Google Workspace admin

This page is for Google Workspace super admins. It shows how to trust Hebno once so members can connect Gmail, Drive and Meet without errors, which scopes each integration requests, and how to limit or revoke access. Trusting Hebno removes a blocker. It does not widen what any member can open, because Google enforces each member’s own permissions.

At a glance


Who	A Google Workspace super admin, in the Google Admin console
Where	Security → Access and data control → API controls → App access control
What you do	Add Hebno by its OAuth client ID and mark it Trusted
Result	Members connect their own accounts. Each member sees only what their own Google permissions allow.

Why trust is needed

Gmail and Drive scopes are restricted by Google. If your organisation sets those services to Restricted in App access control, only apps marked Trusted or Specific Google data can use them, and members of the domain see a blocked-access message when they connect. Marking Hebno trusted once fixes this for the organisation or the organisational units you choose. If you have not restricted any services, members can connect without admin action.

Mark Hebno as trusted

Get Hebno's OAuth client ID

In Hebno, open Admin → Connectors → Catalogue, select a Google card, and copy the OAuth client ID shown in the organisation panel. Or ask support@hebno.com.

Open App access control

In the Google Admin console, go to Security → Access and data control → API controls, then select Manage third-party app access.

Add Hebno

Select Add app → OAuth App Name Or Client ID. Search by the client ID, select Hebno, and select the OAuth client.

Choose where it applies

Select Everyone in the organisation, or select organisational units and groups. See Restrict by organisational unit.

Set the access level

Choose Trusted: Can access all Google services, or Specific Google data and select only the scopes in the table below. Select Finish.

Specific Google data limits Hebno to the integrations you choose. Select only the scopes for the Google integrations your organisation allows in Hebno.

Scopes each integration requests

Every authorisation includes openid, email and profile. A product’s scopes are requested only when a member uses that product.

Integration	Scope	Purpose
Google Drive	`https://www.googleapis.com/auth/drive`	Read, search, save and convert files, including shared drives
Gmail	`https://www.googleapis.com/auth/gmail.readonly`	Search and read messages
Gmail, sending	`https://www.googleapis.com/auth/gmail.send`	Send an email a member confirmed. Requested only on Allow sending.
Google Calendar	`https://www.googleapis.com/auth/calendar.readonly`	Read events
Google Calendar	`https://www.googleapis.com/auth/calendar.freebusy`	Check colleagues’ free and busy times
Google Calendar	`https://www.googleapis.com/auth/directory.readonly`	Match names to colleagues’ email addresses
Google Calendar, invitations	`https://www.googleapis.com/auth/calendar.events`	Create events and send invitations. Requested only on Allow invitations.
Google Meet	`https://www.googleapis.com/auth/meetings.space.readonly`	Read conference records, transcripts, notes and recording details
Google Meet	`https://www.googleapis.com/auth/drive.meet.readonly`	Open transcript and notes files that Meet saves to Drive
Google Meet	`https://www.googleapis.com/auth/calendar.readonly`	Find calendar events with a Meet link

Hebno requests no permission to delete mail, change labels or change sharing. Write permissions (gmail.send, calendar.events) are separate grants, so you can trust Hebno for reading while members choose whether to approve sending.

Restrict by organisational unit

Apply the trust setting to the organisational units whose members use Hebno, for example the delivery and advisory teams, and leave other units unconfigured. Members outside the selected units cannot grant Hebno restricted scopes. You can use a different access level per organisational unit, such as Specific Google data for a contractor unit. In Hebno, owners and admins add a second layer: allow or block each Google integration under Admin → Connectors → Catalogue, and set Read only or Read and write. Both controls apply, and the stricter one wins.

Enable for the organisation

In Hebno, an owner or admin selects Enable for the organisation on a Google card. A super admin signs in to Google and approves that product’s scopes once for the domain, and members connect without a Google consent screen. Each card approves only its own product, so approving Drive does not approve Gmail. Each member still connects their own account.

Meet transcripts and notes

Hebno reads a transcript or Gemini notes only if Google produced one. In the Admin console, under Apps → Google Workspace → Google Meet → Meet video settings, check these:

Recording and Transcripts are on for the organisational units that run client calls, and hosts can start them.
Take notes for me (Gemini notes) is on for those units, and your Workspace edition includes it.

Google deletes transcript entries 30 days after a conference ends, and stores Gemini notes as Google Docs in the organiser’s Drive, so Drive retention rules apply to them. If you restrict apps from reading Meet artefacts, Hebno shows Your organisation has turned off transcript access for apps and reads meeting details only.

Revoke access

To	Do this
Stop one member	In Hebno, Admin → Connectors → Connections, find the member and select Revoke. They lose access until they reconnect.
Stop a whole integration	In Hebno, switch the card to Blocked under Admin → Connectors → Catalogue. Chat hides it and new authorisations stop.
Stop Hebno across your domain	In the Admin console, open API controls → Manage third-party app access, select Hebno and set Blocked, or remove it. Google revokes the tokens.
Review what members granted	In the Admin console, open the app’s page to see its users and scopes.

Switching a restricted service to Restricted in App access control also revokes tokens for apps that are not trusted. Members then see Your Google connection needs reconnecting in Hebno. Revoking changes nothing in Google beyond access. Files, email and events are unchanged.

Overview

Microsoft 365