How a Google Workspace client with a shared leasing address can connect to PropFlow, what Google requires to allow it, and the options for Fede.
2026-09-15 · proposal, not a build ticket · shared-mailbox research: Microsoft connect flow — research
On this page
The next customer, Situs Group (645 residential units), runs on Google Workspace and has a shared leasing address, not a Microsoft mailbox. This is a separate page from the Microsoft connect flow because the platform and the verification path are both different: Google gates a shared address and a mailbox-read scope behind its own app-verification process, with its own timeline and its own cost. The two pages should not be merged into one.
| Area | State |
|---|---|
| gcloud CLI | Installed, signed in as fede@propflowai.co, project propflow-admin-tools. Token expired, so the consent-screen and API state could not be read this session. |
| gam | Not installed. |
| OAuth code | Built by Jose (2026-04-24), hardened and unified by Gera (#7875). A separate integrations OAuth client (GOOGLE_INTEGRATIONS_CLIENT_ID / GOOGLE_INTEGRATIONS_CLIENT_SECRET), with authorize/callback/status/disconnect routes for google-email and google-calendar under src/app/api/integrations/. |
| Calendar adapter | 392-line Google Calendar adapter with a test at src/lib/domain/calendar/provider/google.ts. |
| Dev tooling | Inspector at /admin/dev/integrations-inspector. |
| Scopes today | calendar.events, calendar.readonly, and gmail.send only. No Gmail read scope. |
| Gmail settings page | Build paused 2026-09-05. |
| Verification submission | None found anywhere. |
| Model | Works for us? | Why |
|---|---|---|
| Google Group / collaborative inbox | No | No mailbox sits behind it and there is no OAuth surface to read or send as it. |
| Delegated mailbox (domain-wide delegation) | No | Needs a super admin to grant delegation across the domain. Google discourages it: "Avoid using domain-wide delegation if you can." |
| Alias on the leasing agent's account | Yes | Mail lands in that person's inbox; the app sends as the alias via "Send mail as." |
| Real account with its own login | Yes | A normal Google account, signs in like any user. |
Sources: Gmail API delegate settings, Alias and signature settings, Domain-wide delegation best practices, Help Scout article 78
Calendar connects per agent on calendar.events. This is a sensitive scope, not a restricted one, so it carries lighter verification and no CASA security assessment.
calendar.events and gmail.send, about 3 to 5 business days. Sensitive scope verificationgmail.modify, a restricted scope. That requires restricted-scope verification with a demo video. Restricted scope verification| Option | What it is | Recommendation |
|---|---|---|
| 1 | Start sensitive-scope verification now, add gmail.modify and start CASA in parallel, and go live at Situs under their admin's Trusted-app allowlist while CASA runs. Leasing address is an alias on the leasing agent's account, the same person-with-access model already used for Microsoft. | Recommended. |
| 2 | Send-only from the alias (gmail.send, no CASA). Leads arrive via the Yale forwarding pattern instead of a read scope. | Rejected as a default for Western Slope. |
| 3 | Domain-wide delegation via a service account. | Rejected: needs a super admin and reaches the whole domain. |
gmail.modify now or defer it).history.list polling loop, or users.watch later.