Skip to main content

Email Importing - Google

Configure Google Workspace or Gmail mailbox importing using OAuth2 authentication for Help Desk Departments.

This guide covers Google Cloud Console project setup, OAuth consent screen configuration, and Manage1to1 department authorization.

Permission Required

To configure Google OAuth email importing, you need the Manage Settings permission assigned to your role in Manage1to1, plus access to Google Cloud Console for your domain.

Overview​

Manage1to1 can connect to Gmail using OAuth2 for help desk email importing. This is used only for the ticketing system to import inbound messages and convert them into tickets or ticket replies.

OAuth2 is recommended because it avoids storing a mailbox password and aligns better with Google Workspace security controls.

Why use Google OAuth instead of traditional IMAP:

  • Enhanced security - No password storage in Manage1to1
  • MFA compatibility - Works with Google Workspace multi-factor authentication
  • Token-based access - OAuth tokens can be revoked without changing mailbox password
  • Audit trail - Google Cloud Console provides OAuth authorization logs
note

Email importing is used only for the help desk ticket system. It does not change how Manage1to1 sends outbound emails to administrators or end users.

Before you start​

You will need:

  • Access to Google Cloud Console
  • A Gmail or Google Workspace mailbox to use for the department
  • Your Manage1to1 tenant URL
  • The OAuth2 callback URL shown in Manage1to1 under the department configuration
important

If you have multiple departments with different Gmail addresses, each department must be authorized separately under the corresponding Google account. Each mailbox generates its own OAuth token.

Google reorganizes this console regularly

Google renames and moves these screens fairly often — the OAuth setup moved under Google Auth Platform in 2025, for example. The exact menu labels below reflect the console as of 2026. If one doesn't match what you see, look for the equivalent section rather than the exact name. The flow is always the same: create a project, decide who can use the app (Audience), grant the mailbox scope (Data Access), then create a Web application OAuth client (Clients).

Step 1: Create a Google Cloud project​

Google Cloud Console, not the Admin console

This setup happens in the Google Cloud Console (console.cloud.google.com), where you create projects and OAuth credentials. That is a different site from the Google Admin console (admin.google.com) you use to manage Workspace users — you will not find OAuth client IDs or the consent screen there.

  1. Open the Google Cloud Console.
  2. In the project picker at the top of the page, create a new project dedicated to Manage1to1 help desk importing (for example, Manage1to1 Help Desk).

Keeping this in its own project keeps credentials and audit history clean and isolated.

Step 2: Set up the Google Auth Platform​

  1. From the left menu, open APIs & Services, then Google Auth Platform (older projects may still label this OAuth consent screen).
  2. Click Get started and complete Branding: enter an app name (for example, Manage1to1 Help Desk Importing) and a support email. Under Authorized domains, add your Manage1to1 tenant domain (for example, yourschool.manage1to1.com).
  3. Under Audience, choose the user type — this is the most important choice on this page:
Choose Internal — External stops importing after 7 days

If your school uses Google Workspace, select Internal. Internal apps skip Google's verification, need no test users, never show the "this app isn't verified" warning, and their access does not expire on a schedule.

Only choose External if the mailbox is a personal @gmail.com account with no Workspace organization behind it. An External app left in Testing status has its access automatically revoked by Google after 7 days, which silently stops email importing about once a week. If you must use External, open the Audience tab and click Publish app to move it to In production so access persists.

  1. Complete the contact-information step and accept the Google API Services User Data Policy.

Step 3: Grant the mailbox scope​

  1. Open the Data Access tab (in the older UI this was part of the OAuth consent screen).
  2. Click Add or remove scopes and add the Gmail access scope: https://mail.google.com/
  3. Save.

This scope lets Manage1to1 read imported messages and remove them after they become tickets.

note

If you chose Internal in Step 2, Google does not require you to submit scopes for review — declaring the scope here simply keeps the configuration explicit. External apps must declare this scope.

Step 4: Create the OAuth client ID​

  1. Open the Clients tab and click Create client (older UI: Credentials → Create Credentials → OAuth client ID).

  2. Choose Web application as the application type.

  3. Give it a clear name, for example: Manage1to1 Help Desk Importing.

  4. Under Authorized redirect URIs, add the OAuth2 Callback URL shown in Manage1to1.

    To find it, navigate to Settings, then Help Desk Settings, then Help Desk Departments. Open a department (or create one), set Intake Mode to Custom Mailbox (POP / IMAP) in the Inbound Mail section, then select Google as the provider and OAuth2 as the authentication method. The OAuth2 Callback URL appears alongside these mailbox settings — it is hidden while the department is set to Forwarded Address.

important

The redirect URI must match exactly. Any mismatch will prevent authorization and the refresh token will not be generated.

  1. Click Create. Google will show your Client ID and Client Secret — keep both available to enter into Manage1to1.

Step 5: Configure Gmail importing in the department​

In Manage1to1:

  1. Go to Settings, then Help Desk Settings, then Help Desk Departments.
  2. Create a new department or edit an existing one.
  3. In the Inbound Mail section, set Intake Mode to Custom Mailbox (POP / IMAP).
  4. In the Mail Server Information area, select Google as the provider.
  5. Select OAuth2 as the authentication method.
  6. Enter:
  • The Gmail address that will receive department emails
  • The Client ID
  • The Client Secret
Don't see a Mail Server Information area?

