🚀 Welcome to WorkFlura Setup

Complete the setup to activate your organization's workspace

Loading setup status...

Create Your Workspace

Thank you for installing WorkFlura from the Google Workspace Marketplace!
Sign in with your Google Workspace admin account to get started.

Create Your Workspace

Thank you for installing WorkFlura from the Google Workspace Marketplace!
Please provide your company name to initialize your dedicated secure workspace.

Company Name *

The name of your organization as it will appear in WorkFlura

Domain

Auto-detected from your Google login. You may override this if your organization uses a different domain.

Trial size

Loading…

Your 30-day trial emulates one of our plans. Pick the size that matches your evaluation — most teams start with Starter; choose Team if you are evaluating across several locations. Nothing is billed; at the end of the trial you choose any plan.

Workspace Admin

You're signed in as this account — it will be your workspace administrator. You can add more users and billing contacts later in Settings.

Your Firebase project

Create your own Firebase project and run the WorkFlura setup script first, then paste the details here.

Copy everything from const firebaseConfig = down to the closing ; on the Firebase "Add SDK" screen and paste it below — we'll clean it up for you and read your project ID from it.

Firebase project ID

Filled automatically from the config above — check it matches your project.

Service-account key

Heads-up: if your Google Cloud organization enforces security policies, the command below may stop with a “permitted organization” message. That one-time fix needs your Google Cloud organization admin (Organization Policy Administrator) — the command prints the exact steps. Most organizations won’t hit this.

This runs entirely in Cloud Shell — no need to reopen the instructions:

Click Copy command below.
Open Cloud Shell — the >_ icon at the top-right of your Google Cloud console.
Paste the command and run it. If it asks to confirm, type YES.
It sets up your service account and prints the key between two dashed lines.
Copy that JSON (or click Paste key from clipboard) into the box and click Verify.

show command

(loading…)

Paste only the key — the JSON block the command printed between the dashed lines. It starts with { "type": "service_account", includes -----BEGIN PRIVATE KEY-----, and ends with the final }. Don't paste the whole terminal output.

or click the box and press ⌘V / Ctrl-V

Already set up? Continue to your workspace →

Authorize Form Notifications (Domain-Wide Delegation)

Pending

Google Forms notifications must be maintained by a real user, not by a service account — so WorkFlura acts on behalf of one of your administrators. Authorizing that is a one-time job for a Google Workspace super administrator, and it is the one step Google provides no way to automate.

Go straight to the right screen:

admin.google.com/ac/owl/domainwidedelegation (opens Domain-wide delegation directly — sign in as a super admin)

Click Add new.
Already have a row for this Client ID? Click it and choose Edit instead — add the scopes below to the existing entry. Two rows for one Client ID behave unpredictably.
Paste the Client ID shown in the box below — a long number (your service account's OAuth2 client ID, which the setup script also printed).
Paste the OAuth scopes below, exactly, comma-separated with no spaces.
Click Authorize.
Wait a few minutes. Changes usually apply quickly but can take up to 24 hours. If Check Readiness fails right after authorizing, wait and retry before changing anything.

Two things that commonly block this:

You must be a super administrator. A regular admin will not see Add new. If that's you, send your super admin this page's Client ID and scopes.
If your organization uses multi-party approval, a second super admin must confirm before the authorization takes effect.

Client ID

This is your service account's OAuth2 client ID.

Optional — for the "Load Directory" shortcut. To let WorkFlura list your Workspace users when adding people, a Workspace super admin should grant one WorkFlura System Admin an admin role containing the Users > Read privilege. A custom role with only that privilege is enough — super admin is not required, and no other WorkFlura feature needs it. Without it, administrators add users by typing their email address, which works exactly the same way.

OAuth Scopes

https://www.googleapis.com/auth/forms.body,https://www.googleapis.com/auth/forms.responses.readonly,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/admin.directory.user.readonly

Authorize exactly these four scopes and nothing else. Google Chat notifications do not need any delegated scope.

