Skip to main content

Documentation Index

Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt

Use this file to discover all available pages before exploring further.

Early access. This feature is in early access, which means it’s undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Contact the C1 Support team if you’d like to try it out or share feedback.
By default, C1 sends notifications from no-reply@conductorone.com. You can instead send from your own Google Workspace mailbox so recipients see your company’s domain as the sender. This task requires the Super Admin role in C1 and the Super Admin role in Google Workspace.

​
Before you begin

Configure SPF, DKIM, and DMARC for your sending domain by following Google’s recommended email authentication settings before proceeding.
You’ll need:
  • A Workspace super admin account.
  • A DNS domain you control (with the records above published).
  • Google Cloud Platform access in the same organization as your Workspace.

​
Step 1: Create a dedicated sender mailbox

The address that C1 sends mail as must be a real, licensed user in Google Workspace — not an alias, group, or forwarding address.
1
In admin.google.com, navigate to Directory > Users > Add new user.
2
Create a user with an address like governance@yourcompany.com or c1-notifications@yourcompany.com.
3
Assign a license with Gmail enabled.
4
Sign in as this user once (incognito window) to accept the ToS and complete first-login setup.
Gmail API calls fail for users who have never completed first login.
5
Optional. In Gmail, go to Settings > Accounts > Send mail as, edit the primary identity, and set Name to the display name you want recipients to see (for example, Governance Team). Gmail may override custom display names from the MIME header with this value.

​
Step 2: Create a GCP service account

C1 uses a GCP service account to call the Gmail API on behalf of your sender mailbox. Create the service account in the same GCP organization as your Workspace tenant.
1
Sign in to the Google Cloud console as a super admin.
2
Create a new project or select an existing one for the C1 email integration.
3
In the navigation menu, go to APIs & Services > Library.
4
Search for Gmail API and click Enable.
5
Navigate to APIs & Services > Credentials.
6
Click Create credentials > Service account.
7
Set a name (for example, C1 Email Sender) and click Create and continue. No project roles are required — click Continue, then Done.
8
In the service account list, click the service account you just created.
9
Open the Keys tab. Click Add key > Create new key, choose JSON format, and click Create. Save the downloaded JSON file securely — you’ll upload it to C1 in Step 4.
10
On the service account’s Details tab, copy the OAuth 2 Client ID (a numeric string like 108123456789012345678). You’ll need it for Step 3.
Do not confuse the OAuth 2 Client ID with the service account’s email address.

​
Step 3: Grant domain-wide delegation

Domain-wide delegation allows the service account to impersonate the sender mailbox when calling the Gmail API. You configure this in the Google Admin console, not in GCP.
1
In admin.google.com, navigate to Security > Access and data control > API controls.
2
In the Domain-wide delegation section, click Manage domain-wide delegation.
3
Click Add new.
4
In Client ID, paste the OAuth 2 Client ID from Step 2.
5
In OAuth scopes, enter:
https://www.googleapis.com/auth/gmail.send
6
Click Authorize.
This is a one-time, domain-wide grant. Adding new sender mailboxes later does not require repeating this step.

​
Step 4: Configure the email provider in C1

Enter the sender mailbox and service account credentials from the previous steps in C1 to activate the integration.
1
In C1, navigate to Settings > Email provider.
2
Click Edit.
3
Select Customer provided.
4
In Email service, select Google Workspace.
5
Fill in the fields:
  • Sender name: The display name recipients see (for example, Governance Team).
  • Sender email address: The mailbox you created in Step 1 (for example, governance@yourcompany.com).
  • Reply-to address: Usually the same as the sender address.
  • Delegated user email: Same as the sender address.
  • Service account JSON: Upload the JSON file downloaded in Step 2.
6
Click Save.
Sender and Delegated user must matchGmail only allows sending with a From: address that matches the authenticated user’s primary email or a verified “Send mail as” alias in that user’s Gmail settings. Use the same address for both Sender email address and Delegated user email. If they differ without a verified alias, Gmail will silently rewrite the From: header to the delegated user’s address.

​
Step 5: Verify

Send a test message to confirm C1 can send through your Workspace mailbox and that your email authentication records are passing.
1
On the Email provider page, click Send test.
2
Enter your own email address and click Send test.
3
Check your inbox. If the message arrives, view the raw headers (in Gmail: ⋮ → Show original) and confirm SPF: PASS, DKIM: PASS, DMARC: PASS.
4
If the message does not arrive, check the spam folder, mark it as Not spam, and re-test.
New sending domains typically take 24–72 hours and multiple engaged recipients before Gmail fully trusts them. Display names may not appear in the inbox UI until this trust is established, even though SPF, DKIM, and DMARC are all passing. This is expected behavior and resolves with normal use.