Overview

Tantra sends as your mailboxes using a Google service account with domain-wide delegation. The service account borrows the identity of each mailbox using short-lived tokens. It never uses a password.

A sender shows Disconnected when none of your uploaded service accounts can borrow that mailbox's identity. This almost always means a delegation or scope gap in your Google Workspace admin console, or that the service account was removed. This article shows how to confirm and fix it.

How connection is checked

When you add senders, Tantra tries to impersonate each mailbox with every service account you have uploaded. If one succeeds, the sender is linked to that service account and the badge turns to Connected. If none succeed, the badge stays Disconnected and a short reason appears on the row.

There is a second, separate check for Gmail. A service account can be authorized for Calendar but not Gmail. In that case the sender shows Connected with a Calendar-only badge instead of Gmail capable. Calendar-only senders can send calendar invitations but cannot send cold email.

Likely causes

Domain-wide delegation was never granted for the service account's client ID.
The delegation grant is missing one or more required scopes.
The service account was deleted or disabled in Google Cloud, or removed from Tantra.
The mailbox address is misspelled or belongs to a different domain than the delegation grant.
Delegation was granted moments ago and has not fully propagated yet.

Before you start

You need admin access to the Google Workspace admin console for the sending domain, and the service account's client ID. The three scopes Tantra requires must be authorized for that client ID, entered exactly:

https://www.googleapis.com/auth/gmail.send
https://www.googleapis.com/auth/gmail.modify
https://www.googleapis.com/auth/calendar

The gmail.modify scope is needed for reply detection. If it is narrowed, reply bodies may be unavailable, but sending still works. A fourth scope, https://www.googleapis.com/auth/gmail.settings.basic, is optional and only controls sender-name auto-fill.

Step-by-step checks

Open Accounts and set the status filter to Disconnected to list the affected senders. Read the reason text on each row for a hint.
In your Google Workspace admin console, open the domain-wide delegation settings and find the service account's client ID.
Confirm all three required scopes above are present for that client ID, spelled exactly. A single missing or mistyped scope prevents impersonation.
Confirm the service account still exists and is enabled in Google Cloud, and that its key is still uploaded in Tantra under Connectors.
Confirm the sender email is spelled correctly and belongs to the delegated domain.
Back on the Accounts page, select Re-authenticate All. Tantra re-tests every sender against your service accounts. A successful sender flips to Connected.
If you only just granted delegation, wait a few minutes for it to propagate, then select Re-authenticate All again.

What happens next

Re-authenticate All re-runs the impersonation probe for every sender. When it finishes, a toast reports success or failure, and each row updates its badge. A sender that now impersonates cleanly shows Connected, and if Gmail is authorized it also shows Gmail capable. From that point the sender can be used in campaigns again.

Troubleshooting

Symptom	Cause	Fix
Sender shows Disconnected with a permission or delegation reason	Domain-wide delegation is missing or lacks a required scope	Add all three scopes to the client ID in the admin console, then select Re-authenticate All.
A toast reads Verification failed	No service account could impersonate the mailbox	Confirm the service account exists, is enabled, and is uploaded, then retry.
Sender shows Connected but Calendar-only	The service account is authorized for Calendar but not Gmail	Add the `gmail.send` and `gmail.modify` scopes for the client ID, then re-verify.
Sender still disconnected right after granting delegation	The delegation grant has not propagated yet	Wait a few minutes and select Re-authenticate All again.
Only one sender is disconnected while others work	That mailbox address is misspelled or off-domain	Correct the address, or confirm it belongs to the delegated domain, then re-verify.
All senders went disconnected at once	The service account was deleted, disabled, or removed from Tantra	Restore or re-upload the service account, then re-authenticate.

FAQ

What does disconnected actually mean? It means none of your service accounts can impersonate that mailbox right now. Tantra cannot get a token to send as it.

Do I need the mailbox password? No. Tantra never uses passwords. Access comes entirely from domain-wide delegation on your service account.

Which scopes must I grant? gmail.send, gmail.modify, and calendar, entered exactly as shown above for the service account's client ID.

Why is my sender Calendar-only? The service account can act on that mailbox's calendar but is not authorized for Gmail. Add the two Gmail scopes and re-verify to enable email sending.

How do I re-verify after fixing delegation? Open the Accounts page and select Re-authenticate All. Tantra re-tests every sender against your service accounts.

I fixed the scopes but it still fails. Why? Delegation changes can take a few minutes to propagate across Google. Wait, then re-authenticate. Also confirm the client ID you edited matches the uploaded service account.

A sender shows as disconnected