Google Cloud setup

This page is for TracsConnect operators. Shop users do not need to create a Google Cloud project; they only connect their Google account from the dashboard.

You should have:

Access to the Google Cloud project that owns the TracsConnect OAuth client
Permission to enable APIs and manage Google Auth Platform clients
The deployed dashboard backend callback URL for the target environment

Step 1: Enable Google Calendar API

In Google Cloud

Open the Google Cloud project for the environment and enable Google Calendar API from APIs & Services.

TracsConnect currently needs Calendar API access and the standard OpenID/userinfo identity scopes; it does not read Google Calendar changes back into TRACS.

Google Cloud Console showing the Google Calendar API product page with the Enable button.

Reference: Configure OAuth for Google Calendar.

In Google Auth Platform, configure the OAuth app name, support email, developer contact email, and publishing status for the environment.

Google Auth Platform Branding page showing app information, verification status, and redacted support email.

Add only the scopes TracsConnect requests:

https://www.googleapis.com/auth/calendar.events
https://www.googleapis.com/auth/calendar.calendarlist.readonly
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
openid

Google classifies broad Calendar access as sensitive. Keep the scope set narrow and submit verification when the app needs to be used outside internal test users.

Step 3: Create a web application OAuth client

Create an OAuth client with application type Web application.

Add the exact callback URI for the deployed dashboard backend:

https://<dashboard-backend-host>/api/v1/dashboard/google-calendar/callback

For local development, use the local dashboard backend host and the same callback path.

Google Auth Platform Clients page showing a web application OAuth client with the client ID redacted.

Reference: Using OAuth 2.0 for Web Server Applications.

Step 4: Set TracsConnect environment variables

Copy the OAuth client values into the target backend environment:

GOOGLE_CALENDAR_CLIENT_ID=<client id from Google Cloud>
GOOGLE_CALENDAR_CLIENT_SECRET=<client secret from Google Cloud>
GOOGLE_CALENDAR_REDIRECT_URI=https://<dashboard-backend-host>/api/v1/dashboard/google-calendar/callback

The redirect URI must match the Google Cloud OAuth client exactly, including scheme, host, path, and trailing slash behavior.

Step 5: Confirm Calendar scopes

Before enabling the dashboard rollout flag, compare the configured scope list against Google’s Calendar API scope guidance. The Data Access page is where Google shows the requested OAuth scopes and verification requirements.

Google Auth Platform Data Access page showing the Add or remove scopes button and OAuth scope tables.

Reference: Choose Google Calendar API scopes.

Step 6: Smoke the TracsConnect flow

After deployment:

Enable the integrations.google_calendar feature flag for one test shop.
Open Connections & Integrations in the dashboard.
Open Google Calendar and click Connect.
Complete Google consent with a test Google account.
Choose a writable calendar, leave sync disabled, and click Test.
Enable sync only after the connection test passes.

If Google returns redirect_uri_mismatch, update either the Google Cloud OAuth client or GOOGLE_CALENDAR_REDIRECT_URI so both values are identical.