Gmail and Pilotiko: booking confirmations sent from your own address
One permission requested from Google: send. Pilotiko does not read your inbox.
The Gmail connection is built to send the booking confirmations and reminders Pilotiko prepares from your own address. It asks only for the gmail.send scope, with no access to read your mail. Status: Being commissioned: the connector is written and tested against a test server; it has not yet been verified with a real account.
In short
- Scopes requested: gmail.send, openid and email. Nothing that reads the mailbox.
- Intended use: booking confirmations plus reminders 24 hours and 1 hour ahead, sent in your business's name.
- Nothing is actually sent yet: real sending waits for the first trial with a live Google account.
- You can cut access in one click in Pilotiko, and again from your Google Account.
What does the Gmail connection do?
It lets Pilotiko send an email on your behalf through the Gmail API, and nothing more. Pilotiko writes each message from your booking data; your inbox stays closed to it.
Google sorts Gmail permissions by how much they expose. The gmail.send scope is described by Google as "Send email on your behalf" and sits in the sensitive tier [1]. Reading mail requires restricted scopes such as gmail.readonly, which trigger Google's restricted-scope app verification [1]. Pilotiko requests none of the restricted ones.
In practice, the connector builds a plain-text message (recipient, subject, body), encodes it and hands it to the Gmail API's users.messages.send method, which Google describes as sending the message to the recipients in the To, Cc and Bcc headers [2]. Names and subjects are scrubbed of line breaks first, so a booking made under a booby-trapped name can't inject extra headers.
Duplicates are guarded against on Pilotiko's side: every message carries a unique key, a repeat to the same person with the same subject within 10 minutes is dropped, and retries after a failure wait 1 minute, then 5, then 30.
- gmail.send: send email as you. No reading, no deleting, no labels.
- openid and email: identify which Google account was connected so the Connections page can show it.
- Read from Google: only the identity of the connected account.
- Written to Google: confirmation and reminder emails sent from your address.
- Needs a person's approval: anything that isn't tied to an already-accepted booking (a quote, a sales follow-up, a reply to a customer) stays a draft until someone approves it.
How do you connect Gmail to Pilotiko?
- 1
Go to Connections
In Pilotiko, open Connections and find the business email group. If the Gmail card reads "To be enabled by Pilotiko", the connection isn't offered on your account yet, and you won't see a dummy button.
- 2
Select Connect
You're sent to Google's consent screen with a one-time security value tied to your business and to you; it expires after 10 minutes.
- 3
Check Google's screen
Make sure the permission listed is sending email on your behalf, then approve with the account that speaks for the business.
- 4
Pick the sending mailbox
If Gmail, Outlook and Zoho Mail are all connected, tell Pilotiko which one sends for the business. It won't guess.
- 5
Send a test reminder
Send a trial reminder to a team address and check the sender, subject and appointment time when it lands.
What is live, being commissioned or coming soon with Gmail?
| Feature | Status | Detail |
|---|---|---|
| Google authorization (OAuth 2.0 with PKCE) | Being commissioned | Flow written and tested in simulation; Pilotiko's Google app hasn't been tried with a real account. |
| Booking confirmations | Being commissioned | Code ready; no real email goes out yet. |
| Reminders 24 h and 1 h ahead | Being commissioned | Same sending path as confirmations. |
| Reading or sorting the inbox | Coming soon | Not built; no read scope is requested. |
| Newsletters and marketing sequences | Coming soon | Not routed through Gmail; consent and unsubscribe exist, real sending is still to come. |
Being commissioned means the connector is written and tested against a test server; it has not yet been verified with a real account.
What would a week of Gmail reminders look like?
What happens to your data, and how do you revoke access?
The token Google issues is encrypted at rest (AES-256-GCM) and never leaves Pilotiko's server; it doesn't show up in logs, screens or error messages. Because Pilotiko doesn't read your mailbox, no incoming mail is copied to Pilotiko.
Quebec's private-sector privacy act requires a business to tell people why information is collected and that they can withdraw consent, and consent must be clear, free, informed and given for specific purposes [3]. Here the purpose is single and shown on Google's screen: sending email on your behalf.
To revoke: in Pilotiko, Connections → Gmail → Disconnect. The tokens are erased and the action is written to the audit log. Then remove Pilotiko from the third-party apps listed in your Google Account settings so Google stops honouring the grant as well.
More detail on Security and in the privacy policy.
What are the Gmail connection's limits?
- No reading: Pilotiko won't see customer replies in Gmail. They stay in your inbox.
- Plain text only on this path for now: no HTML layout or attachments.
- Authorization follows PKCE (RFC 7636) [4], but the full flow has only been exercised in simulation.
- If the token expires and can't be refreshed, the card switches to "Reconnect"; nothing is sent silently.
- Using Outlook instead? See the Outlook / Microsoft 365 integration. Mail hosted in Zoho's Canadian data centre? See Zoho Mail. For text messages, see Twilio.
Frequently asked questions
Can Pilotiko read my Gmail?
No. The only Gmail scope requested is gmail.send, which allows sending and nothing else. Google puts mailbox reading behind restricted scopes, and Pilotiko doesn't ask for them.
Are confirmations already going out from my Gmail address?
Not yet. The connector is being commissioned: it's written and tested against a test server, but no real send has been made with a live Google account. Until then, nothing leaves.
Do I need Google Workspace, or does a free Gmail account work?
Pilotiko doesn't require a particular Google plan; it only asks permission to send from the account you pick. An address on your own domain is clearer for customers than a generic one.
What if Google revokes Pilotiko's access?
The Gmail card switches to "Reconnect" and shows the reason. Queued messages stay queued; Pilotiko never claims an email went out without Google's answer.
Can I connect Gmail and Outlook at the same time?
Yes, but only one mailbox sends for the business. If several are connected, Pilotiko asks you to choose which one handles confirmations.
How do I know a reminder really went out?
Pilotiko marks a message as sent only once Gmail returns a message ID. Without that ID, the attempt counts as a failure and is retried later, never reported as a success.
Sources
- Google for Developers, Choose Gmail API scopes (accessed on October 15, 2026).
- Google for Developers, Method: users.messages.send (Gmail API) (accessed on October 15, 2026).
- LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (accessed on October 15, 2026).
- RFC Editor (IETF), RFC 7636 : Proof Key for Code Exchange by OAuth Public Clients (accessed on October 15, 2026).
Read next
Pilotiko integrations
Google Calendar, Outlook, Zoom, Stripe, LinkedIn, Cloudflare, Twilio and more: what each Pilotiko connection does today, with its status read from the code.
Outlook and Microsoft 365 with Pilotiko: your busy times and your outgoing mail
How Pilotiko connects to Outlook and Microsoft 365: Graph permissions requested, busy-time reading, sendMail, per-employee consent, real status and revoking.
Twilio integration: Pilotiko's text messages, no fake sends
What the Twilio connection does in Pilotiko: encrypted SID and token, reminder texts with real delivery status. The AI phone receptionist is coming soon.