Skip to main content
Porcia uses a Google Workspace service account to scan your org’s mailboxes server-side. This gives you complete vendor discovery across the entire organization without any per-user setup.

​
Prerequisites

  • Google Workspace Super Admin account
  • Ability to create a service account in Google Cloud Console
  • 10–15 minutes for setup
This connects email scanning only. To also discover SSO-accessed apps and sync your directory, set up the SSO & Directory integration separately.

​
How it works

Porcia creates a service account in your Google Cloud project and grants it domain-wide delegation. The service account runs targeted search queries across employee mailboxes — looking only for vendor communication patterns. Raw email content is processed in memory and immediately discarded; only extracted metadata (vendor, pricing, dates) is retained.

​
Step-by-step setup

1

Go to Settings → Integrations → Email

In your Porcia workspace, navigate to Settings → Integrations → Email and click Connect Google Workspace.
2

Create a Google Cloud project (or use an existing one)

Go to console.cloud.google.com and create a new project (e.g. “Porcia Integration”) or select an existing one.
3

Enable the Gmail API

In your Cloud project, go to APIs & Services → Library, search for Gmail API, and click Enable.
4

Create a service account

Go to APIs & Services → Credentials → Create Credentials → Service Account.
  • Give it a name (e.g. “porcia-email-scanner”)
  • Click Create and Continue → skip optional role grants → click Done
5

Create and download a key

Click your new service account → Keys tab → Add Key → Create new key → JSON.Save the downloaded JSON file — you’ll upload it to Porcia in a moment.
6

Enable domain-wide delegation

In the service account settings, click Edit → expand Advanced settings → check Enable Google Workspace Domain-wide Delegation → Save.Note the Client ID shown — you’ll need it in the next step.
7

Authorize the service account in Google Admin Console

Go to admin.google.com → Security → Access and data control → API controls → Manage domain-wide delegation.Click Add new and enter:
  • Client ID: the Client ID from the previous step
  • OAuth scopes:
Click Authorize.
8

Upload credentials to Porcia

Back in Porcia (Settings → Integrations → Email), upload the JSON key file you downloaded and click Connect.Porcia validates the credentials and begins the initial scan immediately.

​
What gets scanned

  • All mailboxes in your Google Workspace org
  • Emails matching vendor communication patterns (invoices, renewals, signups, OAuth notifications)
  • Personal and non-vendor email is ignored entirely

​
Permissions

Porcia cannot send email, delete messages, modify labels, or access Google Drive, Calendar, or any other service.

​
Troubleshooting

The domain-wide delegation step was likely missed or the Client ID was entered incorrectly in the Admin Console. Double-check the Client ID matches exactly, and confirm the OAuth scope https://www.googleapis.com/auth/gmail.readonly was added without typos.
  • Wait 10–15 minutes — the initial scan takes time for large orgs
  • Confirm vendor emails exist in employee inboxes (invoices, renewals, etc.)
  • Check that the service account key JSON was uploaded correctly (not truncated or modified)
This setting lives in the service account detail page in Google Cloud Console under Advanced settings. Make sure you saved after checking the box, then re-copy the Client ID and re-add it in the Admin Console.

​
Disconnecting

  1. Go to Settings → Integrations → Email
  2. Click Disconnect next to Google Workspace
  3. Confirm
To fully revoke access, also delete the service account in Google Cloud Console and remove the domain-wide delegation entry from the Admin Console.

​
Next steps

Connect SSO & Directory

Discover SSO apps and sync your directory

Install Browser Extension

Track real usage across the org

Troubleshooting

Fix email sync issues