Docs

About Rox Architecture User Guide Admin Guide Security Release Notes

Admin Guide

Admin Guide / Integrations / Enterprise Integrations

Google Org-wide Email / Calendar Integration

Enable Google Workspace connectivity for Rox, allowing IT administrators to authorize to securely access calendar and email data on behalf of all users within their Workspace.

This guide explains how you, the admin, can connect email and calendars of all Users on Rox, the two supported architectures, and how Rox keeps data fresh.

Architecture

Rox supports two secure patterns. Choose one based on your governance needs.

The main difference is who owns and manages the Workload Identity Pool.

Option 1: Using Rox Workload Identity Pool (Preferred)

In this model, Rox owns and manages the Workload Identity Pool, and the customer only needs to:

Configure Domain-Wide Delegation in Google Workspace and grant access to Rox’s Service account
- Rox Service Account ID: 117867966423712400255

When to choose this

Fastest and simplest setup
Minimal ongoing maintenance
Recommended for most customers

Required configuration values - Contact the Rox Admin to get the required configuration values like Project Number, Service Account ID, etc.

Option 2: Customer-Managed Identity Pool (Advanced / More Control)

In this model, the customer creates and manages their own Workload Identity Pool and Provider inside their GCP project. Rox then federates with that customer-owned configuration.

When to choose this

Strict security or compliance requirements
Desire for full control over identity trust configuration
Centralized IAM management across internal systems

Prerequisite

This option requires the Google Calendar API and Gmail API to be enabled in the customer's GCP project.

Workload Identity Federation + Service Account Setup Guide

Below guide explains how Google Workspace administrators can securely grant a third-party application access to Google Workspace APIs using Workload Identity Federation (WIF) — without using long-lived service account keys.

By the end of this guide, you will have:

A Workload Identity Pool
An OIDC Provider inside that pool
A Service Account that can be impersonated
Proper IAM permissions (Token Creator + WIF access)
The Service Account Unique ID required for Domain-Wide Delegation

Prerequisites

Google Cloud project admin access
Google Workspace admin access
IAM permissions:
- Workload Identity Pool Admin
- Service Account Admin
- Organization Policy Viewer (recommended)

Step 1: Create a Workload Identity Pool

Google Cloud Console (UI)

Open Google Cloud Console
Go to IAM & Admin → Workload Identity Federation
Click Create Pool
Enter:
- Name: rox-workspace-oauth-pool
- Display name: Rox Workspace OAuth Pool
- Location: Global
Click Create

Equivalent gcloud command

gcloud iam workload-identity-pools create rox-workspace-oauth-pool \\
  --project="rox-google-workspace-access" \\
  --location="global" \\
  --display-name="Rox Workspace OAuth Pool"

gcloud iam workload-identity-pools create rox-workspace-oauth-pool \\
  --project="rox-google-workspace-access" \\
  --location="global" \\
  --display-name="Rox Workspace OAuth Pool"

gcloud iam workload-identity-pools create rox-workspace-oauth-pool \\
  --project="rox-google-workspace-access" \\
  --location="global" \\
  --display-name="Rox Workspace OAuth Pool"

Step 2: Add an OIDC Provider to the Pool

This provider trusts Google OAuth tokens (accounts.google.com) and maps the subject claim.

Google Cloud Console (UI)

Open IAM & Admin → Workload Identity Federation
Select calendar-oauth-pool
Click Add Provider
Choose OIDC
Configure:
- Provider name: google-oauth-provider
- Display name: Google OAuth Provider
- Issuer URL:
- Attribute mapping:
Under Advanced settings, set the Allowed audiences:
- Click Add audience
- Enter your Google OAuth Client ID:

35198670449-4i2f1ldthiscv0t6j7akqtak9mc1gb1o.apps.googleusercontent.com

Save the provider

Equivalent gcloud command

gcloud iam workload-identity-pools providers create-oidc google-oauth-provider \\
  --project="rox-google-workspace-access" \\
  --location="global" \\
  --workload-identity-pool="rox-workspace-oauth-pool" \\
  --display-name="Google OAuth Provider" \\
  --issuer-uri="<https://accounts.google.com>" \\
  --attribute-mapping="google.subject=assertion.sub"
  --allowed-audiences="35198670449-4i2f1ldthiscv0t6j7akqtak9mc1gb1o.apps.googleusercontent.com"

