You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: guides/google-people/external.md
+7-6Lines changed: 7 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ setup_version: 1
4
4
5
5
# Set up Google People
6
6
7
-
You need a Google Cloud project and access to the [Google Cloud console](https://console.cloud.google.com). To enable the People API, you need `serviceusage.services.enable`, normally through **Service Usage Admin** or **Owner**. To grant project roles, you need **Project IAM Admin**. Before you begin, have the application or security owner configure prompt and response screening for malicious content or prompt injection; Model Armor is one option.
7
+
You need a Google Cloud project and access to the [Google Cloud console](https://console.cloud.google.com). To enable the People API, you need `serviceusage.services.enable`, normally through **Service Usage Admin** or **Owner**. To grant project roles, you need **Project IAM Admin**. Each connecting user must already have access to the intended Google profile, contacts, and directory data. Google documents that application developers are responsible for screening prompts and responses for malicious content or prompt injection; Model Armor is one documented option.
8
8
9
9
### Enable the People API {#enable-people-api}
10
10
@@ -38,10 +38,13 @@ Google does not allow an OAuth consent screen to be removed after it is configur
38
38
39
39
1. Open **Google Auth platform** > **Branding**.
40
40
2. If the page shows **Google Auth platform not configured yet**, click **Get Started**.
41
+
42
+
If Google Auth platform was already configured, retain its approved **Branding**. Retain its **Audience** only if it covers every intended connecting account. **Internal** qualifies only when all those accounts are in the Google Cloud organization associated with the project; otherwise use an approved **External** configuration. Then continue at step 14. Otherwise, complete the first-time wizard:
43
+
41
44
3. Under **App Information**, enter `People API MCP Server` in **App name**.
42
45
4. Select a monitored **User support email**.
43
46
5. Click **Next**.
44
-
6. Under **Audience**, select **Internal**. If **Internal**is unavailable, select **External**.
47
+
6. Under **Audience**, select **Internal** only if every intended connecting account is in the Google Cloud organization associated with the project. Otherwise, use an approved **External** configuration.
45
48
7. Click **Next**.
46
49
8. Under **Contact Information**, enter a monitored **Email address**.
47
50
9. Click **Next**.
@@ -50,8 +53,6 @@ Google does not allow an OAuth consent screen to be removed after it is configur
50
53
12. Click **Continue**.
51
54
13. Click **Create**.
52
55
53
-
If Google Auth platform was already configured, retain its approved **Branding** and **Audience**.
54
-
55
56
14. Open **Data Access**.
56
57
15. Click **Add or Remove Scopes**.
57
58
16. Under **Manually add scopes**, paste these three scope URLs:
@@ -66,7 +67,7 @@ If Google Auth platform was already configured, retain its approved **Branding**
66
67
18. Click **Update**.
67
68
19. Click **Save**.
68
69
69
-
If you selected **External** and the app is in **Testing**, add every connecting account:
70
+
An **External** app in **Testing** supports no more than 100 test users. Use this branch only when every intended connecting account fits within that ceiling:
70
71
71
72
20. Open **Audience**.
72
73
21. Under **Test users**, click **Add users**.
@@ -101,6 +102,6 @@ Prepare an approved secret store before the next step. The next dialog allows th
101
102
3. Keep both values for [connecting your credentials](speakeasy.md#connect-speakeasy-credentials).
102
103
4. Return to the Speakeasy AI Control Plane.
103
104
104
-
If you miss the one-time secret, delete it and create a new one before continuing.
105
+
If you miss the one-time secret, return to **Google Auth platform** > **Clients**. Delete the affected OAuth client using its visible or equivalent delete control. Repeat [Create the OAuth client](#create-oauth-client) and this credential-copy section before continuing.
105
106
106
107
<!-- screenshot-exception: do not capture a dialog containing a one-time secret -->
Copy file name to clipboardExpand all lines: guides/google-people/meta.yaml
+19-32Lines changed: 19 additions & 32 deletions
Original file line number
Diff line number
Diff line change
@@ -25,11 +25,10 @@ credential_setup:
25
25
description: A Google Cloud project where an administrator can enable the People API, grant project IAM roles, configure Google Auth platform, and create OAuth credentials
26
26
- id: connecting-user-access
27
27
description: Each connecting user has MCP Tool User on the project and access to the intended Google profile, contacts, and directory data
28
-
- id: prompt-injection-screening
29
-
description: An application or security owner has configured prompt and response screening for malicious content or prompt injection
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments