Google Workspace

Camper manages Groups, Shared Drives, and Shared Calendars on Google Workspace.

Connect with Google (recommended)

1. Open Connections → Google Workspace.
2. Click Connect with Google.
3. Sign in as a Workspace admin and approve the scopes Camper requests.
4. Camper exchanges the code, seals a refresh token with your tenant key, and runs per-scope health checks.

No service-account JSON is pasted in the browser on this path.

What the admin grants

Surface	Required
Directory groups + members	Yes (core membership)
Directory user read	Optional (better identity resolve)
Drive	Optional (Shared Drives)
Calendar	Optional (shared calendars)

If optional scopes fail health checks, Groups still work; Drive/Calendar resource types need those scopes enabled and granted.

Advanced: service account + DWD

Use when you cannot use OAuth (air-gapped GCP projects) or need per-user calendar impersonation (calendarList insert while acting as the member).

1. Expand Advanced: service account + domain-wide delegation.
2. Paste/upload SA JSON + admin subject (+ optional primary domain).
3. In Workspace Admin → Security → API controls → Domain-wide delegation, authorize the SA client id with the same scopes.

Existing SA connections keep working until you reconnect.

Credential storage

• Secrets sealed with the tenant DEK (credentialKind oauth or service_account).
• Non-secrets in connection config: primaryDomain, authMode, installer email (OAuth), etc.

Related

• Internal setup notes: repo docs/google-oauth-setup.md
• Issue #110