Forms Shared Drive

Pending

📋 Prerequisites

Go to Google Drive with your Workspace admin account
In the left sidebar, click Shared drives → + New
Name it (e.g., "WorkFlura Forms")
Open the shared drive, click Manage members
Add the WorkFlura service account email (shown below) with role Manager
Copy the shared drive ID from the URL: drive.google.com/drive/folders/DRIVE_ID_HERE

Why a shared drive (not a regular folder)? Files in shared drives are owned by the drive itself, not by an individual. When team members come and go, your forms and submissions are unaffected.

WorkFlura Service Account Email

Add this as a Manager of your shared drive.

Shared Drive ID *

The ID from your shared drive URL

Apps Script Web App

Pending

WorkFlura uses a small Apps Script running in your own Google Workspace to keep Google Form responses private. Follow the five sub-steps below in order — each builds on the previous.

3.1 Choose your shared secret

Pick a strong, memorable phrase. You'll paste the same value into Apps Script later. Keep it private — anyone with this secret can trigger your purge endpoint.

Shared Secret *

Minimum 12 characters recommended. This is the same value you'll set as the APPS_SCRIPT_SHARED_SECRET Script Property in step 3.3.

Already set this up? Leave it blank — your existing secret is kept. For security it is stored in Google Secret Manager and never shown again, so this field is always empty when you return. Only type here if you want to replace it — and if you do, update the APPS_SCRIPT_SHARED_SECRET Script Property in step 3.3 to match, or submissions will start failing.

3.2 Create the Apps Script project

Open Google Apps Script (in the same Google account that will own this script)
Click New project
Delete any placeholder code in Code.gs, then click the button below to copy WorkFlura's code, and paste it into Code.gs. Save.
Show the manifest file: Project Settings (gear icon on left rail) → check "Show 'appsscript.json' manifest file in editor". Return to the editor — appsscript.json now appears in the file list. Open it, replace its contents with the button below, and save.
Put the script in your Shared Drive so WorkFlura can reach it.
Apps Script saves new projects in My Drive, where the WorkFlura service account cannot see them. The controller must live in the same Shared Drive as your forms.
1. Open your forms Shared Drive (the Shared Drive from step 2).
2. Inside it, create a folder named exactly Operations, if it isn't there already.
3. Find your new Apps Script project in My Drive, then MOVE it — do not copy it — into that Operations folder. Name the Apps Script project Forms Controller (rename it from "Untitled project" at the top-left) so it's easy to identify later if you ever need support.
  A copy leaves the original in My Drive (invisible to the service account) and creates a second file that drifts out of sync. Use Move: right-click the project → Organise → Move, or drag it into the folder. There must be exactly one controller, inside the Shared Drive.

3.3 Set Script Properties

In Apps Script: Project Settings (gear icon) → scroll to Script Properties → Add script property. Add each of the three properties below.

Property 1 of 3

Name: APPS_SCRIPT_SHARED_SECRET

Value: (enter your secret in step 3.1 first)

Property 2 of 3

Name: ACTIVE_FORM_IDS_ENDPOINT

Value: (loading...)

Property 3 of 3 (optional)

Name: PURGE_TRIGGER_OWNER

Value: the email of a durable System Admin (e.g. admin@yourcompany.com)

Only used to name who owns the response-purge in WorkFlura's alert messages if it ever stops. The purge itself works without it.

⚠ Now click Save script properties — don't skip this.

Apps Script does not keep the rows you just added until you press the Save script properties button underneath them. If you navigate away first, the properties are silently discarded and WorkFlura will reject your form submissions with an authentication error that looks like a WorkFlura problem.

To confirm it worked: leave Project Settings, come back, and scroll to Script Properties. Your three properties should still be listed. If they aren't, add them again and press Save.

3.4 Install the purge trigger

This trigger runs every 10 minutes to delete form responses after they've been safely ingested by WorkFlura.

In Apps Script, click the Triggers icon (clock symbol, left rail)
Click + Add Trigger (bottom right)
Set the fields:
- Function to run: purgeAllFormResponses
- Deployment: Head
- Event source: Time-driven
- Type of time-based trigger: Minutes timer
- Select minute interval: Every 10 minutes
Click Save. You'll be asked to authorize — click through the "Advanced → Go to (unsafe)" flow (Google shows this because your Apps Script is unverified; it's safe because you own it).

