Shared mailbox for Helpdesk: Google Workspace

Connect a Google Workspace mailbox with a service account and domain-wide delegation.

Who can do thisWorkspace Administrator

If your mail runs on Google Workspace, the Hub reads the support mailbox through a Google Cloud service account. Mail sent to the mailbox becomes Helpdesk tickets, and replies on an existing thread are matched back to their ticket. The steps are the same as for Microsoft 365, except for the access section.

Note

The Integration Hub is in English only. Its buttons, fields and messages are quoted in English in these articles, in the Danish articles too, exactly as you see them in the app.

Before you start: the service account

Your Google Workspace administrator prepares the access:

Create a service account in Google Cloud.
In the Google Workspace Admin console, enable domain-wide delegation for the service account.
Authorise exactly one scope: https://www.googleapis.com/auth/gmail.readonly.
Create a key for the service account and download it as a JSON file.

Note

With domain-wide delegation, a service account can impersonate mailboxes across your whole Google Workspace domain. The form's info box The service account impersonates one mailbox explains the safeguard: this connection reads only the mailbox you name, and by authorising only the gmail.readonly scope, the delegation cannot be used more broadly. Only your Google Workspace administrator can grant the delegation.

Connect the mailbox

Open Marketplace, find the Shared mailbox card and click Add. The sheet New shared mailbox connection opens.
Under Basics, enter a Name, such as "Support inbox", and set Provider to Google Workspace.
Under Mailbox, enter the Mailbox to impersonate (subject), for example support@your-company.example. This is the one mailbox the service account acts as.
Under Google Workspace access, paste the contents of the key file into Service account key (JSON), or use the file button underneath to upload the .json file.
Under Schedule & status, keep Trigger on On a schedule, choose a Frequency (it starts on Hourly) and switch Enabled on.
Under How far back each run reads, leave Lookback window (minutes) blank for 24 hours, or enter 15 to 43200.
Click Save. The mailbox appears on Connections.

New shared mailbox connection

Mail sent here becomes Helpdesk tickets. Replies on an existing thread are matched back to their ticket rather than opening a new one.

Basics

NameSupport inbox

ProviderGoogle Workspace

Mailbox

Mailbox to impersonate (subject)support@your-company.example

Google Workspace access

Service account key (JSON){ "type": "service_account", "project_id": "yc-helpdesk", … }

Choose file yc-helpdesk-key.json

Enable domain-wide delegation for the service account and authorize the scope https://www.googleapis.com/auth/gmail.readonly.

The service account impersonates one mailbox

Authorize only the gmail.readonly scope.

Schedule & status

TriggerOn a schedule

FrequencyHourly

Enabled

How far back each run reads

Lookback window (minutes)1440Every run re-reads the last 24 hours of mail and skips anything already turned into a ticket. Leave blank for the default of 24 hours.

This window is also your outage budget

If collection stops for longer than the window, mail that falls outside it is never picked up.

CancelSave

PictureThe Google Workspace version: a service account key instead of an app registration.

The key is stored in Juvaro's secret vault and never shown again. When you edit the connection later, the form says "Key set - paste or upload a new one to rotate." Leave the field empty to keep the saved key.

After saving

There is no Test connection for mail. Send a test mail, click Run now on the row and open Runs to see the result.
The mailbox is never auto-paused, so add an alert rule to hear about failures. See Alert rules and Needs attention.
On the Credentials page the key shows as "Service account - Google". Record an expiry date there if your organisation rotates keys on a schedule. See Credentials: expiry dates and rotation.
For the schedule and the lookback window, see How often a mailbox is checked. For what Helpdesk does with the mail, see Mail through the Integration Hub.

If saving fails

Message	What to do
"give the connection a name"	Enter a name under Basics.
"enter the mailbox to impersonate (subject)"	Enter the mailbox's email address.
"paste or upload the service-account key"	A new connection, or a switch from another provider, always needs the key.
"the lookback window must be between 15 and 43200 minutes"	Enter a number in that range, or leave the field blank.