Live learner
Restoring…G
Back to Connectors
Connector setup

Real context, narrow permission.

Outgrow’s Google connectors are optional. When configured, they read only what a learner authorizes, store encrypted refresh credentials, and keep a sync audit.

Read-only AES-256-GCM at rest Disconnect and revoke
1

Create a Google web client

Enable the Google Drive API and Google Calendar API, configure the consent screen, then create an OAuth 2.0 client with the Web application type.

Open Google’s web-server guide
2

Add the exact redirect URI

Google requires the scheme, host, path, case, and trailing slash behavior to match exactly.

https://your-outgrow-domain.example/api/connectors/google/callback
3

Set server-only values

Generate the encryption key independently from the OAuth secret. Never prefix either value with NEXT_PUBLIC_.

GOOGLE_OAUTH_CLIENT_ID=…
GOOGLE_OAUTH_CLIENT_SECRET=…
CONNECTOR_ENCRYPTION_KEY=<32+ random characters>
DATABASE_URL=postgresql://…
NEXT_PUBLIC_APP_URL=https://your-outgrow-domain.example
4

Migrate and restart

Apply the database migrations, restart the web process, and return to Connectors. The cards will change from “Not configured” to “Ready to connect.”

pnpm db:migrate
Permission ledgerOutgrow requests one scope at the moment it becomes useful.
  • drive.readonlyList and read learner-authorized Drive context; no writes.
  • calendar.readonlyRead upcoming commitments for pacing; no event changes.

If credentials are absent, built-in sample connector data remains active and every core learning flow still works. The UI never pretends an external account is connected.