How to Enable API Access in Google Workspace for Custom Integrations

The Gateway to Third-Party Tools

In a default Google Workspace installation, the core API infrastructure is locked down to protect corporate data. However, if your IT department wants to deploy a third-party backup solution (like Spanning or Backupify), migrate emails using a migration tool (like BitTitan), or build custom Python scripts to automate user offboarding, those external services must be allowed to communicate with Google’s servers programmatically.

To facilitate this, you must explicitly enable API access globally across your domain. Without this setting enabled, any external application attempting to authenticate with your Workspace via OAuth or Service Accounts will be met with an immediate “API Access Disabled” error.

Step 1: Locate the Security Settings

1. Log into the Google Workspace Admin Console (admin.google.com) using your Super Administrator account.
2. In the left-hand navigation pane, click on Security > Access and data control > API controls.
3. This page manages exactly which third-party apps are allowed to read your data, but before you can configure individual apps, you must turn on the master switch.

Step 2: Enable the Master API Switch

1. On the API Controls page, scroll down to the bottom and look for the Domain wide delegation section.
2. Below that, you will find a link titled Manage Google Services (or depending on your exact Workspace tier, it might be located under Security > Settings > API Access).
3. Locate the checkbox labeled Enable API access.
4. Check the box and click Save at the bottom of the screen.

Step 3: What Does This Actually Do?

Checking this box does not mean that any random application on the internet can suddenly read your emails. It simply tells Google’s firewall to allow inbound API requests (REST/RPC) from authenticated tokens.

After enabling this, your organization can begin generating OAuth 2.0 Client IDs or using Google Cloud Platform (GCP) Service Accounts.

Security Warning: Domain-Wide Delegation

If you are setting up an enterprise-grade migration tool, simply enabling API access is only step one. Migration tools require Domain-Wide Delegation of Authority.

This is a terrifyingly powerful setting that allows a Service Account to impersonate any user in your organization without needing their password. If you need to enable this:

1. Return to the API controls page.
2. Click Manage Domain Wide Delegation.
3. Click Add New.
4. Paste the exact Client ID provided by your third-party vendor.
5. In the OAuth Scopes field, paste the exact, comma-separated list of Google API scopes the vendor requires (e.g., https://mail.google.com/, https://www.googleapis.com/auth/calendar).
6. Click Authorize.

Never grant Domain-Wide Delegation to an application unless you explicitly trust the vendor and understand exactly which scopes they are requesting.