---
title: "Google Workspace API scopes"
slug: "google-workspace-permissions"
description: "A breakdown of the Google Workspace OAuth scopes Opensense uses for directory sync and Gmail signature deployment, with security and access details."
updated: 2026-10-14T00:00:00.000Z
canonical: "https://help.opensense.com/docs/google-workspace-permissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.opensense.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace API scopes

## Overview

This article describes the integration between **Opensense** and **Google Workspace Directory**. The integration is used only to retrieve user metadata, and to deploy personalized email signatures from the Opensense platform.

Although the Opensense Marketplace app includes a broad set of permissions, only the scopes listed below are authorized and used in this deployment.

## Integration components

<dl class="kb-insights-summary">
  <div><dt>App name</dt><dd>Opensense (formerly SenderGen)</dd></div>
  <div><dt>Source</dt><dd>Google Workspace Marketplace</dd></div>
  <div><dt>Publisher</dt><dd>Opensense Inc.</dd></div>
  <div><dt>Purpose</dt><dd>Retrieve directory metadata, and deploy email signatures</dd></div>
  <div><dt>Integration type</dt><dd>OAuth 2.0, through scoped API access</dd></div>
  <div><dt>Data flow</dt><dd>One-way: Google Workspace to Opensense</dd></div>
</dl>

## Purpose of access

The integration reads user and group metadata from Google Directory, and writes signatures to Gmail, to support:

<ol class="kb-benefits" aria-label="Purpose of access">
  <li>
    <span class="kb-benefits__number" aria-hidden="true">01</span>
    <div><strong>Signature personalization</strong><p>Insert user-specific fields (for example, full name, title, and phone) into templated HTML signatures.</p></div>
  </li>
  <li>
    <span class="kb-benefits__number" aria-hidden="true">02</span>
    <div><strong>Group-based logic</strong><p>Apply signature variations based on group membership (for example, different designs for the Sales and Support teams).</p></div>
  </li>
  <li>
    <span class="kb-benefits__number" aria-hidden="true">03</span>
    <div><strong>OU-based filtering</strong><p>Use organizational units (OUs) to define user targeting or inclusion rules.</p></div>
  </li>
  <li>
    <span class="kb-benefits__number" aria-hidden="true">04</span>
    <div><strong>Signature deployment</strong><p>Write finalized signatures to user mailboxes, primary addresses, and send-as aliases, through the Gmail API.</p></div>
  </li>
</ol>

## Authorized API scopes

Only these API scopes are granted. API scopes are permission identifiers that Google uses to control what data an application can access. They aren't navigable URLs. For a full reference of the available Gmail API scopes, see Google's [Choose Gmail API scopes](https://developers.google.com/workspace/gmail/api/auth/scopes).

<div class="kb-deployment-compare kb-deployment-compare--plain kb-deployment-compare--scopes">
  <div class="kb-deployment-compare__viewport" role="region" aria-label="Authorized API scopes" tabindex="0">
    <table>
      <colgroup><col class="kb-deployment-compare__feature-col"><col class="kb-deployment-compare__detail-col"></colgroup>
      <thead>
        <tr>
          <th scope="col">API scope</th>
          <th scope="col"><span class="kb-deployment-compare__method">Access</span></th>
          <th scope="col"><span class="kb-deployment-compare__method">Purpose</span></th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <th scope="row"><code>https://www.googleapis.com/auth/<wbr>admin.<wbr>directory.<wbr>user.<wbr>readonly</code></th>
          <td>Read-only</td>
          <td>Pull user attributes, like name, title, and department.</td>
        </tr>
        <tr>
          <th scope="row"><code>https://www.googleapis.com/auth/<wbr>admin.<wbr>directory.<wbr>group.<wbr>readonly</code></th>
          <td>Read-only</td>
          <td>Identify group memberships, to assign the correct signature template.</td>
        </tr>
        <tr>
          <th scope="row"><code>https://www.googleapis.com/auth/<wbr>admin.<wbr>directory.<wbr>orgunit.<wbr>readonly</code></th>
          <td>Read-only</td>
          <td>Allow filtering or targeting based on the user's OU placement.</td>
        </tr>
        <tr>
          <th scope="row"><code>https://www.googleapis.com/auth/<wbr>gmail.<wbr>settings.<wbr>basic</code></th>
          <td>Read/write</td>
          <td>Edit email signatures for the user's primary account.</td>
        </tr>
        <tr>
          <th scope="row"><code>https://www.googleapis.com/auth/<wbr>gmail.<wbr>settings.<wbr>sharing</code></th>
          <td>Read/write</td>
          <td>Edit email signatures for the user's alias accounts.</td>
        </tr>
      </tbody>
    </table>
  </div>
</div>

Directory scopes are strictly read-only. The `gmail.settings.basic` and `gmail.settings.sharing` scopes can write, but are limited to signature deployment. Opensense can't access, read, or change email content, routing, or any other Gmail settings.

