> ## Documentation Index
> Fetch the complete documentation index at: https://cal.com/help/llms.txt
> Use this file to discover all available pages before exploring further.

# Delegation Credential — Google Workspace

> Connect Google Calendar for all organization members using a single service account.

Delegation Credential lets organization admins connect Google Calendar for every member at once, without each person needing to authorize individually. It uses a Google Cloud service account with domain-wide delegation to read availability and create events on behalf of your organization's users.

<Note>
  Only organization owners and admins can create and enable a Delegation Credential. The admin's email must belong to the Google Workspace domain being configured.
</Note>

***

## What you need

Before starting, make sure you have:

* **Organization admin access** in Cal.com
* **Google Cloud Console access** for your organization's Google Cloud project
* **Google Workspace Admin Console access** to authorize domain-wide delegation

***

## Step 1: Set up a Google Cloud project

If you already have a Google Cloud project with the Google Calendar API enabled, skip to Step 2.

<Steps>
  <Step title="Create a Google Cloud project">
    Go to the [Google Cloud Console](https://console.cloud.google.com/) and select **Create Project**. Give your project a name and click **Create**.
  </Step>

  <Step title="Enable the Google Calendar API">
    In the Google Cloud Console, go to **API & Services → Library**. Search for **Google Calendar API** and click **Enable**.
  </Step>
</Steps>

***

## Step 2: Create a service account

A service account acts on behalf of your organization's users to access their calendars.

<Steps>
  <Step title="Open the Service Accounts page">
    In the Google Cloud Console, go to **IAM & Admin → Service Accounts**.
  </Step>

  <Step title="Create a new service account">
    Click **Create Service Account**. Enter a name and description, then click **Create and Continue**. You can skip the optional steps.
  </Step>

  <Step title="Download the service account key">
    Select your newly created service account, go to the **Keys** tab, click **Add Key → Create new key**, select **JSON**, and download the file. Keep this file safe — you will paste its contents into Cal.com.
  </Step>
</Steps>

***

## Step 3: Create the Delegation Credential in Cal.com

<Steps>
  <Step title="Open Delegation Credential settings">
    In Cal.com, go to **Settings → Organization → Delegation Credential**.
  </Step>

  <Step title="Add a new credential">
    Click **Add delegation credential**.
  </Step>

  <Step title="Fill in the form">
    * **Domain**: Enter your Google Workspace domain (e.g. `acme.com` if your emails are `@acme.com`)
    * **Workspace Platform**: Select **Google Workspace**
    * **Service Account Key**: Paste the contents of the JSON key file you downloaded in Step 2
  </Step>

  <Step title="Create the credential">
    Click **Create**. The credential will be created but not yet enabled.
  </Step>
</Steps>

***

## Step 4: Copy the Client ID and scope

After creating the credential, the list view shows:

* **Client ID** — a numeric identifier (e.g. `123456789012345678901`)
* **Scope** — `https://www.googleapis.com/auth/calendar`

Copy both values using the copy buttons. You will need them in the next step.

***

## Step 5: Authorize in Google Workspace Admin Console

Use the Client ID and scope from Step 4 to authorize domain-wide delegation in your Google Workspace.

<Steps>
  <Step title="Open Google Admin Console">
    Go to [admin.google.com](https://admin.google.com) and sign in with your Google Workspace admin account.
  </Step>

  <Step title="Navigate to domain-wide delegation">
    Go to **Security → Access and Data Controls → API Controls → Manage Domain-Wide Delegation**.
  </Step>

  <Step title="Add the Client ID">
    Click **Add new** and paste the **Client ID** you copied from Cal.com.
  </Step>

  <Step title="Add the OAuth scope">
    In the **OAuth scopes** field, paste:

    ```
    https://www.googleapis.com/auth/calendar
    ```

    This grants full access to Google Calendar, which Cal.com uses to read availability and create/update events in members' calendars.
  </Step>

  <Step title="Authorize">
    Click **Authorize** to save.
  </Step>
</Steps>

***

## Step 6: Enable the Delegation Credential

<Steps>
  <Step title="Return to Cal.com">
    Go back to **Settings → Organization → Delegation Credential**.
  </Step>

  <Step title="Enable the credential">
    Toggle the credential to **Enabled**. Cal.com will verify that the Client ID has been authorized in your Google Workspace. If the verification succeeds, the credential becomes active.
  </Step>
</Steps>

<Warning>
  The admin enabling the credential must have an email address that belongs to the configured Google Workspace domain, and that email must be verified in Cal.com.
</Warning>

***

## What happens after enabling

Once the Delegation Credential is enabled:

* **Google Calendar is auto-connected** for all organization members whose email matches the configured domain — they do not need to connect it manually
* **Google Meet is available as a location** for booking events, even if members haven't completed [onboarding](/enterprise/members-onboarding)
* **New members** added to the organization automatically get Google Calendar connected
* Members **cannot disconnect** the delegation-managed Google Calendar credential (they can still connect additional calendars manually)

***

## Disabling the Delegation Credential

Disabling a Delegation Credential:

* Immediately stops auto-connecting calendars for members who haven't manually connected Google Calendar
* Preserves existing calendar preferences (selected calendars and destination calendar) for members who had them configured
* Background jobs will clean up delegation-specific credential records over time

***

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Do members need to do anything after the credential is enabled?">
    No. Google Calendar is automatically connected for all members whose email matches the domain. Members can optionally complete [onboarding](/enterprise/members-onboarding) to select which calendars to check for conflicts.
  </Accordion>

  <Accordion title="What if a member already connected Google Calendar manually?">
    The Delegation Credential takes priority for the matching domain. The member's manual connection is preserved but the delegation-managed credential is used for calendar operations.
  </Accordion>

  <Accordion title="What permissions does the service account get?">
    The service account only has access to the Google Calendar API scope (`https://www.googleapis.com/auth/calendar`). It can read availability and create/update calendar events for members in the configured domain.
  </Accordion>
</AccordionGroup>