# Google Workspace admin setup

> What a Google Workspace admin must allow so Nickbox can read Gmail, plus a note you can send to your admin.

Updated: 2026-10-03 · Canonical: https://staging.nickbox.io/en/docs/workspace-admin

If your inbox belongs to a Google Workspace organization, an admin may need to mark Nickbox as a trusted app before you can connect it.

## Before you start

- You need Google Workspace super admin access, or you need to send this page to someone who has it.
- Nickbox requests `gmail.readonly` plus `openid` and `email`. It cannot send, delete or change mail.

## How you know this applies to you

When you try to connect, Google shows an error such as "Error 400: admin_policy_enforced", "This app is blocked" or "Access blocked: your institution's admin needs to review". Personal @gmail.com accounts are not affected.

## Steps for the admin

1. Sign in to the Admin console at admin.google.com.
2. Go to **Security**, then **Access and data control**, then **API controls**.
3. Open **Manage Third-Party App Access**.
4. Click **Configure new app** and search by **OAuth client ID**. Enter:

   ```text
   TODO(owner): OAuth client ID
   ```

5. Select the Nickbox app and choose the organizational units, or the whole domain, that may use it.
6. Set the access level to **Trusted** and confirm.

Names in the Admin console change from time to time. If a label differs, look for third-party app access under API controls.

## Note to send your admin

```text
Hi, I would like to connect my work Gmail to Nickbox, a read-only assistant connector. Google blocks it until an admin allows the app. Could you add it in Admin console > Security > Access and data control > API controls > Manage Third-Party App Access > Configure new app, using OAuth client ID TODO(owner): OAuth client ID, and set it to Trusted? It requests read-only Gmail access (gmail.readonly) and cannot send or delete mail. Details: https://nickbox.io/en/legal/privacy
```

## Check it works

Try connecting the inbox again from the Nickbox dashboard. When Google shows the consent screen, the policy is in place. After that, ask your assistant to `list my inboxes`.

## Troubleshooting

- **The same error appears after the admin changed it.** Policy changes can take a while to apply. Wait and try again, and sign out of Google first.
- **The admin cannot find the app.** Check the client ID was pasted without spaces.
- **Only some users are blocked.** The app may be trusted for some organizational units only.
- **Admin says the app is unverified.** Nickbox has not finished Google's verification yet, so Google shows an unverified app warning.