Connecting Gmail

Closr drafts emails for you, sends them through your Gmail (not a generic address), and parses inbound replies into the right contact thread. To do that, you connect your Gmail through Google's OAuth screen. During alpha you'll see a warning page before you can finish. This guide explains what's happening and walks you through.

Why you'll see the "unverified app" warning

Closr is in Google's **Testing** mode for OAuth. That's a deliberate alpha posture, not a bug.

Here's the short version. Google requires every app that reads or sends Gmail to either limit itself to a small list of pre-approved testers (Testing mode), or go through CASA, Google's security audit. CASA takes months and costs five figures.

We picked option 1 for now because the forward path is different: once Closr hits roughly 80 active inboxes, it migrates onto Nylas's already-verified Google project. At that point the warning goes away for everyone, and we don't pay for an audit we don't need. Plan lives at `docs/superpowers/plans/2026-04-27-nylas-email-master.md` if you want the longer version.

Practical impact for you: Ara added your email to the official test-users list before sending your invite. Your account is allowed. Google still shows the warning to every test user. You have to click through it.

The exact click-through

1. 1In Closr, go to **Settings → Integrations**. Click **Connect** next to Google. You'll see a small confirmation modal listing the three permissions Closr is asking for. Click **Continue**.
2. 2Sign in with the Google account you want Closr to use. Use the same email Ara added to the tester list (the one your invite arrived at).
3. 3You'll land on a screen that says **"Google hasn't verified this app"** or **"This app isn't verified"**. Don't close the tab.
4. 4Click the small **Advanced** link near the bottom of the warning.
5. 5A new line appears: **"Go to closr.app (unsafe)"**. Click it. The "(unsafe)" wording is Google's, not ours. Click through anyway.
6. 6You'll see the real consent screen with the scopes Closr is requesting (listed below). Click **Continue**.
7. 7Google sends you back to Closr's Integrations page. The Google row now says **Connected** with a green check.

That's it. You won't see the warning again on this account.

What Closr is asking for, and why

Four scopes, no extras:

• •**gmail.modify**: send email from your address, read inbound replies so they thread into the right contact, mark messages as read, apply Closr labels, archive when deals close. This is the single load-bearing scope. Without it, the inbox half of Closr doesn't work.
• •**calendar**: Closr creates calendar events for showings and appointments, and reads your existing events to avoid double-booking. Same Google grant covers it. See the Calendar Sync guide.
• •**contacts.readonly**: for the optional one-time import of your Google Contacts during onboarding. Read-only. Closr never writes back to Google Contacts.
• •**openid / userinfo.email / userinfo.profile**: Closr needs to know which Google account you connected. No other profile data is read.

What we don't ask for: hard-delete on your mailbox, IMAP/SMTP full access, calendar sharing permissions, or anything outside the four above. Decision rationale is in `decision_gcp_oauth_scopes.md`.

What changes once you're connected

• •Inbound emails from your contacts (and from human senders Closr doesn't already know) parse into the right thread. Bulk senders (no-reply, mailing lists, marketing platforms) are filtered out so your CRM doesn't fill with junk.
• •Outbound chat-drafted emails go through your Gmail, from your address. The recipient sees your normal "from" name and signature.
• •BrokerBay, ShowingTime, and Realtor.ca confirmation emails auto-route into Showings and Leads. No extra setup.
• •Your calendar starts syncing both directions.

A few things to know