Set up Google Chat API access for SysCloud backup

Step 1: Google Cloud Project Creation

Step 2: Enable Chat API and configure app

Step 3: OAuth 2.0 consent screen configuration & add scopes

Step 4: Create OAuth 2.0 Client Credentials

I. Google Cloud Project Creation

Before you can create OAuth credentials, you need a Google Cloud project. This project serves as a container for all your APIs and authentication configurations.

Note: If you already have an account with ‘Google Cloud console” you can skip Step 1.

A. Access Google Cloud Console

The Google Cloud Console is where you'll manage all your cloud resources and OAuth configurations.

Instructions:

1. Navigate to https://console.cloud.google.com/
2. Sign in with your Google Account (use an account with admin access)
3. If you see a welcome screen, read through it and click "Agree and continue"
4. Accept the terms of service if prompted

B. Create a New Project

A Google Cloud project is a container that holds all your APIs, credentials, and settings.

Instructions:

1. Click on the Project Selector dropdown on the top left of the page.
   
2. In the popup window that appears, click the blue "NEW PROJECT" button. 
   
3. A form will appear asking for project details:
   • Project Name: Enter a meaningful name like "My Backup Application" or "OAuth Integration Project"
   • Organization: This will likely be auto-filled or show "No organization"
   • Parent resource: Select your organization.
   
4. Click on "CREATE" button.
   
5. You'll see a notification at the bottom right indicating "Project creation in progress." Once complete, you'll be automatically switched to your new project.

II. Enable API and configure app

A. Enable required API

Before SysCloud can access Google Chat resources, you must enable the Google Chat API in your Google Cloud project.

Instructions:

1. Go to the home page of the project created.

2. Go to APIs & Services > Library.

   

3. Search for Google Chat API in the search bar and select it. 

   
   
   

4. Click Enable.
   

5. Wait for the API to be enabled. You’ll see a loading indicator while Google enables the API.

Note: When you enable an API, Google Cloud grants your project access to that API. This doesn't immediately consume resources; it just makes the API available for your project to use.

B. Configure the Google Chat app

Google Chat requires a Chat app configuration before the Google Chat API can be used. This is a one-time setup for the selected project.

Instructions:

1. In the same view, go to the Configuration tab.

   
   

2. Click Configuration, if you have not already configured the app.

   • App name: Enter a recognizable name, such as SysCloud Google Chat Backup.
   • Avatar URL: Enter an avatar URL. This can be a placeholder image. Please note: this URL should have 'https://'  Eg: https://syscloud.com
   • Description: Enter a short description, such as Google Chat backup with SysCloud.
3. Under Functionality settings, select Join spaces and group conversations.
   
   
4. Under Connection settings
   1. Select HTTP endpoint URL
   2. For Triggers, select Use a common HTTP endpoint URL for all triggers. Enter the endpoint URL as 'https://localhost'
      
      

5. Under Visibility, select the option based on how your organization wants to make this Chat app available.

   To restrict access, select Make this Chat app available to specific people and groups in your organization and enter the email addresses or Google Groups that should have access to the app.

   Example: admin@yourdomain.com, backup-admins@yourdomain.com
   
   Note: This setting only controls who can access the Google Chat app in your organization. It does not determine which Google Chat users, spaces, or messages SysCloud can back up. 
   
   
   

6. Under Logs, please enable Log errors to Logging

   

7. Click Save.
   

III. OAuth 2.0 consent screen configuration and add scopes

The OAuth consent screen is what users see when they are asked to authorize your application. It should clearly explain what your application does and what permissions it needs.

A. Create OAuth 2.0 consent screen

Instructions:

1. For your selected project, navigate to OAuth consent screen
2. Click on 'Get Started'.
   

B. Configure consent screen details

Instructions:

1. Configure app information
   1. Application Name: Enter your application's name (e.g., "MyCompany Backup Service"). This will appear on the consent screen, so make it something users will recognize.
   2. User Support Email: Enter an email address where users can contact you if they have questions about your application's privacy or security.
2. Click on 'Next'
   
3. Configure audience
   1. External: Choose this option (recommended for most applications). This allows you to create an application that can be used by anyone with a Google account.
   2. Internal: Choose this only if your organization specifically requires it. This limits access to users within your Google Workspace domain.
4. Click on 'Next'
   
