# Switching your SeedlyCRM to CRMLynk managed Google access This guide is for operators who already built their own Google Cloud project and OAuth app to connect Google services to SeedlyCRM, and now want CRMLynk to handle it instead. If you have never set up a Google Cloud project, skip to [Fresh setup](#fresh-setup-no-existing-google-app) at the bottom. It is shorter. Read the [What you lose](#what-you-lose) section before you start. There is one capability that goes away, and one step that will break your existing connections if you skip it. --- ## What actually changes Today, your SeedlyCRM deployment holds your own `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`. Your users see your app name on the Google consent screen, and you are responsible for your own Google verification, your own redirect URIs, and your own API access applications. After switching, SeedlyCRM sends users to CRMLynk, CRMLynk builds the consent screen with its own credentials, and hands the resulting tokens back to your deployment. Your users see "CRMLynk" on the consent screen. You hold no Google credentials at all. Your data does not move. Tokens are still stored encrypted in your own Convex deployment. CRMLynk holds them only for a five minute retrieval window during the connect flow. ## What you gain - **No Google verification of your own.** CRMLynk's OAuth verification was approved on 2026-09-03 for the sensitive scopes listed below. Google's sensitive scope review typically takes several weeks and has to be redone whenever you change your consent screen. - **No redirect URI maintenance.** CRMLynk's redirect URIs are already registered and verified. - **Google Business Profile API access.** GBP access is granted per Google Cloud project and Google allows only one project per company. CRMLynk's project is allowlisted. Without that allowlisting, every GBP call fails with a zero quota error. - **A Google Ads developer token.** Ads API calls require an approved developer token in addition to OAuth. CRMLynk supplies one. ### Scopes CRMLynk is approved for | Google service | Scope | |---|---| | Google Analytics (read) | `analytics.readonly` | | Google Calendar | `calendar`, `calendar.events` | | Google Ads | `adwords` | | Google Ads conversions | `datamanager` | | Google Business Profile | `business.manage` | | Search Console (read) | `webmasters.readonly` | | Drive and Sheets, per file | `drive.file` | ## What you lose **Gmail sync stops working.** Gmail scopes are what Google calls "restricted", a tier above "sensitive". They require an annual third party security assessment (CASA) that costs several thousand dollars. CRMLynk deliberately does not carry restricted scopes, which is what lets a subscription start from $49 a month. If Gmail sync currently works on your deployment through your own verified Google app, switching to CRMLynk turns it off. CRMLynk removes Gmail scopes from any consent request it receives, so reconnecting will not bring it back. Your options: - Keep running your own Google app, and do not switch. Everything below is optional. - Switch, and use a different email path. Outlook and Microsoft 365 mail are unaffected and are covered by CRMLynk's Microsoft publisher verification. - Switch now and wait. Gmail is planned for a later phase, with no committed date. **Google Sheets access becomes per file.** Instead of reaching any spreadsheet in the account, the Sheets and Drive workflow steps open a file picker, and the file you pick is the file the CRM can touch. This requires SeedlyCRM 5.7.1 or newer. See [If you are below 5.7.1](#if-you-are-below-571). --- ## The step people skip **Every existing Google connection must be reconnected after you switch.** A Google refresh token is bound to the OAuth client that created it. Your existing connections hold refresh tokens minted by *your* Google app. After you switch, SeedlyCRM routes all refreshes through CRMLynk, which presents CRMLynk's credentials. Google rejects that pairing. SeedlyCRM does not record which OAuth client issued each connection, so it cannot detect this and reconnect for you. **Symptom if you skip it:** connections look fine until the current access token expires, usually within an hour, then every Google feature on that connection starts failing to refresh. It looks like an outage rather than a setup step, which is why it is worth doing deliberately up front. Reconnecting takes about a minute per connection and does not delete anything. --- ## Steps ### 1. Subscribe Go to [crmlynk.com/subscribe](https://crmlynk.com/subscribe). You will need your **Convex site URL**, which is where your SeedlyCRM backend runs. It ends in `.convex.site` and looks like `https://cheerful-hedgehog-123.convex.site`. To find it, open the Convex dashboard for your production deployment. If the URL you see ends in `.convex.cloud`, change `.cloud` to `.site`, keeping the name identical. Do not enter the address your team uses to log in to the CRM. That is your app domain, not your backend, and CRMLynk cannot reach it. The subscribe form will reject a wrong URL and tell you what to fix. Your API key arrives by email as soon as payment clears. It starts with `sk_live_`. It is also shown on the page you land on after checkout. ### 2. Set two environment variables Against your production Convex deployment: ```bash npx convex env set --prod CRMLYNK_URL https://auth.crmlynk.com npx convex env set --prod CRMLYNK_API_KEY sk_live_your_key_here ``` Managed mode turns on only when **both** are set. Setting one does nothing, which is deliberate, so a half finished switch cannot break a working install. ### 3. Leave your old Google credentials alone for now Do not delete `GOOGLE_CLIENT_ID` or `GOOGLE_CLIENT_SECRET` yet. They are ignored while managed mode is on, and keeping them means step 6 is a one line rollback if you hit a problem. ### 4. Reconnect every Google integration In the CRM, go to each place a Google account is connected and reconnect it: - Settings, Integrations, for the Google Business Profile, Ads and Analytics connection - Each user's own Calendar connection, under their account connections You will see the CRMLynk consent screen instead of your own app name. That is the confirmation that managed mode is live. Work through every sub-account. A connection you forget will keep failing silently until someone notices a stale dashboard. ### 5. Verify Load a dashboard that reads Google data and confirm it populates. Analytics and Business Profile are the quickest to eyeball because they render on the main dashboard. If a connection errors, reconnect it once more. If it still errors, email support@crmlynk.com with your Convex site URL and the error text. ### 6. Clean up, once you are confident After a few days of everything working: - Remove `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` from your Convex environment. - Leave your old Google Cloud project alone, or delete it. If you delete it, understand that recreating a verified app later takes weeks, so keep it if there is any chance you will go back for Gmail. ### Rolling back Remove the two CRMLynk variables and your deployment returns to your own Google app immediately: ```bash npx convex env remove --prod CRMLYNK_URL npx convex env remove --prod CRMLYNK_API_KEY ``` You then have to reconnect every Google integration again, for the same reason as step 4, in the other direction. --- ## If you are below 5.7.1 Older SeedlyCRM versions ask Google for a broad Sheets permission that CRMLynk no longer requests. CRMLynk removes it automatically, so your connections will work, but the Sheets and Drive workflow steps expect you to paste a spreadsheet ID, and that will fail because the CRM no longer has account wide Sheets access. Upgrade to 5.7.1 or newer before relying on Sheets or Drive workflow steps. On 5.7.1 and newer those steps open a file picker, and picking a file is what grants access to it. There is a one click prompt to re-grant spreadsheets you had previously entered by ID. Everything else, Calendar, Analytics, Business Profile and Ads, works on older versions. --- ## Fresh setup, no existing Google app If you never built your own Google Cloud project, there is nothing to migrate: 1. Subscribe at [crmlynk.com/subscribe](https://crmlynk.com/subscribe) with your `.convex.site` URL. 2. Set the two environment variables from step 2. 3. Connect your Google integrations in the CRM. You never create a Google Cloud project, never apply for Business Profile access, never request an Ads developer token, and never go through Google verification. --- ## Questions support@crmlynk.com. Include your Convex site URL, it is the fastest way for us to look up your subscription.