Manifests for Google Workspace Add-ons

An Apps Script project uses a manifest file to configure certain details about the script and its operation. To learn how to view and edit a manifest, see Manifests.

This documentation covers the details of configuring a manifest for a Google Workspace Add-on.

Manifest structure for Google Workspace Add-ons

Google Workspace Add-ons use the Apps Script project manifest file to define several aspects of the add-on's appearance and behavior. The manifest properties for Google Workspace Add-ons are organized under the addOns section of the manifest object structure.

Sample Google Workspace Add-on manifest configuration

The below manifest sample shows the section of a manifest file that defines a Google Workspace Add-on, including the following aspects:

• The addOns.common section of the manifest defines the name, logo URL, colors, and other general, host-independent settings for the add-on.
• The manifest defines a common homepage, but also defines Calendar, Drive, Docs, Sheets, and Slides-specific homepages. Gmail uses the default homepage.
• The sample manifest settings enable the following:
  • Calendar eventOpen and eventUpdated triggers, and two Calendar conference solutions.
  • Two universal actions.
  • A Drive onItemsSelectedTrigger.
  • A Gmail compose action and contextual trigger.
  • File-specific interfaces for Docs, Sheets, and Slides.
• The oauthScopes field sets authorization scopes for the project (Typically required for add-ons).
• The urlFetchWhitelist field sets an HTTPS URL prefix, which ensures that any fetched endpoints match the prefix (Typically required for add-ons). For more information, see Allowlist URLs.

The links in the sample direct to the descriptions of that field in the manifest reference documentation.

Note: Manifests include other components that relate to Apps Script properties. The fields under the addOns field relate directly to Google Workspace Add-ons. This example is just a portion of a full manifest file and is not a fully functional manifest.

// Sample configuration of the addOns section in a manifest file:
{
  "addOns": {
    "calendar": {
      "createSettingsUrlFunction": "getConferenceSettingsPageUrl",
      "conferenceSolution": [{
        "id": "my-video-conf",
        "logoUrl": "https://lh3.googleusercontent.com/...",
        "name": "My Video Conference",
        "onCreateFunction": "onCreateMyVideoConference"
      }, {
        "id": "my-streamed-conf",
        "logoUrl": "https://lh3.googleusercontent.com/...",
        "name": "My Streamed Conference",
        "onCreateFunction": "onCreateMyStreamedConference"
      }],
      "currentEventAccess": "READ_WRITE",
      "eventOpenTrigger": {
        "runFunction": "onCalendarEventOpen"
      },
      "eventUpdateTrigger": {
        "runFunction": "onCalendarEventUpdate"
      },
      "eventAttachmentTrigger": {
        "label": "My Event Attachment",
        "runFunction": "onCalendarEventAddAttachment"
      },
      "homepageTrigger": {
        "runFunction": "onCalendarHomePageOpen",
        "enabled": true
      }
    },
    "common": {
      "homepageTrigger": {
        "runFunction": "onDefaultHomePageOpen",
        "enabled": true
      },
      "layoutProperties": {
        "primaryColor": "#ff392b",
        "secondaryColor": "#d68617"
      },
      "logoUrl": "https://ssl.gstatic.com/docs/script/images/logo/script-64.png",
      "name": "Demo Google Workspace Add-on",
      "openLinkUrlPrefixes": [
        "https://mail.google.com/",
        "https://script.google.com/a/google.com/d/",
        "https://drive.google.com/a/google.com/file/d/",
        "https://en.wikipedia.org/wiki/",
        "https://www.example.com/"
      ],
      "universalActions": [{
        "label": "Open settings",
        "runFunction": "getSettingsCard"
      }, {
        "label": "Open Help URL",
        "openLink": "https://www.example.com/help"
      }],
      "useLocaleFromApp": true
    },

    "drive": {
      "homepageTrigger": {
        "runFunction": "onDriveHomePageOpen",
        "enabled": true
      },
      "onItemsSelectedTrigger": {
        "runFunction": "onDriveItemsSelected"
      }
    },

    "gmail": {
      "composeTrigger": {
        "selectActions": [
          {
            "text": "Add images to email",
            "runFunction": "getInsertImageComposeCards"
          }
        ],
        "draftAccess": "METADATA"
      },
      "contextualTriggers": [
        {
          "unconditional": {},
          "onTriggerFunction": "onGmailMessageOpen"
        }
      ]
    },