5. Developer Contact Information: Enter your contact email (e.g., admin@mycompany.com). This is where Google will contact you if there are issues with your application.
6. Click on 'Next'
   
7. Agree to Google terms and 'Continue'
   
8. Click on 'Create'
   
9. Click on 'Branding' in the left navigation and scroll-down to find 'Authorized domains'.
   
10. Authorized Domains: Add the domain(s) where your application is hosted:
    • Click "Add Domain"
    • Enter your domain name (e.g., backup.mycompany.com)
    • You may need to verify domain ownership. If prompted, follow Google's verification process.
    • Add multiple domains if your application is hosted in multiple locations
11. Click on 'Save'.
    

C. Define OAuth scopes

Scopes define what permissions your application is requesting.

For Google Chat backup, add the required scopes that allow SysCloud to access Google Chat spaces, memberships, messages, users, and groups.

Instructions:

1. On the left navigation, click Data access.

2. Click ADD OR REMOVE SCOPES.

   

3. A scope selection dialog will appear with a search bar and list of available scopes.
4. Add all required scopes for this integration. For each scope, either:
   
   Method 1:
   • Scroll down to the Manually add scopes section.
   • Copy and paste the following scopes in the text box. Add each scope on a new line:
     
     https://www.googleapis.com/auth/chat.spaces
     https://www.googleapis.com/auth/chat.memberships
     https://www.googleapis.com/auth/chat.messages
     https://www.googleapis.com/auth/admin.directory.user
     https://www.googleapis.com/auth/admin.directory.group 
     
     
   • Click Add to table.
     
   
   Method 2: 
   
   • Search for it by name in the search box.
   • Click the checkbox next to the scope to select it.
   • Clear the search bar and repeat the steps for the next scope.

5. Once you've selected all required scopes, click UPDATE.
6. Click Save.

Scope summary table

IV. Create OAuth 2.0 Client Credentials 

Client credentials are what your application uses to authenticate with Google. They consist of a Client ID and Client Secret.

A. Create OAuth Client ID

This is where you create the actual OAuth credentials that your application will use.
Instructions:

1. Login to Google Cloud and navigate to the project created.
   
2. Go to "APIs & Services" > "Credentials"
   
3. Click the blue "+Create credentials" button and from the dropdown menu, select "OAuth client ID"
   
   
   Note: If you get a message about creating an OAuth consent screen first, you need to go back to  OAuth 2.0 consent screen configuration and complete those steps first
4. Select your "Application type", as Web application
   
5. Enter a Name for your credentials (e.g., "My Web Application" or "Backup Service OAuth")
   
6. Configure Redirect URIs - The redirect URI is critical—it's where Google sends users back to your application after authorization. 
   
7. In the Authorized redirect URIs section, Click on 'Add URI' and enter your redirect URI exactly as shown below:
   Your Redirect URI:  https://api.syscloud.com/cloud-connectv3?cloud=googlechat
8. Click "CREATE" to save your credentials
   Important Note: Do not remove, modify, or alter the query parameter. The entire URL must be entered exactly as provided.

This is the most critical step. Your credentials are only shown once.

Instructions:

1. A popup will appear with your credentials
   
2. This is the ONLY time you'll see the Client Secret in full
3. Client ID: A long string like 123456789-abcdefghijklmnop.apps.googleusercontent.com
   • This is not sensitive and can be shared
   • This identifies your application to Google
4. Client Secret: A string like GOCSPX-abc123def456ghi789
   • This is HIGHLY SENSITIVE
   • Treat it like a password
   • NEVER share it
   • NEVER commit it to version control
   • NEVER expose it in client-side code
5. Download the JSON file: Click the download button to save a JSON file containing your credentials. This file looks like:
   
   {
   "client_id": "123456789-abcdefg.apps.googleusercontent.com",
   "client_secret": "GOCSPX-abc123def456ghi789",
   "redirect_uris": ["https://backup.mycompany.com/oauth/callback"],
   "auth_uri": "https://accounts.google.com/o/oauth2/auth",
   "token_uri": "https://oauth2.googleapis.com/token"
   }
6. Store securely: Save the Client Secret in your application's secure configuration system.

Once the setup is complete, continue to enter the credentials in SysCloud to connect and backup your Google Chat. Click here to know how to create a backup job with SysCloud.