SAGE
Google OAuth verification

SAGE requests only the Google permissions needed for owner-reviewed shop workflows.

This packet summarizes the app identity, OAuth scopes, callback URLs, data handling, and reviewer demo script for SAGE by SIMCO LLC. IndieCo Marketing is the SAGE module/app label used for marketing workflows.

App identity

  • Public product: SAGE by SIMCO
  • Developer app/module label: IndieCo Marketing
  • Operator: SIMCO LLC, 4307 Oliver Ave N, Minneapolis, MN 55412
  • Support: hello@indieco.shop, (612) 440-2802
  • Authorized domain: indieco.shop

Production URLs

Existing Google clients (separate from Gmail)

  • https://www.googleapis.com/auth/business.manage: read and prepare owner-reviewed Google Business Profile updates for Business Profiles the shop owner owns, manages, or is authorized to manage.
  • https://www.googleapis.com/auth/calendar.readonly: read owner-authorized calendar context for event and reminder suggestions when Google Calendar is connected.
  • https://www.googleapis.com/auth/calendar.events: create owner-approved calendar events after the owner clicks a specific SAGE action.
  • openid email profile: separate Google sign-in only. This sign-in client does not grant Business Profile, Calendar, or Gmail access.

Separate Gmail scope-expansion client and project

Gmail Inbox Intelligence uses a dedicated Google Cloud project and OAuth client. Its consent screen requests exactly the following two scopes; it does not combine them with Business Profile, Calendar, or Google sign-in scopes.

  • https://www.googleapis.com/auth/gmail.readonly: read recent owner-authorized Gmail messages, relevant thread context, history changes, and attachment metadata needed for the visible SAGE Inbox task. Metadata-only Gmail access is insufficient because the customer question, order exception, invoice detail, or connected-service alert is normally contained in the message body.
  • https://www.googleapis.com/auth/gmail.send: send exactly one reply from the connected Gmail account after the owner or authorized manager reviews the visible From, To, subject, and final body and confirms that individual send. SAGE does not use this scope for campaigns, bulk sending, cold outreach, or automatic replies.

OAuth callback URLs

  • https://indieco.shop/api/marketing/oauth/google/callback
  • https://indieco.shop/api/marketing/oauth/google_calendar/callback
  • https://indieco.shop/api/marketing/oauth/google_email/callback
  • https://indieco.shop/api/account/google-callback

Limited Use commitments

  • Google API data is used only for user-facing SAGE features the connected shop owner can see.
  • Google API data is not sold, rented, shared with advertisers, or used for lead generation.
  • Google API data is not used to train generalized AI models.
  • Gmail data is not used for advertising, resale, lead generation, profiling, generalized-model training, or cross-shop sharing. Gmail access is used only for owner-visible SAGE Inbox and Task Queue workflows.
  • SAGE keeps editable drafts locally in SAGE and sends only after an explicit per-message owner confirmation. SAGE does not automatically or bulk-send email.
  • SAGE does not request Gmail draft-management or mailbox-management permission and cannot create Gmail-native drafts, label, mark read/unread, archive, trash, permanently delete, change filters, or change settings.
  • Gmail attachments are not bulk-downloaded. SAGE v1 stores attachment name/type/size metadata only; owner-open attachment retrieval is a later safety-reviewed feature.
  • Open/read Gmail-derived SAGE rows are retained for at most 90 days. After a row or related task becomes terminal (handled, replied, completed, canceled, or expired), the terminal row/task record, task events, and sent proof are retained for at most 30 additional days; encrypted backups then age out within 30 days.
  • SAGE/SIMCO personnel access is limited to owner-requested support, security investigation, legal compliance, or operations needed to run the authorized workflow.

Existing Business Profile review script

  1. Open https://indieco.shop/books or the provided reviewer login link.
  2. Create or open a reviewer test shop.
  3. Open the Connections area and choose Google Business Profile.
  4. Review the OAuth explanation and requested scope.
  5. Complete Google OAuth with a reviewer/test Google account that has access to a test Business Profile.
  6. Return to the SAGE dashboard and confirm the Google card shows connected state and source freshness.
  7. Open a generated Google task or suggestion. Confirm SAGE drafts the action first and requires owner approval before any public profile update, post, media action, or reply.
  8. Disconnect Google from the connection card and confirm SAGE stops new Google reads for that shop.

Separate Gmail scope-expansion reviewer script

  1. Open the provided reviewer test-shop login without placing a reusable SAGE session token in the visible URL, then choose Gmail Inbox Intelligence.
  2. Confirm the dedicated Gmail project/client consent screen requests exactly gmail.readonly and gmail.send, then return to SAGE.
  3. Send a customer stock question, a transactional vendor/order alert with an attachment, and a promotional newsletter to the reviewer mailbox.
  4. Show and narrate data flow A: inbound Gmail message → bounded SAGE excerpt and classification → a non-sendable internal Task Queue action. Confirm the transactional alert takes this path and the promotional newsletter is suppressed.
  5. Confirm SAGE shows attachment name/type/size metadata only; attachment content is not retrievable in Gmail v1.
  6. Open the customer task, review the relevant thread context and editable local SAGE draft, and confirm the actual From, To, and subject are visible.
  7. Show and narrate data flow B: inbound Gmail thread → SAGE Inbox/task → local draft → explicit owner confirmation → outbound Gmail reply. Edit the reply and confirm the individual send.
  8. Show Gmail returning a sent message receipt, the reply appearing inside the original Gmail thread, and the SAGE task completing only after that successful receipt.
  9. Send a follow-up into the same Gmail thread and confirm SAGE refreshes/reopens the same canonical task instead of creating a duplicate.
  10. Confirm there is no Gmail-native draft, bulk-send, label, read-state, archive, trash, delete, filter, or settings control in the Gmail v1 surface.
  11. Disconnect Gmail from the connection card and confirm SAGE removes that shop's token and stops new Gmail reads and sends. SAGE invokes remote Google revocation when the mailbox grant is not shared by another authorized SAGE shop.

Production readiness controls

  • Until Google verification is complete, SAGE blocks real-owner redirects and captures pilot-access requests inside the authenticated dashboard.
  • Production owner access is gated by SAGE_GOOGLE_OAUTH_PRODUCTION_APPROVED=true.
  • Calendar production owner access is separately gated by SAGE_GOOGLE_CALENDAR_OAUTH_PRODUCTION_APPROVED=true.
  • Gmail production owner access is separately gated by SAGE_GOOGLE_EMAIL_OAUTH_PRODUCTION_APPROVED=true, GOOGLE_EMAIL_RESTRICTED_SCOPE_APPROVED=true, and GOOGLE_EMAIL_SEND_SCOPE_APPROVED=true.
  • The Gmail OAuth client must remain in its own Google Cloud project because revoking a Google grant can affect every client in the same project.
  • Google Business Profile API access and quota are separately tracked by SAGE_GBP_API_ACCESS_APPROVED=true.
  • Gmail scopes https://www.googleapis.com/auth/gmail.compose, https://www.googleapis.com/auth/gmail.modify, https://www.googleapis.com/auth/gmail.settings.basic, and https://mail.google.com/ are not requested in v1. Gmail-native drafts, optional label/read/archive synchronization, and alias-setting management remain roadmap items that require implemented controls and a later scope review.