Workspace Delegation connects Google Calendar across your whole organization at once, authorized by a single Workspace admin, rather than requiring each person to log in individually. Use this method when you need to sync many users' calendars.
How it works
Domain-wide delegation lets a service account act on behalf of each authorized user, with no interactive login required. A Workspace super-admin authorizes the service account once, in the Google Admin console, with a specific set of scopes. Databook then connects on behalf of each user individually: every user you want to sync gets its own connection, all using the same authorized service account.
What Databook can see
Because the connection acts as the user it's syncing, it sees exactly what that user sees in their own calendar, both public and private events. This is different from OAuth, where private events on shared calendars stay hidden.
How we protect your privacy
Since Workspace Delegation captures private events by design, filtering happens after the data reaches Databook rather than at the connection itself:
Private events are captured on ingestion but filtered out before they're used anywhere else in the product.
Cancelled events are removed the same way.
See Google Calendar integration for the full privacy approach shared across both connection methods.
Setting it up
In Google Cloud, select or create a project and enable the Google Calendar API.
Create a service account and note its numeric client ID.
Create a JSON key for the service account, download it, and base64-encode it. Store it securely: whoever holds it can access any authorized user's calendar once delegation is granted.
In the Google Admin console, go to Security, then Access and data control, then API controls, then Manage Domain Wide Delegation, and add the service account's client ID with the exact scopes you need. For calendar access, use https://www.googleapis.com/auth/calendar, or the read-only variant.
Share the base64-encoded key, the list of user emails to sync, and the authorized scopes with your Databook account team, who will set up a connection for each user.
The scopes you provide when a connection is created must be a subset of what's authorized in the Admin console, and each user's email must belong to an active user in the domain (not suspended or deleted).
Changes to domain-wide delegation can take up to 24 hours to propagate, though most apply within a few minutes. If access doesn't work immediately after setup, wait and retry before troubleshooting further.
Troubleshooting
Symptom | Likely cause |
unauthorized_client error | The scopes requested for a connection don't match what was authorized for the service account in the Admin console. |
invalid_grant error | The user's email isn't an active user in the domain (it may be suspended, deleted, or mistyped). |
Access doesn't work right after setup | Domain-wide delegation changes can take up to 24 hours to propagate. Wait and retry before assuming something is misconfigured. |
A note on historical data
Backfill of past calendar events is capped at 28 days by the underlying Google API. Earlier history isn't available, so plan your sync timing with that limit in mind.
When to use Workspace Delegation
You need to sync many users' calendars across an organization, beyond what OAuth can handle cleanly.
A Workspace super-admin is available to authorize delegation and manage scopes centrally.
You need complete calendar coverage, and you're comfortable with privacy being enforced downstream through Databook's filtering rather than at the connection itself.
Getting access
To set up the Workspace Delegation connection, contact your account team.