gcloud iam workload-identity-pools providers create-oidc google-oauth-provider \\
  --project="rox-google-workspace-access" \\
  --location="global" \\
  --workload-identity-pool="rox-workspace-oauth-pool" \\
  --display-name="Google OAuth Provider" \\
  --issuer-uri="<https://accounts.google.com>" \\
  --attribute-mapping="google.subject=assertion.sub"
  --allowed-audiences="35198670449-4i2f1ldthiscv0t6j7akqtak9mc1gb1o.apps.googleusercontent.com"

gcloud iam workload-identity-pools providers create-oidc google-oauth-provider \\
  --project="rox-google-workspace-access" \\
  --location="global" \\
  --workload-identity-pool="rox-workspace-oauth-pool" \\
  --display-name="Google OAuth Provider" \\
  --issuer-uri="<https://accounts.google.com>" \\
  --attribute-mapping="google.subject=assertion.sub"
  --allowed-audiences="35198670449-4i2f1ldthiscv0t6j7akqtak9mc1gb1o.apps.googleusercontent.com"

Step 3: Create a Service Account

This service account will be impersonated by the workload identity and used to access Google Workspace APIs.

Google Cloud Console (UI)

Go to IAM & Admin → Service Accounts
Click Create Service Account
Enter:
- Name: rox-workspace-sa
- Display name: Rox Workspace Service Account
Click Create
Skip optional role assignment for now

Equivalent gcloud command

gcloud iam service-accounts create rox-workspace-sa \\
  --project="rox-google-workspace-access" \\
  --display-name="Rox Workspace Service Account"

gcloud iam service-accounts create rox-workspace-sa \\
  --project="rox-google-workspace-access" \\
  --display-name="Rox Workspace Service Account"

gcloud iam service-accounts create rox-workspace-sa \\
  --project="rox-google-workspace-access" \\
  --display-name="Rox Workspace Service Account"

Step 4: Allow the Workload Identity Pool to Impersonate the Service Account

This step enables Workload Identity Federation to act as the service account.

Google Cloud Console (UI)

Go to IAM & Admin → Service Accounts
Open rox-workspace-sa
Go to the Permissions tab
Click Grant Access
Add:
- Principal:
- Role:
  Workload Identity User

Equivalent gcloud command

gcloud iam service-accounts add-iam-policy-binding \\
"rox-workspace-sa@rock-sorter-asdadsad-g1.iam.gserviceaccount.com" \\
  --role="roles/iam.workloadIdentityUser" \\
  --member="principalSet://iam.googleapis.com/projects/<project_number>/locations/global/workloadIdentityPools/rox-workspace-oauth-pool/*"

gcloud iam service-accounts add-iam-policy-binding \\
"rox-workspace-sa@rock-sorter-asdadsad-g1.iam.gserviceaccount.com" \\
  --role="roles/iam.workloadIdentityUser" \\
  --member="principalSet://iam.googleapis.com/projects/<project_number>/locations/global/workloadIdentityPools/rox-workspace-oauth-pool/*"

gcloud iam service-accounts add-iam-policy-binding \\
"rox-workspace-sa@rock-sorter-asdadsad-g1.iam.gserviceaccount.com" \\
  --role="roles/iam.workloadIdentityUser" \\
  --member="principalSet://iam.googleapis.com/projects/<project_number>/locations/global/workloadIdentityPools/rox-workspace-oauth-pool/*"

Step 5: Ensure Token Creator Permission Is Granted

The caller that generates access tokens must have Service Account Token Creator permissions.

⚠️ Without this, token generation will fail with 403 Forbidden.

Google Cloud Console (UI)

Open rox-workspace-sa
Click Grant Access
Add the identity that will mint tokens (for example, another service account or workload identity principal)
Assign role:
- Service Account Token Creator

Equivalent gcloud command (example)

gcloud iam service-accounts add-iam-policy-binding \\
"rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com" \\
  --role="roles/iam.serviceAccountTokenCreator" \\
  --member="rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com"

gcloud iam service-accounts add-iam-policy-binding \\
"rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com" \\
  --role="roles/iam.serviceAccountTokenCreator" \\
  --member="rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com"

gcloud iam service-accounts add-iam-policy-binding \\
"rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com" \\
  --role="roles/iam.serviceAccountTokenCreator" \\
  --member="rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com"

Step 6: Retrieve the Service Account Unique ID (Required for Domain-Wide Delegation)

Google Workspace Domain-Wide Delegation requires the numeric Service Account Unique ID, not the email.

Google Cloud Console (UI)

Go to IAM & Admin → Service Accounts
Open rox-workspace-sa
Copy the Unique ID

Equivalent gcloud command

gcloud iam service-accounts describe \\
"rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com" \\
  --format="value(uniqueId)"

gcloud iam service-accounts describe \\
"rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com" \\
  --format="value(uniqueId)"

gcloud iam service-accounts describe \\
"rox-workspace-sa@rock-sorter-asdasdas-g1.iam.gserviceaccount.com" \\
  --format="value(uniqueId)"

📌 Save this value — you will need it in the Admin Console.

