schakl.
All integrations

Google Workspace Available

Google Workspace

You connect Google Workspace with your own Google Cloud project: configured per organisation, connected per employee. Signing in with Google and connecting Google are two separate grants — a login through Google does not hand the app your Calendar, Drive or Gmail.

What you need

  • A Google Workspace domain, and a Google Cloud project you administer yourself
  • A licence key covering the Google Workspace module (Instellingen → Licentie)
  • The google.settings.manage permission for the settings page; admin only by default
  • For the Gmail timeline, the Contactmomenten (interactions) module as well, a separate licence
  • If an access proxy sits in front of your host (Cloudflare Access, for instance), a bypass for <code>/api/v1/google/calendar/webhook</code>. Those notifications come from Google's servers rather than a browser, so without one they are silently turned away.

How to connect it

  1. 1 Switch Google Workspace on under Instellingen → Modules (Settings → Modules). Without a covering licence the module goes read-only after the grace period and its own background jobs stand down.
  2. 2 In the Google Cloud console, create one project for your agency and register an OAuth 2.0 Client ID of type Web application. Set the consent screen to Internal: that is what removes the verification review for the restricted scopes.
  3. 3 In that same project, under APIs & Services → Library, enable the APIs you will actually call: Google Calendar API, Google Drive API, Gmail API.
  4. 4 Open Instellingen → Google Workspace (Settings → Google Workspace). The first field is the Redirect-URI, derived from your environment's own hostname and never typed by hand. Copy it with the Kopiëren button and paste it into Authorized redirect URIs on your OAuth client. Google matches it exactly.
  5. 5 On the same page, fill in Client-ID and Clientgeheim (stored encrypted; leave the secret blank to keep the stored one), and under Onderdelen tick the surfaces employees will be asked to grant: Agenda, Drive, Gmail.
  6. 6 Under Drive-indeling fill in the Gedeelde Drive-ID, the Bovenliggende map voor klantmappen (ID) and optionally the Sjabloonmap (ID), pick an Automatiseringsaccount and tick Maak automatisch een map voor elke nieuwe klant. Under Gmail-beleid, decide whether newly matched emails wait for approval or are captured straight away.
  7. 7 Then have every employee connect themselves: Instellingen → Mijn account, card Google-account, button Google koppelen. With Gmail enabled, the checkbox Koppel ook mijn mailbox (Gmail) sits alongside it.

Signing in with Google is not connecting Google

This is the confusion that comes up most, so we say it plainly: single sign-on with Google (Instellingen → Single sign-on) and the connection to Calendar, Drive and Gmail are two separate grants with separate lifetimes. Even an agency that forces everyone to sign in through Google still needs each employee to press <strong>Google koppelen</strong> for themselves. It works the other way round too: your login never quietly gains the right to read your mail.

Your own Cloud project is the whole point

Browsing a client's existing Drive folders needs the full Drive scope, not the narrow one that only sees files the app created itself. For ordinary SaaS that is prohibitive, because scopes like this cost a security assessment. Because each agency registers its own Cloud project and the consent screen is Internal, everything stays inside your own Workspace domain and the assessment falls away. Leave the client blank and the environment falls back to the server operator's client instead, at which point enabling APIs in your own project changes nothing.

Calendar and Drive, day to day

The Agenda gains a source <strong>Google Agenda</strong> carrying your own events, read from schakl's cache and never live from Google. In the other direction, approved leave and tasks planned onto someone's calendar are written into that person's own Google Calendar. The <strong>Drive</strong> panel appears on clients, projects and tasks; it browses live as the viewing user, so Drive's own permissions stay authoritative.

  • Create a subfolder, upload files straight to Drive, and link an existing Drive file to a record
  • Unlinking removes only the link; the file in Drive is never touched
  • Folders for clients that predate the setting are filled in afterwards with Mappen aanmaken

Gmail: metadata first, the body later

Every five minutes the worker reads each opted-in mailbox incrementally, fetches metadata only, and logs messages whose participants match a known contact. They arrive as pending touchpoints in the queue <strong>Interacties → E-mails te beoordelen</strong>, where the mailbox owner approves, rejects or remaps them to the right client or project. Only after approval is the body fetched from Google. Deciding about a colleague's mailbox is not possible: no permission grants it, admins included.

  • Switched on per person with Registreer mijn e-mail in het CRM, plus a Gmail label that is never logged
  • An exported .eml file can be uploaded by hand instead, via Interacties → E-mail uploaden
  • A remote image in a message is dropped: loading a tracking pixel would tell the sender the mail was opened

Permissions

Grant these to the role that manages this integration (Settings → Roles). Admin-only by default, and never to the client role.

  • google.settings.manage Manage the Instellingen → Google Workspace page and run the folder backfill for existing clients. Admin only by default.
  • google.connection.manage Connect and disconnect your own Google account. Admin and member by default.
  • google.calendar.read See the Google Agenda source inside the Agenda.
  • google.drive.read Browse a client's Drive folder and see the linked files.
  • google.drive.write Link and unlink files, upload, and create folders.
  • interactions.interaction.review Approve, reject or remap matched emails. Your own mailbox only, however broadly the permission is granted.

What it deliberately does not do

  • Domain-wide delegation is not implemented: per-user connections only, so every employee connects themselves.
  • Gmail is read-only. schakl. never sends mail through Gmail; outgoing post uses the transport under Instellingen → E-mail.
  • Calendar sync writes one way. Google events are only read; two-way sync is not part of this version.
  • The first Gmail poll imports nothing and only records a starting point. Existing mail is never fetched retroactively. If a mailbox goes unpolled for more than about a week (worker stopped, licence lapsed, connection needing attention), it re-baselines from now and the gap is skipped.
  • Gmail is polled, not pushed: a matched email is in the queue within roughly five minutes, not instantly.
  • Drive links are references, not copies. Delete the file in Drive and the link points at nothing, and folders are configured by pasting a folder ID because there is no folder picker yet.

Where to find it Instellingen → Google Workspace (Settings → Google Workspace) for the organisation, Instellingen → Mijn account (Settings → My account, card Google-account) for your own connection, plus the Drive panel on a client, project or task and the queue Interacties → E-mails te beoordelen (Interactions → Emails to review).

Read the guide

Other integrations

Mollie Stripe Adyen Exact Online SnelStart Cloudflare