Integrations · Gmail
A Guild agent can read, triage, and send email from a Google account through the Gmail integration. Guild stores the OAuth token server-side, refreshes it automatically, and never exposes it to agent code or prompts. Credential policies and audit run through Guild’s credential proxy on every call.
Book a demo
See how teams govern agents that use Gmail.
Start free
Connect Gmail and scope your first agent.
What the Gmail integration exposes
The integration provides tools covering messages, threads, drafts, labels, mailbox history, attachments, account settings, filters, forwarding addresses, send-as aliases, and push notification watches. Tools follow the naming prefix gmail_oauth_ and can be imported as a full set or narrowed with pick. The tools table on this page reflects the latest published version of the package.How it works
1
Open Credentials in Guild
Go to Credentials in Guild. The page lists services you can connect.
2
Authorize your Google account
Click Gmail and complete the OAuth authorization flow. Guild stores the token and refreshes it automatically.
3
Import tools into your agent
Import GmailOauthTools from the package and spread it into your agent’s tools object. Use pick to include only the tools your agent needs.
Why Gmail access needs governing
Gmail tools can send messages, delete threads permanently, modify filters, and update forwarding settings. Guild’s credential proxy sits between every agent call and the Gmail API: it checks credential policies before the request leaves Guild, then injects the OAuth token server-side. Agent code never sees the credential. You can write ALLOW and DENY rules that restrict which gmail_oauth_ operations an agent may call, and scope those rules to specific agents or workspaces on the same connected credential. Credentials can be scoped to an account, a single workspace, a member, or one agent. A workspace can be restricted to its own credentials so it never falls back to the organization’s shared token. These controls mean a triage agent that only reads mail and a sending agent that dispatches replies can share one Gmail connection without sharing each other’s permissions.About the Gmail integration
The@guildai-services/guildlabs~gmail-oauth package gives your agents access to the Gmail API through Guild’s Gmail integration.
Authentication
- Type: OAuth 2.0
- Token management: Refreshed automatically
Setup
1
Open Credentials
Go to Credentials in Guild.
2
Connect Gmail
Click Gmail and authorize with your Google account.
Usage
Selecting specific tools
Tools are named with thegmail_oauth_ prefix. Use pick() to include only what your agent needs.
Tools
Tools in the latest published version ofguildlabs~gmail-oauth:
All 59 tools
All 59 tools
Frequently asked questions
Can I limit my agent to reading email without letting it send?
Can I limit my agent to reading email without letting it send?
Yes. Write a credential policy that DENY-lists gmail_oauth_users_messages_send and gmail_oauth_users_drafts_send, or use pick to include only read-oriented tools such as gmail_oauth_users_messages_list and gmail_oauth_users_messages_get when you define the agent.
Does Guild refresh the Gmail OAuth token automatically?
Does Guild refresh the Gmail OAuth token automatically?
Yes. Token management is handled automatically by the integration; agent code does not need to request or store tokens.
Can the agent react to incoming email the moment it arrives?
Can the agent react to incoming email the moment it arrives?
Not yet via webhook events. The catalog entry for this integration lists no webhook events, so the agent cannot be triggered automatically by incoming mail. You can poll the mailbox using gmail_oauth_users_messages_list or use gmail_oauth_users_watch to set up a push notification watch on the mailbox.
Can one Gmail credential serve multiple workspaces with different permissions?
Can one Gmail credential serve multiple workspaces with different permissions?
Yes. Connect one account-level credential and then write credential policy rules scoped to individual workspaces or agents. Each rule can allow or deny different gmail_oauth_ operations per workspace without requiring a separate Google account authorization.
Put a governed agent on Gmail this week
Book a demo
See how teams govern agents that use Gmail.
Start free
Connect Gmail and scope your first agent.