Grok Bot blocked by Google Workspace admin consent
The Gmail or Calendar connector fails with an admin-approval or unverified-app error. How Workspace admins allow the connector safely and scope it to a Bot user.
Symptom
Connecting Gmail, Calendar or Drive fails with "Your admin has not approved this app", "This app is blocked", or an unverified-app warning that can't be bypassed.
Why it happens
Workspace admins can restrict which OAuth clients may access user data. Grok Bot's connector (or Composio's) is a third-party client that hasn't been allowed. This is a good control; the fix is to allow it narrowly, not to switch it off.
The fix
- Create a Google user for the Bot:
ops-bot@yourdomainor similar. Put Bot users in their own organisational unit. - Admin console → Security → API controls → App access control. Add the connector's OAuth client ID and mark it Trusted for the Bot OU only.
- Connect from the app signed in as the Bot user. Grant only the scopes the routine needs: read-only Gmail for triage, read/write Calendar for scheduling.
- Share specific mailboxes, calendars or Drive folders with the Bot user rather than making it a super-admin of anything.
Why a Bot user rather than your account
Because the token lands on the shared computer, where every Bot can use it. A Bot user with a shared inbox delegation can read what it needs; it cannot read your DMs with the board.
Verified 28 Aug 2026 · Facts about Grok Bot change during beta. See changelog.