## Excluded permissions (not utilized)

Although they're presented during app installation, these permissions are **not authorized, granted, or used**:

- Access sensitive mail settings
- Control mail routing
- Filter or delegate Gmail
- Access Gmail message content

These are default scopes in the Opensense app manifest, but they're explicitly excluded during deployment through scoped OAuth configuration.

## Security and access controls


<dl class="kb-insights-summary">
  <div><dt id="access-control">Access control</dt><dd>A <strong>Google Workspace Super Admin</strong> authorizes and manages the integration. Permissions are enforced with <strong>granular OAuth scope control</strong> in the Admin console, and app access is restricted to the five API scopes listed above.</dd></div>
  <div><dt>No access to email content or controls</dt><dd>Opensense <strong>can't view, alter, or route email messages</strong>. The platform has <strong>no access</strong> to Gmail accounts, settings, or message data beyond signature deployment.</dd></div>
  <div><dt id="data-handling">Data handling</dt><dd>Data is accessed through <strong>secure, encrypted API calls</strong> (TLS). No directory data is written back to Google Workspace. Opensense processes only non-sensitive metadata, for display purposes.</dd></div>
  <div><dt id="revocation-and-audit">Revocation and audit</dt><dd>Admins can revoke access at any time, in the Admin console under <strong>Security</strong> &gt; <strong>Access and data control</strong> &gt; <strong>API controls</strong>. Audit logs and app access reviews are supported natively in Google Admin settings.</dd></div>
</dl>

## IT security review checklist

1. **Confirm scoped access.** Validate that only the five API scopes listed above are authorized.
2. **Review admin approval.** Make sure that a **Super Admin** has approved and restricted the Marketplace app.
3. **Review access control settings.** Confirm that permissions for Gmail message content, routing, or sensitive settings aren't turned on.
4. **Turn on audit logging.** Consider turning on API access logs, for periodic internal compliance reviews.
5. **Request an OAuth scope summary (optional).** Contact Opensense or your admin for a detailed list of active scopes, if you need it for an internal audit or SOC 2 or ISO 27001 reviews.
6. **Review vendor security documentation.** See the [Opensense Security Overview](https://www.opensense.com/security).

## Troubleshooting and support

<dl class="kb-insights-summary">
  <div><dt>App not syncing users?</dt><dd>Check that the organizational units or groups are accessible to the app.</dd></div>
  <div><dt>Signatures not deploying?</dt><dd>Confirm that the <code>gmail.settings.basic</code> and <code>gmail.settings.sharing</code> scopes are authorized, and that domain-wide delegation is turned on for the Opensense service account.</dd></div>
  <div><dt>Aliases not receiving signatures?</dt><dd>Verify that <code>gmail.settings.sharing</code> is authorized, and that domain-wide delegation is configured correctly in the Admin console.</dd></div>
  <div><dt>Unexpected permissions?</dt><dd>Check the scopes again in the Admin console, under <strong>Security</strong> &gt; <strong>Access and data control</strong> &gt; <strong>API controls</strong> (formerly <strong>Apps</strong> &gt; <strong>App access control</strong>).</dd></div>
  <div><dt>Need help?</dt><dd>Contact Opensense Support at <a href="mailto:help@opensense.com">help@opensense.com</a> for integration guidance or help with reconfiguration.</dd></div>
</dl>

## What's next

- [How does Opensense work with Google Workspace?](https://help.opensense.com/docs/how-does-opensense-work-with-google-workspace)
- [Google Workspace integration overview (change request)](https://help.opensense.com/docs/google-workspace-integration-overview)
- [Google Add-on deployment overview (change request)](https://help.opensense.com/docs/opensense-google-add-on-cr-guide): the add-on's own OAuth permissions.