> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meetkay.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Use your own Google OAuth client

> Connect Google through an OAuth app you created yourself, so the consent screen and API quota are yours.

When you connect Google, Kay normally signs you in through its own registered
Google app — that's what the consent screen names, and whose API quota your
requests count against. If you'd rather own that relationship, you can create a
Google app of your own and tell Kay to use it instead. Kay calls this **using
your own OAuth client**.

You might want this because:

* **The consent screen is yours.** You approve an app you created and control,
  not a shared one.
* **The API quota is yours.** Your Google API usage counts against your own
  Google Cloud project, not a pool shared with other Kay users.
* **Your organization requires it.** A Workspace admin can allow their own app
  where an unknown third-party app would be blocked.

<Note>
  This is an advanced, optional setup. Google is the only service that supports
  it today, and everything works without it — if you never touch this, Kay's
  built-in client keeps working. If your organization publishes its own client
  through Kay, it applies automatically and there is nothing to set up.
</Note>

## 1. Create the client in Google Cloud

You create the OAuth client on Google's side, in the
[Google Cloud console](https://console.cloud.google.com/auth/overview). Kay
shows these same steps in the app, with an **Open Google setup guide** button
that takes you to the right console page.

<Steps>
  <Step title="Create or pick a project">
    In the Google Cloud console, create a project or pick an existing one.
  </Step>

  <Step title="Enable the APIs you need">
    Under **APIs & Services › Library**, enable the APIs your workflows need —
    for Kay today that's the Gmail and Google Calendar APIs.
  </Step>

  <Step title="Set the user type">
    Under **Google Auth Platform › Audience** — part of the OAuth consent screen
    settings — set the user type. On a Google Workspace account choose
    **Internal**. A personal Gmail account has no organization, so **Internal**
    is greyed out there: choose **External**.
  </Step>

  <Step title="External only: stay in testing mode and add yourself">
    On the External path only, still under **Audience**: leave the publishing
    status on **Testing**, and add your own Google address under **Test users**.
  </Step>

  <Step title="Create the client">
    Under **Google Auth Platform › Clients**, create an OAuth client of type
    **Desktop app**, and keep its ID and secret to hand.
  </Step>
</Steps>

Worth knowing before you choose:

* **Internal** skips Google's verification and CASA review even for restricted
  scopes, so prefer it when you can select it.
* On the External path, an address missing from **Test users** is refused at
  sign-in.
* Google warns during sign-in that an unverified app is unsafe — continue via
  **Advanced**.
* External testing-mode access lapses after seven days, so expect to reconnect
  weekly.

## 2. Register it in Kay

<Steps>
  <Step title="Open the Google connection">
    Go to **Settings → Plugins** and open **Google**, then choose **Options**.
  </Step>

  <Step title="Choose to use your own client">
    Expand **Advanced: use your own OAuth client** and choose **Use my own
    client**.
  </Step>

  <Step title="Paste the ID and secret">
    Kay asks for the client ID and secret in a secure prompt — they never appear
    on the settings page itself. Kay checks the ID looks like a real Google
    client ID and refuses its own built-in one, so you can't accidentally
    register a client that isn't yours.
  </Step>

  <Step title="Connect your account">
    Saving the client also selects it, so you don't need to flip anything — just
    connect your Google account. A toggle (**Kay's built-in client** / **Your
    own OAuth client**) appears alongside, for switching back and forth later.
  </Step>
</Steps>

## Check which client a connection actually uses

A connected Google account states which client signed it in — **"Connected
using Kay's built-in client"**, **"your own OAuth client"**, or **"your
organization's OAuth client"** — so you never have to guess whether the switch
took effect.

A connection keeps the client it was created with for as long as it lives:
flipping the toggle changes which client **new** connections use, but an
existing connection continues to refresh through the client that made it. To
move an account onto your own client, disconnect it and connect again with
**Your own OAuth client** selected.

The setup steps stay available after you've registered a client — **Show setup
steps** on the same panel brings them back, which is handy when a failed sign-in
sends you back to check your Google Cloud configuration.

## Removing your client

**Remove client** on the same panel first shows you how many connected accounts
were signed in through your client, and asks you to confirm. Removing it
doesn't silently move those accounts to Kay's built-in client — each one stays
listed but shows **"OAuth client removed — reconnect to continue"** until you
sign it in again. Fresh connections then use the built-in client.

## Troubleshooting

| What you see                                                     | What it means                                                                                                                            |
| ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Google refuses the sign-in outright                              | On the External path, the address you signed in with isn't listed under **Test users** in your Google Cloud project.                     |
| "Google hasn't verified this app"                                | Expected for an unverified app — continue via **Advanced**.                                                                              |
| A connection stops working about a week after connecting         | External testing-mode access lapses after seven days. Reconnect the account, or use a Workspace account with **Internal** to avoid this. |
| A connection shows an issue and asks to reconnect                | The client that signed it in is no longer registered in Kay. Reconnect to sign it in again under the current client.                     |
| The toggle and paste prompt are missing, with an org badge shown | Your organization publishes this client. Your admin manages it, and changes they publish apply on their own.                             |