ownAI Connectors — Setup

Gmail, Google Calendar, Google Drive, Outlook Mail, Outlook Calendar, and OneDrive. No separate MCP download — ownAI ships the tools. One OAuth app per provider; each product is a separate connector so the agent only sees the matching scopes and tools.

How Connectors work

Settings → Connectors stores one OAuth app (Client ID + secret) per provider, then you click Connect on each product. The browser login stays with Google / Microsoft; ownAI never asks for your account password. After Connect, the matching MCP stub is enabled and the agent can use those tools in chat (writes are confirm-gated).

Provider	One app in the cloud	Connect separately in ownAI
Google	One Desktop OAuth client (Client ID ends with `.apps.googleusercontent.com`)	Gmail, Google Calendar, Google Drive
Microsoft	One Entra app registration (Application/client ID is a GUID)	Outlook Mail, Outlook Calendar, OneDrive

What goes where?

What	Where	Note
Google Client ID + Secret	Connectors → Google OAuth app → Save Google app	Not a service-account JSON. ID ends with `.apps.googleusercontent.com`; secret often `GOCSPX-`.
Microsoft Application (client) ID + Secret	Connectors → Microsoft OAuth app → Save Microsoft app	ID is a GUID from Overview — not Directory (tenant) ID, not Object ID, not the secret. The secret looks like `WOe8Q~…` (tilde in the middle).
Google / Microsoft login	Select the connector → Connect → browser	Do not type your password into ownAI.
Access token	automatic	ownAI stores it encrypted after Connect. Connect each product once (incremental consent).

Quick start

Open ownAI → gear → Connectors.
Paste the provider app credentials → Save … app.
Select Gmail / Outlook Mail / … → Connect → finish in the browser.
When the tab says you can close it, return to ownAI. Status should be Connected.

Redirect URI used by ownAI (register this at Google only for Web clients; always for Microsoft):

http://127.0.0.1:8765/oauth/callback

Google (one app → Gmail + Calendar + Drive)

Create one Google Cloud OAuth Desktop client. Enable each API you need. In ownAI, save that client once, then Connect Gmail, Calendar, and Drive separately so each login grants the right scopes.

Create the Google OAuth app

Open Google Cloud Console and pick (or create) a project.
APIs & Services → Library — enable every API you will use:
- Gmail API
- Google Calendar API
- Google Drive API and Google Docs API (Drive connector)
OAuth consent screen (Google Auth Platform): User type External, app name e.g. ownAI, your support email. Publishing to “In production” is not required for personal use.
Under Test users add exactly the Google account you will sign in with.
Credentials → Create credentials → OAuth client ID → application type Desktop app → Create.
Copy Client ID and Client secret into ownAI → Save Google app. Desktop clients usually have no redirect-URI field; that is expected (see Redirect URI).

Gmail

Connectors → Gmail → Connect. Scopes: read, modify labels, send.

Tools: search, get message, send, drafts (including send draft), reply, labels, attachments, delete message (trash or permanent). Send / modify / delete are confirm-gated in Agent mode.

Google Calendar

Same Google app. Enable Google Calendar API, then Connect Google Calendar (browser login may run again).

Tools: list calendars, list events (with weekday labels), create / update / delete event, RSVP (accepted / declined / tentative), free/busy.

Google Drive / Docs

Same Google app. Enable Google Drive API and Google Docs API, then Connect Google Drive.

Read: search, list folder, recent, metadata, comments, read text, download into the workspace folder .ownai_downloads/ (default 15 MB, hard cap 20 MB; Google Docs/Sheets/Slides export as PDF). Write: create Doc, append text, upload text file, share link, delete / move / rename. If you connected earlier with read-only only: Disconnect → Connect again.

Microsoft 365 (one app → Outlook Mail + Calendar + OneDrive)

Create one Azure / Entra app registration. ownAI uses tenant /common (work Microsoft 365 and personal Outlook.com / Hotmail). Tokens stay per connector: Connect Outlook Mail, Outlook Calendar, and OneDrive one by one (incremental consent).

Find App registrations

The left menu often hides this. Fastest:

In portal.azure.com use the top search and type App registrations.
Or open App registrations (Azure) / Entra admin center.
Switch to All applications if the app is missing. Check the directory (tenant) in the top-right if you belong to more than one.

