How Tantra sends as your mailboxes

Overview#

Both of Tantra's outreach engines, calendar campaigns and cold email, send from your own Google Workspace mailboxes. This article explains the mechanism so the setup steps make sense. Anyone setting up Tantra for the first time should read it before uploading anything.

Prerequisites:

• A Google Workspace account with admin access to your domain.
• Permission to create a service account and grant it access in your Google Admin console.

How it works#

Tantra never asks for your Google password and never stores a login token for your users. Instead, you create one Google service account, a special non-human identity, and give it permission to act on behalf of the mailboxes in your domain. This permission is called domain-wide delegation.

Think of the service account as a trusted assistant you hire once. You tell Google, in your own admin console, exactly which actions the assistant may take (send email, manage calendar events). Tantra then asks that assistant to send a specific message as a specific mailbox. Google checks the permission you granted and delivers the message as if the mailbox owner sent it.

Because you grant the permission inside your own Google Admin console, you stay in control. You can revoke it at any time without involving Tantra.

Before you start#

You need three things, covered in the next articles:

1. A Google service account and its JSON key file. See Create a Google service account.
2. Domain-wide delegation granted to that service account, with the correct scopes. See Grant domain-wide delegation and scopes.
3. The service account uploaded to Tantra, and your senders verified. See Upload your service account to Tantra and Add and verify your senders.

What happens next#

Once your service account is uploaded and a sender is verified, Tantra can send as that mailbox. Each time it sends, Tantra requests a short-lived access token that impersonates the mailbox, uses it, and lets it expire. Tokens are cached for under an hour and refreshed automatically, so you do not manage anything after setup.

Behind the scenes#

When a campaign needs to send, Tantra looks up the verified sender, mints a short-lived token scoped to only the permissions you granted, and calls the Google API as that mailbox. If you later remove the service account or revoke delegation in Google, sending for those mailboxes stops.

Best practices#

• Grant only the scopes Tantra needs. The exact list is in Grant domain-wide delegation and scopes.
• Keep the service account JSON file private. Treat it like a password.
• Use a dedicated service account for Tantra so you can revoke it without affecting other tools.

Common mistakes#

• Trying to connect individual mailboxes with a personal Google login. Tantra does not use per-user sign-in for sending. It uses one service account for the whole domain.
• Granting delegation to the wrong client ID. Use the service account's unique client ID, shown when you create it.

Troubleshooting#

FAQ#

Does Tantra store my Google password?#

No. Tantra uses a service account with domain-wide delegation. It never holds a password or a per-user login token.

Can I revoke access without contacting Tantra?#

Yes. Remove the delegation in your Google Admin console, or delete the service account. Sending for those mailboxes stops.

Do I need one service account per mailbox?#

No. One service account covers every mailbox in your domain that you grant it access to.

Why does Tantra ask for both Gmail and Calendar permissions?#

Cold email uses the Gmail permissions and calendar campaigns use the Calendar permission. You grant whichever engines you plan to use.

Related articles#

• Create a Google service account
• Grant domain-wide delegation and scopes
• Add and verify your senders