3.5 Deploy as Web App and paste the URL

Click Deploy → New deployment
Click the gear icon next to "Select type" and choose Web app
Set Execute as: Me, and Who has access: Anyone
Click Deploy, then copy the Web App URL shown
Paste the URL into the field below

Apps Script Web App URL *

The URL shown after deploying your Apps Script as a Web App

Google Chat Bot

Pending

📋 What is this?

Google Chat notifications allow WorkFlura to send direct messages to users about form submissions, approval requests, and status updates. This is required for real-time alerts.

▶ 📝 How to Create a Google Chat Bot

Open the Google Chat API page in Google Cloud Console and click Configuration in the left menu.
Fill in the App configuration:
- Build this Chat app as a Workspace add-on: this checkbox is at the top of the page — make sure it is unchecked before filling in anything else. If it is checked, Google hides the Authentication Audience setting below and sends events in a format WorkFlura does not accept.
- App name: WorkFlura Notifications
- Avatar URL: https://workflura-prod.web.app/icons/workflura-256-chatbot.png
- Description: Sends workflow notifications
- Interactive features: Select Enable Interactive Features; do not select anything under Functionality.
- Connection settings: Select "HTTP endpoint URL"
- HTTP endpoint URL:
- Authentication Audience: in the dropdown just below the endpoint URL, select HTTP endpoint URL (not "Project number") — this makes Google Chat sign each request for your webhook URL so WorkFlura can verify it.
Under Visibility, choose “Make this Chat app available to specific people and groups” and add the users who should receive notifications (your admin, plus any testers). For org-wide rollout, add a Google Group that contains everyone who should receive notifications. Only users in your Workspace domain can be added — external (e.g. gmail.com) participants get in-app notifications instead.
Click Save.
Wait a few minutes for the app to become discoverable (occasionally up to a few hours on a brand-new project). Then, signed in as a user in your visibility list, open Google Chat (chat.google.com or Gmail → Chat), click New chat, and search WorkFlura Notifications. Open it, and if prompted click Install / OK (some accounts may also need to send a Hi message).
Once the direct message opens, look at the browser URL — the format is: https://chat.google.com/dm/BOT_ID_HERE
Your Bot ID is only the part after /dm/ in that URL (e.g. mBO2NKAAAAE) — copy just that, not the whole URL, and paste it into Chat Bot ID below.

Chat Bot ID

The Bot ID from your Google Chat App configuration. Users will click a link to message this bot and enable notifications.

User Onboarding for Chat (share the steps below with every user for chat enablement)

Google Chat requires each person to start the conversation once before WorkFlura can send them notifications. Every user does this on their own account:

Open Google Chat (chat.google.com, or Gmail → Chat).
Click New chat and search WorkFlura Notifications.
Open it and, if prompted, click Install / OK (some accounts may also need to send any one message, e.g. “Hi”).
That’s it — WorkFlura notifications will now arrive as direct messages.

Note: only users in your Workspace domain can receive Chat messages. External participants still get in-app notifications.

Regional Settings

Default set

A default is already selected (America/New_York · MM/DD/YYYY). You can leave it as-is or change it — either way it's saved automatically.

Timezone

Date Format

Check your setup

Pending

This checks everything at once — your service account key, administrators, Shared Drive, Pub/Sub topic, Apps Script link, domain-wide delegation, and a live test that WorkFlura really can create a form. It reports every gap in one go rather than one error at a time.

Safe to run as often as you like. It creates one throwaway test form and deletes it again.

🚀 Welcome to WorkFlura Setup

Create Your Workspace

Create Your Workspace

📋 Prerequisites

3.1 Choose your shared secret

3.2 Create the Apps Script project

3.3 Set Script Properties

3.4 Install the purge trigger

3.5 Deploy as Web App and paste the URL

📋 What is this?

Setup Complete!