The Mail Server Information area is hidden while a department is set to the default Forwarded Address intake mode. You must first set Intake Mode to Custom Mailbox (POP / IMAP) (step 3 above) — the provider, authentication, and OAuth fields only appear in that mode.

At this point, the OAuth refresh token field should still be empty.

Step 6: Authorize the mailbox​

  1. Click Authorize.
  2. When prompted by Google, choose the same Google account as the mailbox being configured.
note

If you are signed into multiple Google accounts, the most common failure here is authorizing the wrong account. The refresh token that comes back will only work for the account you authorized.

  1. Approve access when Google requests permissions.

If you see “This app isn’t verified”​

This warning only appears if you chose External in Step 2 — Internal apps never show it. If you do see it, proceed by selecting Advanced, then continuing to your application to complete the flow.

warning

This is a Google UI warning, not a Manage1to1 error. The goal is to complete authorization so the refresh token is generated.

Step 7: Confirm the refresh token is generated​

After authorization completes successfully, Manage1to1 will populate the OAuth Refresh Token field automatically.

important

If the refresh token field remains blank after authorization, importing will not work. The most common causes are a redirect URI mismatch or authorizing the wrong Google account.

Step 8: Save settings and validate​

  1. Click Save Settings.
  2. Manage1to1 will re-test the configuration during save.

If validation fails:

  • Confirm redirect URI matches exactly in Google Cloud Console
  • Confirm Client ID and Client Secret are correct
  • Confirm the authorized Google account matches the mailbox entered in the department
  • Repeat the authorization step if needed

Once saved successfully, Manage1to1 will begin importing mail for that department on its normal interval.

Testing Google OAuth Importing​

After configuration, verify email importing works correctly:

  1. Send test email to department Gmail address from external account
  2. Wait for import cycle (5-15 minutes typically)
  3. Check Help Desk for new ticket matching test email subject
  4. Reply to ticket through Manage1to1 interface
  5. Verify email delivery - Check that reply arrives at original sender's inbox
  6. Check sender address - Confirm reply shows department sender email as From address

If test ticket is not created:

  • Verify import cycle has run (wait 15-20 minutes)
  • Check Gmail mailbox via web interface to confirm test email arrived
  • Verify OAuth refresh token field is populated in department configuration
  • Review validation errors during department save
  • Re-authorize if refresh token is blank
  • Contact Manage1to1 Support for import log review

Common Questions​

Q: Do I need a separate Google Cloud project for each department? No. One Google Cloud project can support multiple departments. However, each department mailbox must be authorized separately to generate its own OAuth refresh token.

Q: What permissions does Manage1to1 request from Google? Manage1to1 requests read and delete permissions for email messages in the authorized mailbox. This allows importing messages and removing them after successful ticket creation.

Q: Can I revoke OAuth access after configuration? Yes. Revoke access through Google Account settings or Google Cloud Console. Email importing will stop immediately. To restore importing, re-authorize the mailbox in Manage1to1.

Q: What happens if the OAuth token expires? OAuth tokens should refresh automatically. If importing stops unexpectedly, re-authorize the mailbox in department configuration to generate a new refresh token.

Q: Why am I seeing "This app isn't verified" when authorizing? This appears only when the Google Cloud project's user type is External. If your mailbox is on Google Workspace, set the user type to Internal (Step 2) and the warning goes away entirely. If you must stay on External, the warning is expected — click Advanced and proceed to your application to complete authorization. It does not affect functionality.

Q: Email importing works for about a week, then stops. Why? This is the classic sign of an External Google Cloud project left in Testing status — Google revokes its access after 7 days. Fix it permanently by setting the project's user type to Internal (recommended for Google Workspace), or, if the mailbox is a personal @gmail.com account, open Google Auth Platform → Audience and click Publish app to move it to In production. After changing this, re-authorize the mailbox in the department to generate a fresh token.

Q: Can I use the same Gmail address for multiple departments? No. Each department must have its own unique mailbox. Using the same mailbox causes routing issues and prevents proper ticket attribution.

Q: Do I need to configure anything in Gmail settings? No. OAuth authorization grants necessary permissions automatically. You don't need to enable IMAP or configure application-specific passwords.

Q: What if I'm signed into multiple Google accounts? During authorization, carefully select the Google account matching the department mailbox. Authorizing the wrong account is a common issue - the refresh token only works for the account you authorized.

Q: Can I use a Google Group email address instead of a mailbox? No. OAuth importing requires a real Gmail mailbox, not a Google Group. Google Groups don't support IMAP access or OAuth authorization needed for importing.

Q: How do I update the Client ID or Client Secret after initial setup? Edit the department configuration, update the fields, re-authorize the mailbox (this generates a new refresh token), and save. The new credentials take effect immediately for subsequent import cycles.

Related articles

Loading…