Skip to main content
Integrations · Gmail
A Guild agent can read, triage, and send email from a Google account through the Gmail integration. Guild stores the OAuth token server-side, refreshes it automatically, and never exposes it to agent code or prompts. Credential policies and audit run through Guild’s credential proxy on every call.

Book a demo

See how teams govern agents that use Gmail.

Start free

Connect Gmail and scope your first agent.

What the Gmail integration exposes

The integration provides tools covering messages, threads, drafts, labels, mailbox history, attachments, account settings, filters, forwarding addresses, send-as aliases, and push notification watches. Tools follow the naming prefix gmail_oauth_ and can be imported as a full set or narrowed with pick. The tools table on this page reflects the latest published version of the package.

How it works

1

Open Credentials in Guild

Go to Credentials in Guild. The page lists services you can connect.
2

Authorize your Google account

Click Gmail and complete the OAuth authorization flow. Guild stores the token and refreshes it automatically.
3

Import tools into your agent

Import GmailOauthTools from the package and spread it into your agent’s tools object. Use pick to include only the tools your agent needs.

Why Gmail access needs governing

Gmail tools can send messages, delete threads permanently, modify filters, and update forwarding settings. Guild’s credential proxy sits between every agent call and the Gmail API: it checks credential policies before the request leaves Guild, then injects the OAuth token server-side. Agent code never sees the credential. You can write ALLOW and DENY rules that restrict which gmail_oauth_ operations an agent may call, and scope those rules to specific agents or workspaces on the same connected credential. Credentials can be scoped to an account, a single workspace, a member, or one agent. A workspace can be restricted to its own credentials so it never falls back to the organization’s shared token. These controls mean a triage agent that only reads mail and a sending agent that dispatches replies can share one Gmail connection without sharing each other’s permissions.

About the Gmail integration

The @guildai-services/guildlabs~gmail-oauth package gives your agents access to the Gmail API through Guild’s Gmail integration.

Authentication

  • Type: OAuth 2.0
  • Token management: Refreshed automatically

Setup

1

Open Credentials

Go to Credentials in Guild.
2

Connect Gmail

Click Gmail and authorize with your Google account.

Usage

Selecting specific tools

Tools are named with the gmail_oauth_ prefix. Use pick() to include only what your agent needs.

Tools

Tools in the latest published version of guildlabs~gmail-oauth:

Frequently asked questions

Yes. Write a credential policy that DENY-lists gmail_oauth_users_messages_send and gmail_oauth_users_drafts_send, or use pick to include only read-oriented tools such as gmail_oauth_users_messages_list and gmail_oauth_users_messages_get when you define the agent.
Yes. Token management is handled automatically by the integration; agent code does not need to request or store tokens.
Not yet via webhook events. The catalog entry for this integration lists no webhook events, so the agent cannot be triggered automatically by incoming mail. You can poll the mailbox using gmail_oauth_users_messages_list or use gmail_oauth_users_watch to set up a push notification watch on the mailbox.
Yes. Connect one account-level credential and then write credential policy rules scoped to individual workspaces or agents. Each rule can allow or deny different gmail_oauth_ operations per workspace without requiring a separate Google account authorization.

Put a governed agent on Gmail this week

Book a demo

See how teams govern agents that use Gmail.

Start free

Connect Gmail and scope your first agent.
Also runs on Guild: Discord · Email · SendGrid · Slack Read: Docs: Credential policies · Credentials · Tools in agents
Last modified on October 16, 2026