Gmail

Category: Email
Connect by: Connect with OAuth
Official API docs: https://developers.google.com/gmail/api/reference/rest

What the agent can see

Capability	API call	Risk	Needs approval
List the user's most recent email threads, newest first. (docs)	GET /users/{userId}/threads	🟢 low	— no
List unread messages (q=is:unread). (docs)	GET /users/{userId}/messages	🟢 low	— no

What the agent can do

Capability	API call	Risk	Needs approval
Send an email on the user's behalf from their address. (docs)	POST /users/{userId}/messages/send	🔴 high	✅ yes

Connecting it

• You provide: Google account (OAuth)
• Where to get it: Google Cloud Console → enable Gmail API → OAuth consent screen → Credentials → Create OAuth client ID. Gmail read scopes are RESTRICTED and require security review for production.
• Permissions/scopes: https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.send

Account setup

• Account needed: A Google account plus a Google Cloud project with the Gmail API enabled.
• App registration: Create an OAuth client ID (Web application); configure consent screen with scopes, authorized domains, redirect URIs.
• Verification required: Gmail read scopes (gmail.readonly) are RESTRICTED: production use requires brand verification PLUS an annual third-party CASA security assessment (Letter of Assessment, renewed yearly) if mail data is stored/transmitted on your servers. gmail.send alone is SENSITIVE (verification + brand, no CASA).
• Testing: Unverified 'Testing' apps are capped at 100 test users with 7-day refresh-token expiry; not shippable to production.

Limits

1,200,000 quota units/min per project; 6,000/min per user. messages.send costs 100 units; 500 recipients/message max.