Skip to main content
Per-app Google setup is deprecated. All Google apps now share one Google OAuth client and one Redirect URI. To use your own client, follow the Google setup guide. Credentials saved for one Google app apply to all of them.

​
Overview

OneCLI connects AI agents to the Google Admin SDK through Google’s OAuth flow. Agents can manage users, groups, and organizational units in your Google Workspace domain. The gateway injects OAuth credentials into requests to the Admin SDK API automatically. This is useful for IT automation agents that need to provision users, manage group memberships, or audit organizational structure.

​
What you will set up

  • A Google OAuth client shared by every Google app in OneCLI
  • A Google Admin connection authorized by a Workspace admin account
  • Per-agent, per-tool access to directory changes

​
Connect Google Admin

This applies on OneCLI Cloud and self-hosted alike. One Google client serves every Google app in OneCLI, so you set it up once. If you already did it for another Google app, skip to step 2.

1. Set up your Google client

Follow the Google setup guide. It enables the Google APIs, sets up the consent screen, creates the OAuth client, and adds the Redirect URI.
Open Connections > Google Admin, select Connect Google Admin, pick your Google account, and click Allow.
OneCLI connect window for Google Admin showing Configuration required, the setup guide link, and the Configure credentials button.

The Google Admin connect window before a Google client is set up.

​
What agents can do

  • List users in your Google Workspace domain
  • Create new user accounts with name, email, and organizational unit
  • Update user details (name, password, suspension status, org unit)
  • Delete or suspend user accounts
  • List groups and their members
  • Create new groups and add or remove members
  • Manage organizational units (list, create, update, delete)
  • Read user login activity and account status
  • Manage user aliases and email addresses

​
Controlling access

Access is per agent: grant the connection to each agent that needs it, choosing per tool what runs freely, what needs human approval, and what stays blocked — a read-only agent is a single grant. Organization rules add guardrails on top, like rate limits and blanket blocks. Everything is checked before credential injection, so a blocked request never reaches the Admin SDK.

​
FAQ

Yes. The Admin SDK requires admin privileges on the Google account you connect.
No. The token stays in OneCLI, and the gateway adds it at the proxy. See How it works.
Yes. Put write tools behind approval when you grant the connection, and add organization rules.