The click-by-click script for Propflow's Google OAuth verification video, recorded in the real product. Each step has the link to open, what to show, and what to say.
2026-10-27, take 4 · replaces the test-page script (take 3) · recorded in production on the test company Propflow Demo (TEST) · scopes: calendar.events, gmail.send · full practice run passed 2026-10-27 08:37–08:44 Pacific
Aim for about 4 minutes. Read the lines at a calm pace. On every Google permission screen, click “Show all services” if it is there and pause two full seconds so every permission is readable. Steps 6 to 9 need a fake prospect to write in; Claude sends those emails when you type the cue word in the Claude chat, so keep that window open on the side (off camera).
Google's 2026-09-24 email asked to see “the maximum extent of user-facing features” for each permission, plus working test credentials. A separate test page showed each permission once, but not the product. Take 4 shows the real thing:
gmail.send only (PR #22499, live 2026-10-26), and the calendar connect asks for calendar.events only. The app never asks for anything we did not submit.propflow.test@gmail.com:
clara@inbound.propflowai.co, keeps Gmail's copy).propflow.test@gmail.com only:
1Intro
0:00 – 0:25The privacy policy. Scroll a little so it is clearly our site.
"Hi, I'm Gera, co-founder of Propflow. Propflow is software for property management companies. Our AI leasing assistant, Clara, answers rental leads by email and books apartment tours. We request exactly two Google permissions: calendar.events and gmail.send. I'll show each consent screen, then a real lead going through the product, and the result in the user's own Google account. This is our privacy policy; section 8 covers Google user data under the Limited Use requirements. I'm using a test company in our live product."
2Connect the calendar calendar.events
0:25 – 1:05Click Connect Google → pick propflow.test@gmail.com → “Google hasn't verified this app”: Advanced → Go to Propflow → point at the address bar → “Show all services”: one calendar permission. Pause two seconds, Continue. Back in Propflow, click “Add my calendar” so the agent is on the tour list.
"First, the leasing agent connects their Google Calendar. This is Google's consent screen; our client ID is in the address bar. There is one calendar permission: calendar.events. It is the narrowest one that does the job. Clara has to see which times are already booked before offering a tour, and put the tour on the calendar once it is booked. A free-busy-only or read-only permission cannot add the tour, and full calendar access would let us change settings and sharing, which we never need."
3Connect the company Gmail gmail.send
1:05 – 1:40In Leasing email, type propflow.test@gmail.com → Connect → same Google screens → “Show all services”: one Gmail permission, send only. Pause two seconds, Continue. Back in Propflow the row says Connected.
"Next, the company connects the leasing inbox that rental leads write to. Same consent screen, same client ID. There is one Gmail permission: gmail.send, which only sends email. It is the narrowest Gmail permission there is. We don't request reading, drafting, labelling or deleting mail."
4Why we don't need to read Gmail
1:40 – 2:00The Forwarding section: “Forward a copy of incoming mail to clara@inbound.propflowai.co”.
"Clara still needs to see new leads. Instead of reading the mailbox, the company uses Gmail's own forwarding setting to send a copy of incoming mail to Clara. The company controls that and can turn it off at any time, and it is why we never request a Gmail read permission."
5Pause: turn Clara on
pause the recordingPause the recording. In the Claude chat type “flip”. Claude turns on “Clara replies to email” for the test company and says when it is on. Resume recording.
6A lead arrives, Clara replies from Gmail gmail.send calendar.events
2:00 – 2:40Type “lead” in the Claude chat. Within a minute, Dana Whitfield's email “Tour request: 2 bedroom at Demo Commons” lands in the Inbox; open it. About 30 seconds later, open Sent: Clara's reply is there, from propflow.test@gmail.com, with prices and two tour times. Open it.
"Here is a prospect, Dana, asking to tour a two-bedroom. Clara checked the agent's calendar for busy times, and replied from the company's own Gmail address, using gmail.send. Here it is in the Sent folder: the prices, and two open tour times. We only use whether a time is busy or free; we don't store or share event details."
7The prospect books, the tour lands on the calendar calendar.events
2:40 – 3:15Type “book” in the Claude chat. Claude has Dana pick the first time Clara offered and give her phone number. About 30 seconds later, refresh Tab 4: the tour appears. Click it open. Then Gmail Sent: Clara's “You're all set” confirmation.
"Dana picks a time. Clara books it and adds the tour to the agent's Google Calendar with calendar.events. Here it is in their calendar. And here is Clara's confirmation, again sent from the company's Gmail. Propflow only creates and changes events for tours it booked."
8The prospect cancels, the tour is removed calendar.events
3:15 – 3:40Type “cancel” in the Claude chat. About 30 seconds later, refresh Tab 4: the tour is gone and nothing else moved. Then Gmail Sent: Clara's cancellation note.
"If the prospect cancels, Clara removes the tour from the calendar. The tour is gone, and the agent's own events are untouched. We only ever remove events Propflow created."
9Revoke access and close
3:40 – 4:05Propflow → Delete all connections → confirm.
"Users can remove Propflow's access at any time from their Google Account. To recap: calendar.events lets Clara check busy times and add or remove the tours she books, and gmail.send lets her reply to leads from the company's own address. Those are the only two permissions we request. Thank you for reviewing."
Target length ≈ 4:05 · after recording, tell Claude “done” and it turns the test company back to how the reviewer needs it.
Google asked for working test credentials and step-by-step navigation. Claude drafts the reply to Google's email with both, after the video is uploaded.
Before sending: Claude switches the Propflow sign-in for propflow.test@gmail.com to email codes (today it uses your fingerprint, which only works on your Mac), and you turn off 2-Step Verification and remove the recovery phone on that Google account, so the reviewer is never blocked.
The password never goes on this page or in the video. It goes only in the reply to Google.
What the reviewer can do on their own: sign in, connect the calendar and Gmail (same screens as the video), see Dana's conversation in Propflow, the tour messages in Gmail Sent, and the calendar. Starting a new lead needs a prospect mailbox on our side, so the reply offers to run one live on request.
propflow-integrations-508806 → Google Auth Platform → Data Access): exactly calendar.events and gmail.send, plus openid, email, profile. Nothing else.