docs(agentkit): add Google Workspace (DWD) connector docs

.coderabbit.yaml

@@ -125,8 +125,10 @@ reviews:
         - No raw HTML `<div>` blocks unless absolutely necessary and justified
           by a code comment.
         - If `<Steps>` is used, verify it compiles to one ordered list: each
-          numbered step starts at column 0 as `1. ## ...`, and content nested
-          under a step uses exactly 3 spaces of indentation.
+          numbered step starts at column 0 as `1. ## ...` or `1. ### ...`
+          (H2 when steps should appear in the table of contents, H3 when
+          visual weight should stay low), and content nested under a step
+          uses exactly 3 spaces of indentation.
         - When `<Tabs>` appears inside a step, verify the whole tabs block stays
           inside that list item with consistent 3-space indentation for `<Tabs>`,
           `<TabItem>`, prose, and fenced code blocks. Flag mixed indentation that
@@ -178,8 +180,10 @@ reviews:
           not call it broken MDX or demand that Steps wrap all procedural
           content.
         - If `<Steps>` is used, verify it still compiles to one ordered list:
-          each numbered step starts at column 0 as `1. ## ...`, and any content
-          nested under a step uses exactly 3 spaces of indentation.
+          each numbered step starts at column 0 as `1. ## ...` or
+          `1. ### ...` (H2 for TOC visibility, H3 for lower visual weight),
+          and any content nested under a step uses exactly 3 spaces of
+          indentation.
         - When `<Tabs>` appears inside a step, verify the entire tabs block stays
           inside that list item: `<Tabs>`, `<TabItem>`, prose, and fenced code
           blocks should all remain indented under the step. Flag mixed

src/components/templates/agent-connectors/_section-after-authentication-googledwd-auth.mdx

@@ -0,0 +1,3 @@
+export const sectionTitle = 'Authentication'
+
+This connector uses **Service Account with Domain-Wide Delegation (DWD)**. You create a GCP service account, grant it domain-wide delegation in Google Admin, and provide Scalekit with the service account JSON key. Scalekit then impersonates any user in your Google Workspace domain on demand — no per-user OAuth redirects required.

src/components/templates/agent-connectors/_section-after-setup-googledwd-common-workflows.mdx

@@ -0,0 +1,60 @@
+export const sectionTitle = 'Common workflows'
+
+import { Tabs, TabItem, Aside } from '@astrojs/starlight/components'
+
+<details>
+<summary>Create a connected account</summary>
+
+Before executing tools, create a connected account for each Google Workspace user you want to impersonate. Pass the user's email as `subject` — this tells Scalekit which Workspace user the service account should act as. The `identifier` is your application's ID for that user.
+
+<Aside type="note" title="Admin authorization required">
+  The Google Workspace admin must whitelist your service account Client ID and scopes before this call will succeed. See the **Create a connected account** steps above.
+</Aside>
+
+<Tabs syncKey="tech-stack">
+  <TabItem label="Python">
+    ```python
+    response = scalekit_client.actions.create_connected_account(
+        # connection_name: the name of the connection you created in the setup step above
+        connection_name='googledwd',
+        identifier='user_123',
+        authorization_details={
+            "google_dwd": {
+                # subject: the Google Workspace user you want to impersonate
+                "subject": "alice@yourcompany.com",
+            }
+        },
+    )
+    print(response.connected_account.id)
+    print(response.connected_account.status)
+    ```
+  </TabItem>
+</Tabs>
+
+</details>
+
+<details>
+<summary>Execute a tool</summary>
+
+Use the `identifier` you set when creating the connected account. Scalekit resolves the impersonated Workspace user from that mapping.
+
+<Tabs syncKey="tech-stack">
+  <TabItem label="Python">
+    ```python
+    response = scalekit_client.actions.execute_tool(
+        # connection_name: the name of the connection you created in the setup step above
+        connection_name='googledwd',
+        identifier='user_123',
+        tool_name='googledwd_fetch_mails',
+        tool_input={
+            "max_results": 5,
+            "format": "metadata",
+            "include_spam_trash": False,
+        },
+    )
+    print(response)
+    ```
+  </TabItem>
+</Tabs>
+
+</details>

src/components/templates/agent-connectors/_section-after-setup-googledwd-connected-account.mdx

