Gmail

The Gmail provider uses a dedicated adapter (GmailAdapter) rather than the generic HTTP adapter — it handles OAuth token refresh, MIME construction, and thread resolution transparently.

Setup

1. Create a Google Cloud OAuth client

• Google Cloud Console → APIs & Services → Credentials → OAuth client ID
• Type: Web application
• Scopes (configured on the consent screen):
  • https://www.googleapis.com/auth/gmail.send
  • https://www.googleapis.com/auth/gmail.readonly
  • https://www.googleapis.com/auth/gmail.modify
• Redirect: https://tappass.example.com/api/connect/gmail/callback

2. Configure TapPass server

GOOGLE_OAUTH_CLIENT_ID=<id>.apps.googleusercontent.com
GOOGLE_OAUTH_CLIENT_SECRET=<secret>

The same Google OAuth client is shared with Google Drive.

3. Connect a mailbox

Open GET /api/connect/gmail (or use the dashboard) to start the OAuth flow. TapPass stores the mailbox credential in the vault, scoped per user.

Operations

Operation	Op group	Description
search	read	Search messages by query
read	read	Read a single message
send	write	Send an email
labels	read	List labels

Usage

Your agent never calls Gmail directly. When the model requests a Gmail operation as a tool call through the governed gateway, TapPass resolves the provider, fetches the connected credential from the vault, executes the operation, and audits the call. send is subject to PII detection and your tool-decision policy before anything goes out.

Email mirror / redirect

The email governance flag routes agent emails for review before they go out. Pass it per request via the X-TapPass-Flags header:

X-TapPass-Flags: email=mirror:supervisor@yourcompany.com

mirror:<addr> sends a copy to the supervisor while the original still sends; internal:<domain> restricts recipients to your domain.

Policy example

Block outbound Gmail to anyone outside your corporate domain:

For example, you can block send to any recipient outside @yourcompany.com. Rules like this are authored in the dashboard, from a template, or in plain English.