MountainGoat · Email Sync

Gmail Email Sync: MountainGoat Configuration Guide

For Google Workspace administrators connecting a purchase-order mailbox to a MountainGoat instance.

This guide walks you through authorizing MountainGoat to read purchase-order email from one Gmail mailbox you choose. At a glance:

Read-only access. The only permission requested is gmail.readonly. MountainGoat cannot send, delete, or change any message, and it never sees a password.
You configure the integration in two places: the Google Cloud console (create an OAuth client) and the MountainGoat Admin UI (paste the credentials).
You hold the kill switch. Your admin can revoke the connection at any time from your own console, without involving MountainGoat.

1.Overview

MountainGoat finds purchase orders in a designated mailbox and turns them into structured, reviewable orders. To do that it needs read-only access to one Gmail mailbox, granted through Google's standard OAuth 2.0 consent flow.

Three steps share the work:

Your Google Workspace admin creates an OAuth client in your own Google Cloud console (sections 3 to 5).
A MountainGoat administrator enters the Client ID and Client Secret in the MountainGoat Admin UI (section 6).
The mailbox owner clicks Connect Gmail and approves Google's consent screen (section 7).

2.Prerequisites

Google Workspace administrator access, or an account permitted to create Google Cloud projects and OAuth clients in your organization.
Your MountainGoat subdomain. Each production MountainGoat instance is reachable at https://{app.subdomain}.mountaingoat.ai. Throughout this guide, {app.subdomain} is a placeholder for your subdomain label. Replace it everywhere it appears with your own label (for example acme, producing acme.mountaingoat.ai).
The purchase-order mailbox. The identity of the single Gmail mailbox MountainGoat will read.
A MountainGoat administrator account to enter the credentials in the MountainGoat Admin UI.

Time required: about 15 minutes.

3.Create the Google Cloud project

Go to https://console.cloud.google.com and sign in with your Workspace admin account.
Click the project picker in the top bar, then New project. Name it MountainGoat Integration and create it.
Select the new project.
Enable the Gmail API: left menu → APIs & Services → Library, search for "Gmail API", click Enable.

Go to APIs & Services → OAuth consent screen.
Choose User type Internal.
Set the app name to MountainGoat, add your support and developer email addresses, and Save.

Why Internal matters. The Internal user type keeps the app private to your organization and avoids Google's external-app verification review. Only accounts in your Workspace can ever grant it access.

5.Create the OAuth client

Go to APIs & Services → Credentials → Create credentials → OAuth client ID.
Application type: Web application. Name: MountainGoat.
Under Authorized redirect URIs, click Add URI and enter the value below, replacing {app.subdomain} with your subdomain label.
Click Create. A dialog shows the Client ID and Client secret. Copy both.

Authorized redirect URI https://{app.subdomain}.mountaingoat.ai/api/oauth/gmail/callback

The redirect URI must match character for character. A trailing slash or http:// instead of https:// will make the connection fail. Copy and paste it.

6.Enter the credentials in MountainGoat

Click Settings under the user profile.
Select the Admin tab → API & Credentials → Email Credentials → Gmail OAuth App Configuration.

MountainGoat field	What to enter
Client ID	The Client ID from the OAuth client you created in section 5.
Client Secret	The Client secret from the same OAuth client. Stored encrypted and never displayed back. See the note below.
Redirect URI	`https://{app.subdomain}.mountaingoat.ai/api/oauth/gmail/callback`. Must match the authorized redirect URI in Google exactly.
Scopes	`https://www.googleapis.com/auth/gmail.readonly`. This is the default; leave it as is.

About the Client Secret. The secret is write-only in the Admin UI: you can enter or replace it, but MountainGoat never displays it back and stores it encrypted. On a later edit, leave the Client Secret blank to keep the existing secret. Only type in the field when you intend to replace it.

On a managed instance, MountainGoat can enter the credentials for you. Send them through a password manager share, a one-time secret link, or read them over a phone call. Never put a client secret in the body of a normal email or chat message. If one ends up in an email thread, tell us and we will help you rotate it in minutes.

Click Save Gmail Config when you are done.

7.Connect the mailbox

The person who owns the purchase-order mailbox completes the one-time connection:

Sign in to MountainGoat and go to Settings → Admin → Setup → Inbox Connections.
Click Connect Gmail.
Sign in as the purchase-order mailbox account and approve Google's read-only consent screen.

MountainGoat stores an encrypted refresh token and begins read-only sync of that mailbox. Access is limited to the mailbox of the account that signs in here.

8.Troubleshooting

Symptom	Cause	Fix
Google shows `redirect_uri_mismatch`	The redirect URI in Google does not exactly match the one MountainGoat sends.	Compare both values character for character, including `https://` and no trailing slash, in Google and in the MountainGoat Redirect URI field.
Google shows an access-blocked or verification error	The consent screen user type is External.	Set the OAuth consent screen user type to Internal (section 4).
Consent screen never appears after clicking Connect Gmail	Client ID or Client Secret is missing or wrong in MountainGoat.	Re-check the Client ID and re-enter the Client Secret under Email Credentials, then save and retry.
Sync stops working later	The grant was revoked, or the mailbox account password or security state changed in a way that invalidated tokens.	Repeat section 7 to reconnect the mailbox.

9.Security and privacy notes

Read-only scope. MountainGoat requests only gmail.readonly. It cannot send, delete, or modify mail, and it never receives a password.
One mailbox. The delegated OAuth flow only ever reaches the mailbox of the account that signs in during section 7.
Secrets stay on the backend. The Client Secret field is write-only in the Admin UI. Credentials and tokens are stored encrypted and are never returned to a browser.
Instant revocation. Remove the grant from the mailbox account's Google security settings, or delete the OAuth client in the Google Cloud console. Access stops immediately.
Monitoring. Review the connection any time in the Google Workspace Admin console under third-party app access, and in the mailbox account's security settings.

10.Support

For help connecting Gmail to MountainGoat, contact:

help@mountaingoat.ai

See also the companion Outlook / Microsoft Entra setup guide and the Sign in with Okta configuration guide.