This guide explains how to configure a Google Workspace connector in Cloudiway and set up the necessary Google API feeds in the Google Admin Console. This configuration is required for migrations to and from Google Workspace.
Overview
A Google Workspace connector allows Cloudiway to access your Google domain's data including emails, calendars, contacts, Drive files, Sites, and Chat. You can use the connector as either a source (migrating from Google) or target (migrating to Google).
Two Configuration Options
You can either use Cloudiway's predefined service account (faster setup) or create your own custom service account (more control). This guide covers both options.
Prerequisites
Before configuring the connector, ensure you have:
- Super Admin access to Google Workspace Admin Console
- Google Cloud Console access (for custom service account)
- A valid Cloudiway account with an active project
- The migration account credentials (email and password)
Step 1: Create the Connector
- Log in to the Cloudiway Portal
- Navigate to Connectors in the left menu
- Click + New Connector
- Select Google Workspace (or G Suite) as the connector type
- Enter a descriptive name for your connector (e.g., "Google Source - Company Domain")
- Choose the connector role:
- Source - Migrating data FROM Google Workspace
- Target - Migrating data TO Google Workspace
- Select the migration products you need (Mail, Drive, Sites, Chat, etc.)
Step 2: Configure Required Fields
Complete the following configuration fields:
Domain Configuration
| Field | Description | Example |
|---|---|---|
| Domain Names | Primary and secondary domains to manage | company.com, company.org |
| Migration Account | Super Admin email for API operations | admin@company.com |
| Migration Account Password | Password that won't change during migration | ••••••••• |
Super Admin Recommended
We strongly recommend using a Super Admin account as the migration account. This ensures full access to all user data and avoids permission issues during migration.
Additional Fields (for Sites and Groups)
If migrating Google Sites or Groups, also configure:
- Phone Number - Required for 2-step verification if enabled
- Favorite Logon Location - Helps avoid Google security alerts
Service Account Configuration
Choose one of these options:
Option A: Cloudiway Service Account
Use Cloudiway's pre-configured service account for faster setup.
Client ID: 114818336788408865729
Option B: Custom Service Account
Create your own for full control. See our service account guide.
Provide: Client ID, Private Key JSON
Step 3: Set Up Domain-Wide Delegation
You must authorize the service account to access your domain's data through domain-wide delegation:
- Sign in to the Google Admin Console
- Navigate to Security → Access and data control → API Controls
- Click Manage Domain Wide Delegation
- Click Add new
- Enter the Client ID:
- For Cloudiway's account:
114818336788408865729 - For custom account: Your service account's client ID
- For Cloudiway's account:
- Paste the required OAuth Scopes (see next section)
- Click Authorize
Propagation Time
Domain-wide delegation changes can take up to 24 hours to propagate, though they usually apply within a few minutes.
Step 4: OAuth Scopes by Migration Type
Copy and paste the appropriate OAuth scopes based on your migration needs. Each scope must be separated by a comma.
Important Notes About Scopes
- Some scopes require slashes (/) at the end and others don't - copy the strings exactly as shown.
- If you add another scope later, existing scopes will be removed - add the whole list at once.
- Copy all needed scope blocks to notepad first, then paste into the OAuth Scopes field.
Migration FROM Google Workspace
Mail Migration FROM Gmail
https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly,
https://www.googleapis.com/auth/admin.directory.user,
https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.group,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/calendar,
https://www.googleapis.com/auth/gmail.labels,
https://www.googleapis.com/auth/tasks.readonly,
https://www.googleapis.com/auth/contacts.readonly,
https://www.googleapis.com/auth/gmail.imap_admin,
https://www.googleapis.com/auth/gmail.readonly,Migration FROM Google Groups and Vault
https://www.googleapis.com/auth/ediscovery,
https://www.googleapis.com/auth/devstorage.full_control,
https://www.googleapis.com/auth/admin.directory.user.readonly,The GetList for Google Groups requires these additional feeds:
https://www.googleapis.com/auth/admin.directory.group,
https://www.googleapis.com/auth/admin.directory.group.readonly,Migration FROM GDrive or Google Team Drive
https://www.googleapis.com/auth/drive.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.user.readonly,To automatically grant organizer permission on all team drives, add:
https://www.googleapis.com/auth/drive,Migration FROM Google Sites
https://www.google.com/calendar/feeds/,
https://www.googleapis.com/auth/calendar,
https://www.googleapis.com/auth/drive.readonly,
https://www.googleapis.com/auth/admin.directory.user.readonly,
https://sites.google.com/feeds/,Migration FROM Google Chat
https://www.googleapis.com/auth/chat.memberships,
https://www.googleapis.com/auth/chat.messages.readonly,
https://www.googleapis.com/auth/chat.spaces.readonly,
https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/drive.readonly,Migration TO Google Workspace
Mail Migration TO Gmail
https://www.googleapis.com/auth/admin.directory.resource.calendar,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/calendar,
https://www.googleapis.com/auth/gmail.labels,
https://www.googleapis.com/auth/tasks,
https://www.googleapis.com/auth/gmail.insert,
https://www.googleapis.com/auth/gmail.readonly,
https://www.googleapis.com/auth/contacts,
https://www.googleapis.com/auth/gmail.imap_admin,
https://www.google.com/m8/feeds/,Migration TO GDrive or Google Team Drive
https://www.googleapis.com/auth/drive,Migration TO Google Chat (Google Space)
https://www.googleapis.com/auth/chat.spaces,
https://www.googleapis.com/auth/chat.import,
https://www.googleapis.com/auth/chat.memberships,
https://www.googleapis.com/auth/chat.messages,
https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/drive,Coexistence Scopes
GALSync G Suite
https://apps-apis.google.com/a/feeds/user/,
https://apps-apis.google.com/a/feeds/groups/,
https://apps-apis.google.com/a/feeds/policies/,
https://www.google.com/m8/feeds/,
https://apps-apis.google.com/a/feeds/alias/,
https://www.googleapis.com/auth/admin.directory.user,
https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/directory.readonly,
https://www.googleapis.com/auth/contacts,Free/Busy G Suite
https://www.googleapis.com/auth/calendar.freebusy,Mail Forwarders
https://www.googleapis.com/auth/gmail.settings.basic,
https://www.googleapis.com/auth/gmail.settings.sharing,Step 5: Test the Connection
- Return to the Cloudiway Portal
- In your connector configuration, click Test Connection
- Wait for the validation to complete
- If successful, you'll see a green success message
- Save the connector configuration
Connection Failed?
If the connection test fails, verify:
- Domain-wide delegation is properly configured
- All required OAuth scopes are authorized
- The migration account has Super Admin rights
- The service account Client ID is correct
Configuration Complete!
Your Google Workspace connector is now ready. You can proceed to create user mappings and start your migration project.