    "docs": {
      "homepageTrigger": {
        "runFunction": "onEditorsHomepage"
      },
      "onFileScopeGrantedTrigger": {
        "runFunction": "onFileScopeGrantedEditors"
      }
    },

    "sheets": {
      "homepageTrigger": {
        "runFunction": "onEditorsHomepage"
      },
      "onFileScopeGrantedTrigger": {
        "runFunction": "onFileScopeGrantedEditors"
      }
    },

    "slides": {
      "homepageTrigger": {
        "runFunction": "onEditorsHomepage"
      },
      "onFileScopeGrantedTrigger": {
        "runFunction": "onFileScopeGrantedEditors"
      }
    },
  "oauthScopes": [
    "https://www.googleapis.com/auth/calendar.addons.execute",
    "https://www.googleapis.com/auth/calendar.addons.current.event.read",
    "https://www.googleapis.com/auth/calendar.addons.current.event.write",
    "https://www.googleapis.com/auth/drive.addons.metadata.readonly",
    "https://www.googleapis.com/auth/gmail.addons.current.action.compose",
    "https://www.googleapis.com/auth/gmail.addons.current.message.metadata",
    "https://www.googleapis.com/auth/userinfo.email",
    "https://www.googleapis.com/auth/script.external_request",
    "https://www.googleapis.com/auth/script.locale",
    "https://www.googleapis.com/auth/script.scriptapp",
    "https://www.googleapis.com/auth/drive.file",
    "https://www.googleapis.com/auth/documents.currentonly",
    "https://www.googleapis.com/auth/spreadsheets.currentonly",
    "https://www.googleapis.com/auth/presentations.currentonly"
  ],
  "urlFetchWhitelist": [
    "https://www.example.com/myendpoint/"
  ],
}

Allowlist URLs

Sometimes you may want your script or add-on to open a URL in response to a user action. Other times you may want your script or add-on to retrieve information from an external location using the Apps Script UrlFetch service. In both cases you must allowlist the URLs you open or fetch from in the project manifest.

Allowlisting is the process where you designate specific URLs that are pre-approved for access by your script or add-on. This requirement helps protect user data; if you define a allowlist, script projects can't access URLs that have not been allowlisted. Google Workspace add-ons require URLs to be allowlisted before they can be fetched or opened.

You can allowlist a URL for fetching by adding it or a matching prefix to the urlFetchWhitelist manifest field. For Google Workspace add-on projects, you can allowlist a URL for opening by adding it or a matching prefix to the addOns.common.openLinkUrlPrefixes manifest field.

Note: Whitelist, as used in urlFetchWhitelist, is a deprecated term that is synonymous with and replaced by allowlist. For more information, see Writing inclusive documentation.

The prefixes you add to the manifest must satisfy the following requirements:

• Each prefix must be a valid URL.
• Each prefix must use https://, not http://.
• Each prefix must have a full domain.
• Each prefix must have a non-empty path. For example, https://www.google.com/ is valid but https://www.google.com is not.
• You can use wildcards to match URL subdomain prefixes.
• A single * wildcard can be used in the addOns.common.openLinkUrlPrefixes field to match all links, but this is not recommended as it can expose a user's data to risk and can prolong the add-on review process. Only use a wildcard if your add-on functionality requires it.

When determining if a URL matches a allowlisted prefix, the following rules apply:

• Path matching is case-sensitive.
• If the prefix is identical to the URL, it is a match.
• If the URL is the same or a child of the prefix, it is a match.

For example, the prefix https://example.com/foo matches the following URLs:

• https://example.com/foo
• https://example.com/foo/
• https://example.com/foo/bar
• https://example.com/foo?bar
• https://example.com/foo#bar

Using wildcards

You can use a single wildcard character (*) to match a subdomain for both the urlFetchWhitelist and addOns.common.openLinkUrlPrefixes fields. You can't use more than one wildcard to match multiple subdomains, and the wildcard must represent the leading prefix of the URL.

For example, the prefix https://*.example.com/foo matches the following URLs:

• https://subdomain.example.com/foo
• https://any.number.of.subdomains.example.com/foo

The prefix https://*.example.com/foo doesn't match the following URLs:

• https://subdomain.example.com/bar (suffix mismatch)
• https://example.com/foo (at least one subdomain must be present)

Some of the prefix rules are enforced when you try to save your manifest. For example, the following prefixes cause an error if they are present in your manifest when you attempt to save:

• https://*.*.example.com/foo (multiple wildcards are forbidden)
• https://subdomain.*.example.com/foo (wildcards must be used as a leading prefix)