;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubSend, search, read, label and draft Gmail messages from any Windmill script, flow or app, or pause a flow until someone approves from their inbox.
What you can do with Gmail
Complete, deployable projects built around Gmail — the fastest way to get something real running.
Set up in 2 steps
Connect from the Resources page
Open Resources, click Add a resource/API and pick gmail under Instance-configured OAuth APIs. Click Connect and sign in with the Google account the mail should be sent from, then name the resource and save it.
Run your first script
Fork the send email script below, or drop the approval step into a flow.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Send Email with Service Account
Send Email
List Send-As Aliases
List Labels
Get Send-As Alias
Get Profile
Download Attachment
Delete Label
Create Label
New Email
Search Messages
Modify Labels
Get Thread
Get Message
Create Draft
Suspend/resume a flow by sending approval URL via email
Flows
Multi-step workflows that already wire Gmail to something else.
Trigger flows from Gmail
Gmail is not only a destination. These inbound paths are supported today.
New email (scheduled poll)
The New Email trigger script returns the messages matching a search query since its last run; it needs gmail.readonly or gmail.modify. To run it, open a flow, add a trigger and choose Scheduled Poll, then pick the trigger script and an interval. The steps after it run once per new item, and each flow keeps its own cursor.
Instant push (Pub/Sub in your own Google Cloud project)
Gmail pushes only to a Pub/Sub topic in your own Google Cloud project, which is why the trigger above polls. For instant delivery, call users.watch on your topic (renew it daily) and attach Windmill's GCP Pub/Sub trigger (self-hosted Enterprise) to a subscription. Each notification carries only a historyId, so the handler calls users.history.list.
Resource type
The shape of the credential every script on this page expects.
gmail
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| token | string | Yes |
Questions
What can Windmill do with my mailbox?
Whatever scope you tick when connecting. The default, gmail.send, only sends; reading, search and the new-email trigger need gmail.readonly, drafts gmail.compose, labels gmail.modify or gmail.labels, and gmail.modify covers every script. Each script names its scope.
Can I create the resource by hand instead of connecting?
No: Google access tokens last about an hour, and only the OAuth flow gets the refresh token that renews them, which is why this page has no CLI lane. For a credential that does not expire, use Send Email with Service Account (Google Workspace, below) or send through the smtp resource.
Can I send from a shared Workspace mailbox with a service account?
Yes, with the Send Email with Service Account script, which needs no OAuth connection and no token refresh: it signs a JWT with the service account key on every run and impersonates the mailbox you pass as delegated_user. 1) In Google Cloud, create a service account, enable the Gmail API on its project and download a JSON key. 2) In the Google Admin console (super admin), open Security > Access and data control > API controls > Domain-wide delegation, click Add new, and enter the service account's client ID (the numeric client_id in the key) with the scope https://www.googleapis.com/auth/gmail.send. 3) In Windmill, create a google_service_account resource from the key. To keep the key in a secret store, put private_key in a secret variable (for example one backed by Vault) and set the field to $var:<path>. Delegation only works for mailboxes in your Workspace domain, not @gmail.com accounts; if the client ID or scope is missing, the token request fails with unauthorized_client.
There is no Connect button on my instance
An instance admin has to add a Google OAuth client once, under Instance settings → Auth/OAuth/SAML → OAuth. Until then, send mail through the smtp resource.