lupin.Open console
App connections

Integrate Google Workspace with HTTP or connected app tools

Choose a credential boundary and map Gmail and Calendar tasks to their real APIs without inventing a generic Workspace endpoint.

Lupin editorialAI-assisted3 min read

Choose the credential owner before the endpoint

Google Workspace is a collection of service APIs, not one generic endpoint that grants access to every mailbox and calendar. A direct HTTP integration obtains Google OAuth authorization and manages the credential lifecycle in its own application. Lupin connections instead use operator-enabled Composio authentication and account-scoped discovered tools. Choose the boundary deliberately. Do not paste a Google access token into Lupin’s tool arguments or assume a connected account gives your application a reusable token. The connection route derives provider account credentials server-side and rejects custom credential overrides.

Map tasks to actual Google resources

For Gmail, GET https://gmail.googleapis.com/gmail/v1/users/me/messages lists message references, and users.messages.get retrieves a selected message. For Calendar, GET https://www.googleapis.com/calendar/v3/calendars/primary/events lists events for an authorized calendar. Those endpoints belong to different services and require appropriate scopes. The direct HTTP example reads at most five calendar items using an already owner-authorized token held by your application. It does not obtain a token, bypass Google consent or prove that the same credential can read Gmail. Use the method’s current reference for parameters and scope requirements.

Direct Google API example using your application’s already authorized token; this is not a Lupin connection credential.
curl --fail-with-body --get \
  "https://www.googleapis.com/calendar/v3/calendars/primary/events" \
  -H "Authorization: Bearer $GOOGLE_ACCESS_TOKEN" \
  --data-urlencode "maxResults=5"

Use discovered schemas on the Lupin path

If the operator has enabled the relevant Google toolkit, the owner completes its hosted authorization and verifies active status through Lupin. Then search tools for the intended operation and inspect the returned input_schema, concrete version and connection_revision. A provider toolkit may name or shape its operation differently from the raw Google endpoint. Do not assume a raw API parameter can be passed unchanged to a discovered tool. Prepare an exact action proposal from that schema and obtain approval even when the intended operation is a calendar or mailbox read.

Handle identity and pagination explicitly

The direct Calendar alias primary is relative to the authorized Google account, so verify the account before acting on its default calendar. Multiple Lupin connections likewise need an explicit connection selection; app name alone is insufficient. Follow the relevant API’s page token or the discovered tool’s schema and output contract when reading more results. Limit the time range and fields your workflow needs. A complete scheduling task may need a specific calendar and time zone rather than the first few returned events, and a partial page must not be described as a complete account inventory.

Keep approvals and migration realistic

Direct OAuth credentials and hosted connected accounts are different trust arrangements. Moving between them normally requires deliberate owner reauthorization rather than copying a token or assuming its audience and scopes are portable. Preserve the workflow’s canonical account, calendar or mailbox identity and revalidate it after the transition. The agent must still distinguish data access from permission to send mail or create events. Start with a narrow read that confirms the correct account, then prepare any outward action for exact human review with its real recipient, time zone and provider resource.

Keep direct and hosted examples distinct

A direct Calendar access token belongs to the application that obtained it through Google OAuth. A Lupin connection ID belongs in account-scoped discovery and execution routes. Test that neither is accepted as the other’s credential. This prevents a migration helper from accidentally exposing a reusable Google token in tool arguments or logs.

Sources & verification

Reviewed against current checked-in Lupin routes, shared contracts and official provider references. No live calls, OAuth authorizations, app actions or purchases were performed.

Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.

Put it into practice

Give your agent the right tools.

Review the API, workspace requirements and permissions before enabling a workflow.

Explore connections Register an agent