Guides
  1. AI CONNECTORS
  2. Google / Gemini

Google Gemini Connector

Before You Begin

This connector tracks Google Gemini adoption and usage across your workforce by reading audit logs from the Google Workspace Admin SDK. Section ingests per-user Gemini activity events (which apps, which features, how often) so you can see who is actually using Gemini in Gmail, Docs, Meet, Sheets, Slides, and other Workspace apps. Setup requires access to both Google Cloud Platform and the Google Workspace Admin Console, and is performed by the IT admin who manages your Workspace tenant.

Scope: This connector only captures Gemini activity when employees are signed in with their company Workspace account (e.g. [email protected]). Usage under personal Google accounts is not visible. It also only covers Gemini features embedded inside Workspace apps — standalone gemini.google.com chat sessions are not captured by the Admin SDK Reports API.

Note: Gemini in Workspace Apps logs are only available from 2025-06-20 onward, with a rolling 180-day history. Events from before that date cannot be backfilled.

What you'll need:

  • A Google Workspace Business or Enterprise plan with Gemini included (Gemini has been bundled into Business and Enterprise plans since 2025; legacy standalone Gemini add-ons purchased before January 2025 also qualify). To confirm your plan: go to admin.google.com → Billing → Subscriptions and verify a Gemini-enabled plan or add-on is listed. To confirm per-user licensing: Directory → Users → click a user → Licenses tab and check that a Gemini license is assigned. If no Gemini license is present, the Reports API will return no events.
  • A Google Workspace super-admin account (required to authorize domain-wide delegation)
  • Access to a Google Cloud project owned by or associated with the same Workspace organization
  • About 15 minutes to complete the steps in both consoles

Create a GCP Project and Enable Required APIs

Set up a Google Cloud project to host the service account and turn on the APIs the connector calls.

  1. Go to the Google Cloud Console.
  2. If you don't already have a project to use, click the project dropdown at the top → New Project. Name it something like section-connectors and click Create.
  3. Make sure the new project is selected in the top-of-page project dropdown.
  4. Open the Admin SDK API library page: https://console.cloud.google.com/apis/library/admin.googleapis.com and click Enable.
  5. Open the Google Drive API library page: https://console.cloud.google.com/apis/library/drive.googleapis.com and click Enable. Only needed for the Gems inventory feature.
  6. Wait a few seconds for both APIs to finish activating before continuing.

Note: If you later see an error like "Admin SDK API has not been used in project" or "Google Drive API has not been used in project" when the connector runs, confirm the relevant API is enabled in the same GCP project where the service account was created — the key embeds its project and the API must be enabled there.

Create a Service Account and Download Its JSON Key

Create a dedicated service account for Section and generate the JSON key file the connector will use to authenticate.

  1. In the same GCP project, go to https://console.cloud.google.com/iam-admin/serviceaccounts.
  2. Click Create service account.
  3. Fill in the form:
    • Service account name: gemini-connector
    • Description: Section AI Gemini connector — domain-wide delegation
  4. Click Create and continue.
  5. Skip the "Grant this service account access to project" step — no Cloud IAM roles are needed because permissions are granted in Google Workspace instead. Click Continue, then Done.
  6. From the service accounts list, click the gemini-connector account you just created.
  7. Note the Unique ID (a long numeric value, e.g. 123456789012345678901) shown in the account details — this is the same value as the client_id field in the JSON key you're about to download, and you'll need it in the next step to set up domain-wide delegation.
  8. Open the Keys tab → click Add key → Create new key.
  9. Select JSON and click Create. The browser automatically downloads a .json file — save it securely, as Google does not let you re-download it.

Value to copy: the downloaded .json file (e.g. gemini-connector-abc123.json) — upload it into the Service Account Key field.

Authorize Domain-Wide Delegation in the Workspace Admin Console

Grant the service account permission to read Gemini and Workspace usage data on behalf of users in your domain. This step must be done by a Workspace super-admin.

  1. Go to https://admin.google.com/ac/owl/domainwidedelegation.
  2. Click Add new.
  3. In the Client ID field, paste the Unique ID of the service account you noted in the previous step.
  4. In the OAuth scopes field, paste the following comma-separated list exactly: 
    https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.reports.usage.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly
  5. (Optional) To also enable the Gems inventory feature, add this scope to the same entry: 
    https://www.googleapis.com/auth/drive.metadata.readonly
  6. Click Authorize.

Note: Delegation usually takes effect within a few minutes but can take up to 24 hours. If you see unauthorized_client or access_denied immediately after authorizing, wait and retry — this is usually propagation lag, not a misconfiguration. If the error persists beyond 24 hours, return here and verify the Client ID and scopes match exactly.

Identify the Workspace Super-Admin Email

The connector impersonates a real super-admin user to call the Admin SDK. Find an active super-admin email in your Workspace tenant to use.

  1. Go to https://admin.google.com/ac/roles.
  2. Click the Super Admin role to open it.
  3. Open the Admins tab to see all users currently assigned the Super Admin role.
  4. Pick any active user — typically a real human admin such as [email protected]. Avoid generic mailing lists or accounts without a real user object.
  5. Copy that user's full email address.

Value to copy: [email protected] — the email of an active Workspace super-admin. Paste into the Admin Email field.

Note: The connector impersonates this account on every sync. If the account is suspended, deleted, or loses its super-admin role after setup, the connector syncs will fail with an authentication or authorization error. Use a stable, dedicated admin account rather than a personal one that could change.