For your Google Workspace administrator

Access blocked. Here is exactly what to approve, and what you are approving.

Google's block screen is a dead end on purpose: it names no client ID, no scopes and no vendor evidence, so the person who hit it cannot file a request an administrator could actually decide on. This page is the other half of that screen. There are two routes past it, and the one we recommend does not require trusting Sparcle at all.

1. What the screen means

What the screen says

“Access blocked: your institution’s admin needs to review Bolt by Sparcle”, usually with Error 400: access_not_configured.

What it actually means

Your Google Workspace has App access control set to block unconfigured third-party apps. Bolt is simply not on the allowlist yet. Nothing is broken, in Bolt or in your tenant.

Whose decision it is

Your own Workspace administrator’s. Sparcle cannot allowlist Bolt for your domain, and no vendor can. Only an admin in your Admin console can.

What is not wrong

It is not a failed sign-in, an expired credential, a licence problem, or a Bolt defect. A correct password and a valid licence produce exactly this screen too.

What happens to your data meanwhile

Nothing left your machine. The block happens at Google’s consent screen, before any token is issued and before Bolt reads anything.

2. Route A: run Bolt on your own OAuth client

The route we recommend, and the one most enterprises end up on. Instead of your administrator approving an outside vendor's application, you register the OAuth client yourself, inside your own Google Cloud project.

Bolt reads its Google client credentials from configuration, so an enterprise deployment can point it at a client you own: BOLT_GOOGLE_CLIENT_ID with BOLT_GOOGLE_CLIENT_SECRET for the confidential flow, or BOLT_GOOGLE_DESKTOP_CLIENT_ID for a native, no-secret desktop client. Set them and Bolt uses yours instead of ours.

Why it clears the block

The application is then first-party inside your tenant. App access control governs third-party apps, so there is nothing left for it to block, and no allowlist entry to maintain.

What you gain

You hold the client secret. You set the consent screen to Internal so only your domain can use it. You see every grant in your own console, and you revoke by deleting the client rather than by asking us.

What it costs you

About fifteen minutes in Google Cloud Console, once. The exact console path, the redirect URIs and the configuration keys are written out at the Google Workspace setup guide.

The honest caveat

Scopes on a client you own are yours to choose, which means write access becomes possible where the Sparcle-owned client offers none. That is a widening, not a narrowing: grant only the scopes in section 4 if read-only is what you intend to allow.

3. Route B: allowlist Sparcle's client IDs

Faster, and right for a pilot or a single user. Your administrator marks Bolt trusted by client ID; nothing is installed or changed anywhere else.

Where

Admin console → Security → Access and data control → API controls → App access control → Configure new app → OAuth App Name Or Client ID.

Client ID, desktop app

439562173816-iqjm8af7b319el2g8rrh9ignt8ovh8pu.apps.googleusercontent.com is the public, native (loopback + PKCE) client the installed desktop app uses. This is the one most people need.

Client ID, web

439562173816-ghoqm4v38hv5go22va9p53dgh05i8hes.apps.googleusercontent.com is the confidential web client. Allowlist both: a build that has no native client registered falls back to this one, and an allowlist that covers only one of the two produces the same blocked screen on the other.

What to set it to

Trusted, for the OU or group you want to pilot with rather than the whole domain. Access can be narrowed or withdrawn at any time, and revoking here revokes existing grants.

Publisher shown

Sparcle Inc. Bolt is not listed on the Google Workspace Marketplace, so there is no Marketplace allowlist entry to find; configuring it by client ID is the supported route and the one Google’s own screen points at.

4. Every scope Bolt asks Google for

The whole list, with what each one cannot do. On the Sparcle-owned client every scope is read-only: there is no write scope to grant, because none is registered.

Scope	Google class	What it is for	What it cannot do
openid, email, profile	Minimal	Sign-in only: who you are. Requested at login, always.	None. This is the identity handshake.
gmail.readonly	Restricted	Reading mail so it can be searched and summarised on the endpoint.	No send, no modify, no delete. The Sparcle-owned client registers no Gmail write scope at all.
calendar.readonly	Sensitive	Listing your calendars and reading events. The narrower calendar.events scope cannot enumerate calendars, which the all-calendars view needs.	No event creation, no edits, no invitations.
drive.readonly	Restricted	Reading files a search matches, so Drive content is findable alongside local content.	No upload, no edit, no delete, no sharing changes.
contacts.readonly, contacts.other.readonly	Sensitive	Resolving names and addresses when you search for a person.	No writes to the directory or to personal contacts.
tasks.readonly	Sensitive	Reading task lists so tasks appear in search and recall.	No task creation or completion.

5. What you are actually approving

Where the data goes

From the endpoint straight to Google and back. Sparcle operates no service in that path, so approving Bolt does not add a vendor to your data flow. Detail at /trust/for-your-it.

Where the token is kept

On the user’s own machine, encrypted with AES-256-GCM. There is no copy on any Sparcle system to breach or subpoena.

Independent assessment

Bolt passed Google CASA, performed by an authorized assessment lab against 48 requirements covering exactly this: how an app handles Google user data. That is why Google itself grants Bolt the two restricted scopes above. Detail at /trust/independent-assessment.

Verifying rather than believing

A read-only script that shows every connection Bolt opens on a test machine, classified against the published list, at /trust/prove-it-yourself. Run your own monitor instead if you would rather.

The wider review

Permissions, storage, encryption, code signing, and the assurance we do not hold, on one forwardable page at /trust/for-your-it.

6. If you are the person who got blocked

File your company's third-party app request, and put this in it. An administrator can decide on these five lines without a call:

Application:  Bolt, a desktop application, by Sparcle Inc.
Client IDs:   439562173816-iqjm8af7b319el2g8rrh9ignt8ovh8pu.apps.googleusercontent.com (desktop)
              439562173816-ghoqm4v38hv5go22va9p53dgh05i8hes.apps.googleusercontent.com (web)
Scopes:       gmail.readonly, calendar.readonly, drive.readonly,
              contacts.readonly, contacts.other.readonly, tasks.readonly
              Read-only. No write scope is registered on this client.
Data path:    Endpoint to Google directly. No vendor cloud, no telemetry,
              no copy on any Sparcle system.
Assessment:   Google CASA passed (48 requirements, authorized lab).
Review pack:  https://sparcle.app/trust/for-your-it/
Admin route:  Preferably run Bolt on our own OAuth client instead:
              https://sparcle.app/trust/google-workspace-approval/