Create the Azure app

New registration. Name e.g. ownAI.
Supported account types: Accounts in any organizational directory and personal Microsoft accounts. A single-tenant (this org only) app cannot sign in personal Outlook.com accounts.
Authentication (or Authentication Preview) → Add a platform → Mobile and desktop applications → redirect URI exactly:
```
http://127.0.0.1:8765/oauth/callback
```
Implicit grant / hybrid flow: leave off. “Allow public client flows” may be Yes for this desktop loopback.
Certificates & secrets → New client secret. Copy the Value immediately (shown once). You can paste it in ownAI; for Mobile/desktop ownAI uses PKCE and will retry without the secret if Azure returns 401.
Overview — copy Application (client) ID (GUID) into ownAI’s Microsoft Application (client) ID field. Then Save Microsoft app.

Three GUIDs — only one belongs in ownAI

Overview field	Use
Application (client) ID	Yes — this is the app. Paste into ownAI.
Directory (tenant) ID	No — your Azure directory. ownAI uses `/common`.
Object ID	No.
Client secret value (`…~…`)	Secret field only — never the ID field. `AADSTS700016` means the secret was sent as the client ID.

API permissions (delegated Microsoft Graph)

App → API permissions → Add a permission.
Choose Microsoft Graph (not “My APIs”, not Exchange).
Delegated permissions — not Application.
Search by the short name (e.g. Calendars, then tick Calendars.ReadWrite). The English display name is often “Read and write user calendars”. Switch the Azure portal to English if the technical name is hidden.
Add permissions. Admin consent is only needed in some company tenants; personal accounts consent in the browser on Connect.

Connector	Delegated Graph permissions
All three	`User.Read`, `offline_access`
Outlook Mail	`Mail.ReadWrite`, `Mail.Send`
Outlook Calendar	`Calendars.ReadWrite` (search “Calendars”, not the full string)
OneDrive	`Files.ReadWrite`

Outlook Mail

Connectors → Outlook Mail → Connect. Graph: /me/messages, mail folders.

Tools: search, get message, send, drafts (including send draft), reply, list folders, move, get attachment, delete message (Deleted Items, or permanentDelete).

Outlook Calendar

Connectors → Outlook Calendar → Connect (second browser login is normal).

Tools: list calendars, list events (calendar view), create / update / delete, RSVP (accept / decline / tentative), free/busy (getSchedule).

OneDrive

Connectors → OneDrive → Connect. This is the user’s OneDrive, not SharePoint sites.

Tools: search, list folder, recent, metadata, read text, download into .ownai_downloads/ (default 15 MB, cap 20 MB), upload text (< 4 MB), create folder, share link, delete / move / rename. OneNote notebooks are not downloaded — the tool returns webUrl instead.

Redirect URI

ownAI always uses this loopback URL

http://127.0.0.1:8765/oauth/callback

Google Desktop app: the console often has no redirect field — that is normal. Only a Google Web application client requires you to type the URI.

Microsoft: add it under Authentication → Mobile and desktop. Do not use https, localhost, or a trailing slash — they will not match.

Errors

Google: 401 invalid_client / “OAuth client was not found”

Usually not a multi-hour wait.

The Client ID in the request does not exist or was copied wrong. API enablement delay is a different issue.

Credentials → open the OAuth client of type Desktop (not a service account).
Client ID must end with .apps.googleusercontent.com. No spaces or line breaks.
Copy the secret again (often GOCSPX-…).
ownAI: paste again → Save Google app → Connect.
Confirm the correct GCP project at the top of the Console.
Sign in with the Google account listed as a test user.

Google: 403 access_denied / “verification not completed”

Testing mode — your account is missing as a test user.

Cloud Console → OAuth consent screen (or Google Auth Platform → Audience).
Test users → add the address you sign in with → Save.
ownAI: Connect again.

Publishing to production is not required for private use and triggers Google verification.

Microsoft: AADSTS700016 — application not found

Wrong ID was sent as Application (client) ID.

If the identifier looks like WOe8Q~…, that is the secret, not the client ID. If it is the Directory (tenant) ID from Overview, that is also wrong. Use only Application (client) ID from Overview, then Save Microsoft app and Connect again.

Microsoft: browser OK (“close this window”) but ownAI shows HTTP 401

Login succeeded; token exchange was rejected.

Typical for Mobile/desktop apps when a client secret is sent. Current ownAI retries the token request with PKCE only. Restart ownAI, confirm the Application (client) ID is the GUID, Save Microsoft app, Connect again.

Checklist

Google: Gmail / Calendar / Drive / Docs APIs enabled; Desktop OAuth client; test user = your Google account; Save Google app; Connect each product
Microsoft: App registrations found; account type includes personal accounts; redirect URI exact; Application (client) ID is the GUID; Graph delegated permissions added; Connect each of Outlook Mail / Calendar / OneDrive
Agent mode examples: “Search my unread mail”, “What’s on my calendar tomorrow?”, “Find my roadmap in Drive / OneDrive”

See also the Connectors chapter in the user manual.