Google Chat Connector Setup

Installing the Google Chat Connector

Note: For this step, your deployment engineer will be required.

The Google Chat connector depends on the same Google Workspace configuration section as the Gmail and Google Drive connectors, so ProjectID, ServiceUser, and ServiceAccountKey carry the same values described in the Google connector setup.

Prerequisites

Enable the Required APIs

The GCP project referenced by project-id must have these APIs enabled:

• Google Chat API (chat.googleapis.com)
• Google Workspace Events API (workspaceevents.googleapis.com)
• Cloud Pub/Sub API (pubsub.googleapis.com)

The Atolio Terraform module enables them for you. If the project is managed by hand, enable them from the API Library.

Grant the Chat Scopes

You will need a Service Account as described in Grant Service Account Permissions. In addition to the scopes listed there, the domain-wide delegation entry must carry the following scopes:

https://www.googleapis.com/auth/chat.spaces.readonly
https://www.googleapis.com/auth/chat.messages.readonly
https://www.googleapis.com/auth/chat.memberships.readonly

To add them, open the Google Admin console at https://admin.google.com/ac/owl/domainwidedelegation, edit the existing entry for the Atolio service account client ID, append the three scopes to the list already there, and authorize. Removing a scope that is already in the list will break the Gmail, Drive, or Sites sources.

Create the Pub/Sub Topic and Subscription

To support the indexing of Google Chat messages in real-time (streaming), a Pub/Sub topic is needed.

The Atolio Terraform module creates both, along with the two role bindings. If you are provisioning by hand, make sure to keep the name and bindings as listed above.

Streaming is the only part of the connector that needs Pub/Sub. If you set skip-streaming to true, the topic and subscription are not required, and the connector indexes only what it finds on each backfill.

Configuration

Source configuration can be applied in two ways:

Recommended (v4.24+): Use the Admin console to configure this source through the browser. You can paste the YAML configuration shown below directly into the Admin console.

Alternative: Use atolioctl via the command line (for Deployment Engineers). If using atolioctl, follow Configuring Sources first. The commands below also need an API token in JWT_TOKEN and the address of the feeder server’s gRPC endpoint.

Edit and Apply the Configuration

Source configuration is stored as a single document that covers every configured connector. The supported workflow is to export the current configuration, edit it, then import it back. Always start from a fresh export so you do not overwrite a change made elsewhere.

Export the current configuration to a local file:

atolioctl configure export --jwt-token-sdk ${JWT_TOKEN} --feeder-address :8889 lumen-connectors.yaml

Add a Google Chat entry alongside the Google sub-connectors already in the file, using the same values you provided for the Google source:

connectors:
  # ...existing connectors left in place...
  google:
    default:
      # ...existing Google sub-connectors left in place...
      gchat:
        connector: google              # Reference to parent connector, usually Google
        instance: default
        source: gchat
        common:
          enabled: true
          identity-provider: false     # This connector is a workspace tool, not IDP
        secrets:
          service_account_key:
            value: "<GOOGLE_SERVICE_ACCOUNT_B64>"
        configuration:
          parallelism: 0
          project-id: "<GOOGLE_PROJECT_ID>"
          service-user: "<GOOGLE_SERVICE_USER>"

Exported entries also carry a rendezvous-completed flag and a status block reporting each source’s current state and last validation result. Those fields are managed by Atolio. Leave them untouched on existing entries, and omit them when adding a new entry by hand as shown above.

Import the edited file to write the configuration back into the stack:

atolioctl configure import lumen-connectors.yaml --jwt-token-sdk ${JWT_TOKEN} --feeder-address :8889

Import writes the configuration into the stack after checking that the YAML is well formed. It does not contact Google. The connector validates the credentials and connection itself when it starts and picks up the configuration. If something is wrong, the source reports as misconfigured and the connector pod logs the error. See Troubleshooting for the specific messages.

Limiting the Backfill Window

By default, backfill reads messages created in the last five years. Narrow that with backfill-start-time, which is useful on a large Workspace where the first pass would otherwise run for a long time against Chat’s per-project read quota:

        configuration:
          backfill-start-time: "2026-01-01T00:00:00Z"

Both bounds are RFC 3339 timestamps. backfill-end-time is unbounded when unset, and is mostly useful for pinning a reproducible window.

Backfill resumes from where it left off. Each space records the point its messages were read up to, so an interrupted or repeated pass reads only what is new rather than starting over.

Discoverable Spaces and Target Audiences

A Google Chat space can be made discoverable to a target audience, which is a group of people your Workspace administrator defines. Anyone in that audience can find the space and read its messages without being a member, and Atolio has to reflect that in its permissions.

Set audiences to map each audience to the groups and users it grants access to, keyed by the audience resource name:

        configuration:
          audiences:
            audiences/00zu0gcz154hwnv:
              - engineering@example.com
              - all-contractors@example.com
              - jane.doe@example.com

To turn an audience id into the list of members, ask your Workspace administrator. Target audiences are managed in the Admin console under Directory > Target audiences, where each audience lists the groups and individuals it contains.

This section is only relevant if your organization uses discoverable spaces. Spaces restricted to their members need no audiences configuration.

Configuration Schema

In the exported file, every source lives at connectors.<connector>.<instance>.<source>, so the Google Chat source sits at connectors.google.default.gchat.

GoogleChatSourceConfiguration

Google Chat connector configuration.

Common

Common settings shared across all connectors.

Secrets

Sensitive configuration values for authentication.

SecretValue

A reference to a secret value.

GChatConfiguration

Google Chat-specific connector configuration.