@@ -0,0 +1,29 @@
+export const sectionTitle = 'Create a connected account'
+
+import { Tabs, TabItem, Aside } from '@astrojs/starlight/components'
+
+Before executing tools, create a connected account for each Google Workspace user you want to impersonate. Pass the user's email as `subject` — this tells Scalekit which Workspace user the service account should act as. The `identifier` is your application's ID for that user.
+
+<Aside type="note" title="Admin authorization required">
+  The Google Workspace admin must whitelist your service account Client ID and scopes before this call will succeed. See the **Set up the connector** steps above.
+</Aside>
+
+<Tabs syncKey="tech-stack">
+  <TabItem label="Python">
+    ```python
+    response = scalekit_client.actions.create_connected_account(
+        # connection_name: the name of the connection you created in the setup step above
+        connection_name='googledwd',
+        identifier='user_123',
+        authorization_details={
+            "google_dwd": {
+                # subject: the Google Workspace user you want to impersonate
+                "subject": "alice@yourcompany.com",
+            }
+        },
+    )
+    print(response.connected_account.id)
+    print(response.connected_account.status)
+    ```
+  </TabItem>
+</Tabs>

src/components/templates/agent-connectors/_section-before-tool-list-googledwd-common-workflows.mdx

@@ -0,0 +1,29 @@
+export const sectionTitle = 'Common workflows'
+
+import { Tabs, TabItem } from '@astrojs/starlight/components'
+
+<details>
+<summary>Execute a tool</summary>
+
+Use the `identifier` you set when creating the connected account. Scalekit resolves the impersonated Workspace user from that mapping.
+
+<Tabs syncKey="tech-stack">
+  <TabItem label="Python">
+    ```python
+    response = scalekit_client.actions.execute_tool(
+        # connection_name: the name of the connection you created in the setup step above
+        connection_name='googledwd',
+        identifier='user_123',
+        tool_name='googledwd_fetch_mails',
+        tool_input={
+            "max_results": 5,
+            "format": "metadata",
+            "include_spam_trash": False,
+        },
+    )
+    print(response)
+    ```
+  </TabItem>
+</Tabs>
+
+</details>

src/components/templates/agent-connectors/_setup-googledwd.mdx

@@ -0,0 +1,58 @@
+import { Steps, Aside } from '@astrojs/starlight/components'
+
+Register your Scalekit environment with the Google Workspace (DWD) connector so Scalekit can act on behalf of any user in your Google Workspace domain. Unlike OAuth connectors, DWD uses a service account — no per-user login flows are required.
+
+<Steps>
+1. ### Create a connection in Scalekit
+
+   - In [Scalekit dashboard](https://app.scalekit.com), go to **AgentKit** > **Connections** > **Create Connection**. Find **Google Workspace (DWD)** and click **Create**.
+   - Under **Scopes**, add each Google API scope your agent needs. Enter the full scope URI, for example:
+      - `https://www.googleapis.com/auth/gmail.readonly`
+      - `https://www.googleapis.com/auth/calendar`
+      - `https://www.googleapis.com/auth/drive`
+
+      See the [Google OAuth 2.0 Scopes reference](https://developers.google.com/identity/protocols/oauth2/scopes) for the full list.
+
+2. ### Create a GCP service account
+
+   - Go to [Google Cloud Console](https://console.cloud.google.com) → **IAM & Admin** → **Service Accounts**.
+   - Click **+ Create Service Account**, enter a name and description, and click **Create and Continue**.
+   - Skip the optional role and user access steps and click **Done**.
+
+3. ### Download the service account JSON key
+
+   - In [Google Cloud Console](https://console.cloud.google.com), go to **IAM & Admin** → **Service Accounts** and click your service account.
+   - Go to the **Keys** tab → **Add Key** → **Create new key**.
+   - Select **JSON** and click **Create**. The key file downloads automatically.
+
+4. ### Add the service account JSON in Scalekit
+
+   - In [Scalekit dashboard](https://app.scalekit.com), go to **AgentKit** > **Connections** and open the connection you created in step 1.
+   - Paste the full contents of the downloaded JSON key file into the **Service Account JSON** field. Treat this JSON key as a secret credential — restrict access to the connection settings and rotate or revoke the key immediately if it is exposed.
+   - Click **Save**.
+</Steps>
+
+### Authorize the service account in Google Admin
+
+The admin of the Google Workspace organization you want to connect to must complete these steps to authorize your service account.
+
+<Aside type="caution" title="Requires Google Workspace super admin access">
+  These steps must be completed by a super admin of the target Google Workspace organization — not in your GCP account.
+</Aside>
+
+<Steps>
+1. ### Open API controls in Google Admin
+
+   - Sign in to [Google Admin console](https://admin.google.com) as a super admin.
+   - Go to **Security** → **Access and data control** → **API controls**.
+   - Click **Manage Domain Wide Delegation** → **Add new**.
+
+2. ### Authorize the service account
+
+   - In **Client ID**, enter the **Unique ID** of the service account created during setup (visible in GCP Console → **IAM & Admin** → **Service Accounts** → click the service account → **Details** tab).
+   - In **OAuth scopes**, enter the scopes comma-separated — these must match exactly what was configured in the Scalekit connection. For example:
+      - `https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/calendar, https://www.googleapis.com/auth/drive`
+   - Click **Authorize**.
+</Steps>
+
+You can now impersonate any user in that workspace with your service account via Scalekit connected accounts.

