Description

n8n-nodes-google-workspace-sa

An n8n community node that calls Gmail and the Admin SDK Directory API as any
user in your Google Workspace domain, using a **service account with domain-wide
delegation**. It mints a fresh impersonation token on every call, so a single credential
can act across your whole org.

Why this node

n8n’s built-in Google credential impersonates one fixed user. That’s fine for a
personal mailbox, but it can’t sweep a domain — you can’t list every mailbox and read each
one in a single workflow. This node signs a service-account JWT (RS256) and exchanges it
for a token scoped to whichever user each operation targets, so you can iterate over every
mailbox from one credential. The service-account key lives only in an encrypted n8n
credential and never appears in a workflow.

Credential

Google Workspace Service Account API — two fields:

• Service Account JSON Key — the full JSON key file from Google Cloud (stored encrypted).
• Admin Email — a super-admin to impersonate for Directory calls.

Use the credential’s Test button to confirm the key + delegation are working before you
build anything.

Operations

| Resource | Operation | Notes |
|———-|———–|——-|
| User | List | All users in the domain (paginated). Impersonates the admin. |
| User | Get | A single user by email/ID. |
| Message | List | Messages in a given Mailbox Email, with a Gmail search query. |
| Message | Get | A single message (full / metadata / minimal / raw). |
| Message | Get History | Incremental changes since a startHistoryId. |
| Custom API Call | Make an API Call | Any Google API URL as any impersonated user, with your own scope, method, query and body. |

Every Gmail operation takes a Mailbox Email to impersonate; Custom API Call takes an
Impersonate Email + Scope so you can reach Drive, Calendar, or any other Workspace
API the delegation is authorised for.

Setup

1. In Google Cloud, create a service account and a JSON key; enable the Gmail API
and Admin SDK API.
2. In the Google Admin console → Security → API controls → Domain-wide delegation,
authorise the service account’s client ID with the scopes you need, e.g.:
– https://www.googleapis.com/auth/gmail.readonly
– https://www.googleapis.com/auth/admin.directory.user.readonly
3. In n8n, create a Google Workspace Service Account API credential (paste the JSON key
+ a super-admin email) and click Test.
4. Add the Google Workspace (Service Account) node and pick a resource + operation.

Install

Community nodes: Settings → Community nodes → Install → n8n-nodes-google-workspace-sa.

Build (from source)

npm install
npm run build     # tsc → dist/, copies icons
npm run lint      # n8n community-node linter

Compatibility

Read/write depends entirely on the scopes you authorise in domain-wide delegation. The
built-in operations use read-only scopes; grant broader scopes for write access via the
Custom API Call operation.

Built by Cyberneticsplus. MIT.