Google Workspace Integration

Connect a teammate’s work Gmail so the mail in their chosen labels shows up in Muin’s shared communications inbox.

The Google Workspace integration brings each teammate’s work Gmail into the Muin unified communications inbox. Mail in the labels they choose appears alongside donor receipts and Muin-routed conversations, and AI suggested drafts are available on every thread.

The connection is read-only on Gmail: Muin syncs mail in and never sends from your Gmail address. You can still reply to a synced thread from Muin. The reply goes out through Muin’s own email service with your mailbox address as the Reply-To, so the person’s answer lands back in your Gmail and threads into the same Muin conversation.

The integration is per-user: every teammate authorizes their own mailbox, and sign-in tokens are encrypted at rest with a dedicated application encryption key. A one-time admin trust step at admin.google.com flips off the “unverified app” warning for everybody on your domain.

When you’d use this

Donors and families email staff directly, and you want those conversations next to the rest of their record.
You want AI-suggested reply drafts based on real mail threads.
A teammate is leaving and you need to see or remove the mailbox they connected.

What you can do

Inbound mail in one place

Unified inbox. Selected Gmail labels (default INBOX) sync every 5 minutes.
Threading. Incoming replies thread back into the same Muin conversation, so donor and staff context stays together.
Reply from Muin. Available. Replies are sent by Muin’s email service with your mailbox in Reply-To, because Muin does not request send permission on your Gmail.

AI on real-mail context

Muin’s AI reply assistant reads the messages in the connected mailbox the user selected and proposes drafts. Prompt-injection sanitization strips control phrases out of inbound text; per-tenant cost/latency limits prevent runaway agent loops.

Privacy + visibility

Each connection is authorized by one user, and the admin view exposes only connection metadata (who connected, last sync, sync status).

Synced messages are not private to the connecting user. Mail pulled from a connected mailbox lands in the organization’s shared comms inbox, where any teammate with access can read it. Per-user message isolation is planned, not current. Connect a mailbox only if team-wide visibility is what you want.

Setup at a glance

Workspace admin trust (one-time, ≤5 minutes). A super-admin signs in to admin.google.com → Apps → Web and mobile apps → Manage Third-Party App Access → Add app, and trusts Muin’s OAuth client. See Workspace admin setup.
Per-user connect. Each teammate goes to Settings → Communications → Connected mailboxes and signs in with Google.
Pick labels. Default is INBOX; users can change later.
Done. Backfill of the most recent 100 messages starts immediately; ongoing sync runs every 5 minutes.

Full step-by-step: Connect a Google Workspace mailbox.

Installing from the Google Workspace Marketplace

When a Workspace admin installs Muin from the Google Workspace Marketplace, the install hands them to Muin’s sign-in page (if your organization already uses Muin) or to signup with their Workspace domain filled in. Installing does not create an organization on its own; the admin still completes Muin’s normal signup.

Required OAuth scopes

Scope	Used for
`https://www.googleapis.com/auth/gmail.readonly` (selected labels only)	Sync inbound mail into the unified inbox; thread replies; AI draft context.
`email`, `openid`	Identify the connecting user.

We do not request gmail.send. Muin never sends from your Gmail address, so we don’t ask for permission to.

The mailbox connection does not request access to Drive, Calendar, Contacts, Chat, Meet, Sites, or any other Workspace service. Google Drive and Google Calendar are separate connections you add, if you want them, from Connections → Integration Catalog (Integrations Overview).

Personal Gmail

Connecting a personal @gmail.com account is not currently available. That flow existed only to send from your personal address (its inbound arrives via a Gmail forwarding rule, not the API), and sending from a connected mailbox isn’t supported yet, so there is nothing it would add. Read more.

Microsoft 365

Outlook + work Microsoft 365 mailboxes connect via the equivalent Microsoft 365 integration.

Disconnecting a mailbox

Open Settings → Communications → Connected mailboxes.
Click Disconnect on the mailbox.
In Disconnect mailbox?, decide whether to tick Also delete all messages I’ve already synced from this mailbox. Leave it unticked to keep past messages in the shared inbox.
Click Disconnect. Muin stops syncing new messages from that mailbox.

When it goes wrong

What you see	Why	What to do
Google warns the app is unverified	The one-time admin trust step has not been done for your domain.	Ask a Workspace super-admin to follow Workspace admin setup.
The mailbox status shows a sync error	Google refused the stored sign-in, often after a password change or the admin removing access.	Disconnect the mailbox and connect it again. More fixes: Communications troubleshooting.
Some mail is missing	Only the labels you picked sync (default `INBOX`).	Change the labels on the connected mailbox.
A reply sent from Muin does not show the Gmail address as the sender	Muin sends replies from its own email service and puts your mailbox in Reply-To.	Nothing to fix. If the sender must be your Gmail address, reply from Gmail; it threads back into Muin.