minutes to apply.

"Access blocked: this app's request is invalid" or "app has not completed verification"

The consent screen is set to External and the person connecting isn't a test user. Switch the audience to Internal, or add them under Audience → Test users.

"Gmail API has not been used in project … or it is disabled"

Enable the API from step 2 in the same project as the OAuth client, wait a minute and try again.

The agent says the team has no Google OAuth client

No administrator has saved a client yet, and Composio isn't available for your workspace. Follow the steps above, or ask an admin to.

The agent says Gmail or Drive isn't connected

That member hasn't connected the provider in this team yet. Open Settings → Personal Credentials and click Connect.

A teammate can't use my Gmail in my session

That's on purpose. Personal Credentials are only used when the owner sends the message in a conversation they own. Your teammate should connect their own account.

It worked, then stopped after a week

External apps in Testing get connections that Google expires after 7 days. Reconnect, or switch to Internal to avoid it.

Updated November 12, 2026 Questions? augusto@pangea.build