src/components/templates/agent-connectors/index.ts

@@ -31,6 +31,7 @@ export { default as SetupGoogleFormsSection } from './_setup-google-forms.mdx'
 export { default as SetupGoogleMeetsSection } from './_setup-google-meets.mdx'
 export { default as SetupGoogleSheetsSection } from './_setup-google-sheets.mdx'
 export { default as SetupGooglecalendarSection } from './_setup-googlecalendar.mdx'
+export { default as SetupGoogledwdSection } from './_setup-googledwd.mdx'
 export { default as SetupGoogleslidesSection } from './_setup-googleslides.mdx'
 export { default as SetupHarvestapiSection } from './_setup-harvestapi.mdx'
 export { default as SetupHeyreachSection } from './_setup-heyreach.mdx'
@@ -68,6 +69,7 @@ export { default as SetupYoutubeSection } from './_setup-youtube.mdx'
 export { default as SetupZendeskSection } from './_setup-zendesk.mdx'
 export { default as SetupZoomSection } from './_setup-zoom.mdx'
 export { default as ConnectedAccountBigqueryserviceaccountSection } from './_connected-account-bigqueryserviceaccount.mdx'
+export { default as SectionAfterAuthenticationGoogledwdAuth } from './_section-after-authentication-googledwd-auth.mdx'
 export { default as SectionAfterSetupAirtableCommonWorkflows } from './_section-after-setup-airtable-common-workflows.mdx'
 export { default as SectionAfterSetupApifymcpCommonWorkflows } from './_section-after-setup-apifymcp-common-workflows.mdx'
 export { default as SectionAfterSetupApolloCommonWorkflows } from './_section-after-setup-apollo-common-workflows.mdx'
@@ -101,6 +103,8 @@ export { default as SectionAfterSetupGoogleAdsCommonWorkflows } from './_section
 export { default as SectionAfterSetupGooglecalendarCommonWorkflows } from './_section-after-setup-googlecalendar-common-workflows.mdx'
 export { default as SectionAfterSetupGoogledocsCommonWorkflows } from './_section-after-setup-googledocs-common-workflows.mdx'
 export { default as SectionAfterSetupGoogledriveCommonWorkflows } from './_section-after-setup-googledrive-common-workflows.mdx'
+export { default as SectionAfterSetupGoogledwdConnectedAccount } from './_section-after-setup-googledwd-connected-account.mdx'
+export { default as SectionBeforeToolListGoogledwdCommonWorkflows } from './_section-before-tool-list-googledwd-common-workflows.mdx'
 export { default as SectionAfterSetupGoogleformsCommonWorkflows } from './_section-after-setup-googleforms-common-workflows.mdx'
 export { default as SectionAfterSetupGooglemeetCommonWorkflows } from './_section-after-setup-googlemeet-common-workflows.mdx'
 export { default as SectionAfterSetupGooglesheetsCommonWorkflows } from './_section-after-setup-googlesheets-common-workflows.mdx'