Step 7: Configure Domain-Wide Delegation in Google Workspace

Google Workspace Admin Console (UI)

Go to admin.google.com
Navigate to:
Click Add new
Enter:
- Client ID:
  👉 Paste the Service Account Unique ID
- OAuth Scopes:
  Example:
Click Authorize

Final Checklist

✅ Workload Identity Pool created

✅ OIDC Provider configured

✅ Service Account created

✅ Workload Identity User role granted

✅ Service Account Token Creator granted

✅ Service Account Unique ID added to Domain-Wide Delegation

Common Errors & Fixes

Error	Cause	Fix
`403 Forbidden: generateAccessToken`	Missing Token Creator role	Grant `roles/iam.serviceAccountTokenCreator`
`Invalid audience`	Provider misconfigured	Check issuer URL and pool name
Workspace API access denied	Missing DWD scopes	Recheck scopes in Admin Console

How Rox Syncs

Rox fetches Calendar events (and Email, if enabled) every 15 minutes.
Credentials are refreshed automatically before expiry (WIF assertion or refresh token, depending on your architecture).
Syncs are incremental to minimize API usage and latency.

Permission Scopes

Requested permission scopes depend on the type of integration your organization chooses to go for - read-only or read-write. You can choose the scope individually for email and calendar.

Target	Access level	Requested permissions	What gets enabled
Calendar	Read-Only	https://www.googleapis.com/auth/calendar.readonly	Read access to users’ calendars for meeting insights and scheduling automation
Calendar	Read-Write	https://www.googleapis.com/auth/calendar.readonly https://www.googleapis.com/auth/calendar.events	Read and write access to users’ calendars for meeting insights and scheduling automation
Gmail	Read-Only	https://www.googleapis.com/auth/gmail.readonly	Read access to email subject and email metadata (and optionally email content) in users’ mailboxes for syncing communications to Rox.
Gmail	Read-Write	https://www.googleapis.com/auth/gmail.readonly https://www.googleapis.com/auth/gmail.send	Read access & write access to users' mailboxes and ability to send

Security

Least-privilege by default (read-only scopes).
For Option B, Rox uses short-lived federated credentials; no long-lived keys are stored by Rox.
You can revoke access centrally (remove DWD, disable the WIF binding, or disconnect in Rox).

Admin steps to follow

Decide between the two options stated above.
Implement the chosen option in Google Workspace.
Go to Rox to finish the setup using the steps below.

Steps for setup in Rox

Go to Settings > Integrations page
Click the Connect button for Google Workspace
Select the sync level for Calendar, and click Next

Select the sync level for Email, any email domains that you want to restrict from indexing and the number of past days that you want to sync the data for.

Enter the details from the Google Workspace. Optionally, you can restrict Rox from syncing the data of particular users

Click on Connect. You will be taken to the Google authorization page. Please authorize the operation.
You will be re-directed to Rox and you will be able to see the Google Workspace integration is live.

Rox is committed to the privacy and security of its users. Customer data processed through the Rox platform is encrypted in transit and at rest using AES-256 encryption and is never used to train generalized machine learning models. Rox maintains SOC 2 Type II compliance and undergoes independent third-party security audits on an annual basis. All AI-generated outputs, including but not limited to prospect recommendations, message drafts, meeting summaries, and pipeline scoring, are provided for informational purposes and should be reviewed by authorized personnel before any action is taken. Performance metrics referenced on this website, including pipeline generation figures, response rates, and revenue impact, reflect results reported by individual customers under specific configurations and may not be representative of all deployments. Actual results will vary based on factors including but not limited to data quality, CRM configuration, outreach volume, market conditions, and target audience. Rox does not guarantee specific revenue outcomes. The Rox platform integrates with third-party services including Salesforce, HubSpot, Gmail, Microsoft Outlook, Slack, and others; availability and functionality of third-party integrations are subject to the respective providers' terms of service and may change without notice. Features described as "autopilot," "autonomous," or "automated" operate within user-defined parameters and require initial configuration and ongoing oversight. Rox, the Rox logo, and "Revenue on Autopilot" are trademarks of Rox Data Corp. All other trademarks are the property of their respective owners. Service availability is subject to the terms outlined in your enterprise agreement. For questions regarding data processing, compliance certifications, or platform capabilities, contact security@rox.com.