Set up an organization Google app

An organization admin configures the app in the Haruno dashboard; members use it on their next connect or reconnect.

What this is

When a member connects Gmail, Google Calendar, or Google Drive, Haruno asks Google for permission through either Haruno's built-in app or the Google app configured for the organization.

An organization admin creates a Desktop OAuth app in Google Cloud and uploads it on the organization page in the Haruno dashboard. Members cannot edit these details locally. Gmail and Calendar use the organization app when configured; Google Drive uses it only for My Drive mode.

Connections keep their minting app

Replacing or removing the organization app does not rewrite existing grants. Each connection keeps the app that created it until a member deliberately reconnects. Admins manage the encrypted app details in the dashboard; there is no local editor.

What you'll need

A Haruno organization and organization-admin access to its dashboard.
A Google Cloud project with the Gmail, Calendar, and Drive APIs enabled.
A Google OAuth client whose application type is Desktop app.
The downloaded JSON file, or its client ID and client secret.

The admin configures this once for the organization. Members continue to connect and reconnect individual accounts from Haruno Settings → Integrations.

Before you start: what to expect

Two things are worth knowing before you spend the time, because both follow from one choice you make in step 3.

With an ordinary Gmail account

Google keeps a new External app in testing until it is reviewed. While it is in testing, members must sign in again roughly once a week, and Google shows an “unverified app” warning. The organization admin controls the app's audience and test-user list.

On that warning screen, choose Advanced and then Continue only if your organization admin confirms that this is the organization's app.

With a Google Workspace account

Choose Internal instead of External in step 3. There is no weekly sign-in, no warning screen, and no review — an Internal app can only be used by people in the Google Workspace organization.

The organization admin can ask Google to review and publish an External app to remove the weekly sign-in. Review takes time, and restricted Gmail access can require a security assessment arranged by the organization.

Create the organization Google app

As an organization admin, open the Google Cloud console and create a project for the organization — “Haruno” works as a name.
In your new project, open APIs and services and switch on three of them: the Gmail API, the Google Calendar API, and the Google Drive API. Switch on all three even if you only plan to connect one, so you do not have to come back later.
Open the consent screen settings and fill in an app name and your email address. For the audience, choose External if you are using an ordinary Gmail account, or Internal if you have Google Workspace and want to skip the weekly sign-in.
If you chose External, add every member account that may connect to Haruno to the test users list. An account that is not on this list cannot sign in while the app remains in testing.
Open Credentials, choose to create credentials, pick OAuth client ID, and choose Desktop app as the application type. A Web application client will not work with Haruno.
Download the JSON file straight away, using the download button Google offers the moment the client is created. Google shows the secret only once.
Open the Haruno dashboard, go to the organization page, and upload the downloaded file or enter its client ID and client secret. App administration is dashboard-only: the Windows client has no local editor. Members connect or reconnect Gmail, Google Calendar, or My Drive from Haruno Settings → Integrations.

Google renames these screens from time to time. If a screen is worded slightly differently from the steps above, look for the same idea rather than the exact words.

What each permission unlocks

When a member connects, Google shows the permissions required by that connector and access mode. Keep the required permissions selected or the connection is refused.

Permission on Google's screen	What Haruno can do with it
Send email on your behalf	Write and send mail, and send replies you have approved.
Read, compose, and delete your email	Search and read your mail, open attachments, reply in a conversation, sort messages with labels, and move messages to Trash.
Manage your email labels	Create, rename, and apply labels. Already included if you granted the row above.
See and edit events on all your calendars	Read your schedule and create, change, or cancel events.
See, edit, create, and delete only the Google Drive files you use with this app	Connection-folder mode uses Haruno's built-in app and is rooted at the app-created Haruno folder. It cannot see existing My Drive items merely moved there in the Drive web UI.
See, edit, create, and delete all of your Google Drive files	My Drive mode uses the organization app, requests full Drive access, and is rooted at the account's My Drive. Folder-sharing policy can narrow this access but cannot widen another mode.

Required access follows the selected mode

Gmail needs “Send email on your behalf”. Google Drive connection-folder mode requires the drive.file row through Haruno's built-in app; My Drive mode requires the full Drive row through the organization app. The folder-sharing policy can narrow either connection but cannot widen it.

What this means for scheduled tasks

If you grant “Read, compose, and delete”, a scheduled task running while you are away can move messages to Trash and prepare drafts without checking with you first. Anything that leaves your computer — sending a message, replying, inviting people to an event — is still held for you to approve when you are back. Mail moved to Trash stays recoverable in Gmail for 30 days.

Replacing or removing the organization app

An organization admin replaces or removes the Google app on the organization page in the Haruno dashboard. New Gmail and Calendar connections use the built-in app when no organization app exists; new My Drive connections are unavailable until an organization app is configured.

Existing grants are never changed retroactively. A connection keeps the app that created it, and a member deliberately reconnects that connector to adopt the current organization app.

If something goes wrong

What you see	What it means, and what to do
Error 403: access_denied	The member account is not on the organization app's test users list. Ask an organization admin to add it in the Google Cloud console, then try again.
The browser shows an error page instead of Google's sign-in	The client you created is a Web application client. Create a new one and choose Desktop app as the application type.
Haruno asks you to sign in to Google again about once a week	The organization app is still in testing. That is Google's rule, not a fault. Reconnecting takes seconds; a Google Workspace Internal app removes the limit altogether.
A message mentioning accessNotConfigured	One of the three services is not switched on in your project. Go back to APIs and services and switch on the Gmail, Google Calendar, and Google Drive APIs.
“Google hasn't verified this app”	This can be expected for an organization app in testing. Continue only after an organization admin confirms the app identity.
Haruno asks you to sign in again to switch	That connection was made with a different app. Reconnect that connector to adopt the organization's current app.

Next steps

The organization app is managed in the dashboard. Members can now connect or reconnect their tools, or review what Haruno can reach.

Connectors

See every app Haruno can connect to.

Permissions

Review and change what Haruno can reach.

FAQ

Quick answers to common questions.