src/content/docs/agentkit/connectors/googledwd.mdx

@@ -0,0 +1,90 @@
+---
+title: 'Google Workspace (DWD) connector'
+tableOfContents: true
+description: 'Set up Google Workspace Domain-Wide Delegation to let your agent impersonate users through a service account — no per-user OAuth required.'
+sidebar:
+  label: 'Google Workspace (DWD)'
+connectorIcon: https://cdn.scalekit.com/sk-connect/assets/provider-icons/google.svg
+connectorAuthType: Service Account (DWD)
+connectorCategories: [productivity, communication]
+head:
+  - tag: style
+    content: |
+      .sl-markdown-content h2 {
+        font-size: var(--sl-text-xl);
+      }
+---
+
+import ToolList from '@/components/ToolList.astro'
+import { tools } from '@/data/agent-connectors/googledwd'
+import { Steps, Tabs, TabItem } from '@astrojs/starlight/components'
+import { AgentKitCredentials } from '@components/templates'
+import { SetupGoogledwdSection } from '@components/templates'
+import { SectionAfterAuthenticationGoogledwdAuth } from '@components/templates'
+import { SectionAfterSetupGoogledwdConnectedAccount } from '@components/templates'
+import { SectionBeforeToolListGoogledwdCommonWorkflows } from '@components/templates'
+
+<Steps>
+
+1. ### Install the SDK
+
+   <Tabs syncKey="tech-stack">
+     <TabItem label="Node.js">
+       ```bash frame="terminal"
+       npm install @scalekit-sdk/node
+       ```
+     </TabItem>
+     <TabItem label="Python">
+       ```bash frame="terminal"
+       pip install scalekit
+       ```
+     </TabItem>
+   </Tabs>
+
+   Full SDK reference: [Node.js](/agentkit/sdks/node/) | [Python](/agentkit/sdks/python/)
+
+2. ### Set your credentials
+
+   <AgentKitCredentials />
+
+3. ### Set up the connector
+
+   Register your Google Workspace credentials with Scalekit so it can authenticate requests on your behalf. You do this once per environment.
+
+   <details>
+   <summary>Dashboard setup steps</summary>
+
+   <SetupGoogledwdSection />
+
+   </details>
+
+</Steps>
+
+## What you can do
+
+Connect this agent connector to let your agent:
+
+- **Read and search emails** — Fetch messages, threads, and attachments from any Gmail label or inbox
+- **Send and manage emails** — Compose messages, manage drafts, and modify labels on Gmail messages
+- **Manage Google Drive files** — Share, move, copy, and query activity on files and folders in Google Drive
+- **Access Google Calendar** — Read, create, and manage calendar events across a user's calendars
+- **Manage Google Vault** — List matters and manage legal holds in Google Vault
+- **Administer user settings** — Update vacation auto-reply settings and other Gmail account configurations
+
+## Authentication
+
+<SectionAfterAuthenticationGoogledwdAuth />
+
+## Create a connected account
+
+<SectionAfterSetupGoogledwdConnectedAccount />
+
+## Common workflows
+
+<SectionBeforeToolListGoogledwdCommonWorkflows />
+
+## Tool list
+
+Use the exact tool names from the **Tool list** below when you call `execute_tool`. If you're not sure which name to use, list the tools available for the current user first.
+
+<ToolList tools={tools} />

src/data/agent-connectors/capabilities.json

@@ -75,6 +75,14 @@
     "**Post updates** \u2014 add, edit, and delete comments and activity updates on items",
     "**Manage structure** \u2014 create and delete columns, manage subitems, webhooks, workspaces, teams, and tags"
   ],
+  "googledwd": [
+    "**Read and search emails** — fetch messages, threads, and attachments from any Gmail label or inbox",
+    "**Send and manage emails** — compose messages, manage drafts, and modify labels on Gmail messages",
+    "**Manage Google Drive files** — share, move, copy, and query activity on files and folders in Google Drive",
+    "**Access Google Calendar** — read, create, and manage calendar events across a user's calendars",
+    "**Manage Google Vault** — list matters and manage legal holds in Google Vault",
+    "**Administer user settings** — update vacation auto-reply settings and other Gmail account configurations"
+  ],
   "clickup": [
     "**Manage tasks** \u2014 create, update, delete, and search tasks; set priorities, due dates, assignees, and statuses",
     "**Manage lists** \u2014 create, update, and delete lists in folders or as folderless lists; get members",