Overview
Hook connects to your team's Gmail and Google Calendar (or Outlook and Microsoft 365 Calendar) through Nylas, an email and calendar API provider and Hook sub-processor. Each user connects their own account with standard OAuth consent. Nothing is installed on your systems, and no domain-wide delegation or service account is needed.
When a user clicks Connect in Hook, they see a Google or Microsoft consent screen that names Nylas as the app requesting access. If your organisation restricts third-party apps, an admin needs to approve the Nylas app first (see Admin approval below).
What Hook does with the connection
Capability | What happens | Where you see it in Hook |
Send email | Sends an email from the connected user's own mailbox, with their signature, when the user sends one or a playbook they set up sends one. Opens, link clicks and replies are tracked on those emails only. | Playbooks, agent actions, email drafts |
Read calendar events | Reads events on the connected user's primary calendar: title, time, attendees and meeting link. | Meetings, meeting prep, notetaker scheduling |
Every request runs as the connected user, so Hook only sees calendars that user can already see.
Permissions requested
Hook asks only for the scopes needed to send email and read calendar events.
Google Workspace
Scope | Why Hook needs it |
| Send email as the user. Grants no read access to the mailbox. |
| Read the user's calendar events. Read only, Hook cannot create or change events. |
| Identify which account was connected. |
| Show the user's name on the connection. |
Microsoft 365
Scope | Why Hook needs it |
| Send email as the user. Grants no read access to the mailbox. |
| Read the user's calendar events. |
| Identify which account was connected. |
| Keep the connection working without the user signing in again. |
What Hook does not do
Read, sync or index the user's inbox, sent folder or attachments.
Create, edit or delete calendar events.
Access any mailbox or calendar other than the connected user's own, plus calendars already shared with them.
Send email from an address the user has not connected.
Admin approval
You need this only if users see a "blocked" or "needs admin approval" message on the consent screen.
Google Workspace
In the Google Admin console, go to Security > Access and data control > API controls.
Select Manage Third-Party App Access, then Add app > OAuth App Name Or Client ID.
Search for Nylas and select it.
Choose which organisational units can use it, then set access to Trusted.
Microsoft 365
In the Microsoft Entra admin center, go to Enterprise applications > Admin consent requests, or open the Nylas app from the user's consent link.
Review the permissions listed above and select Grant admin consent.
Data, security and disconnecting
Sub-processor: Nylas processes data in the United States and is certified under the EU-US Data Privacy Framework and its UK Extension. It is listed on trust.hook.co.
What Hook stores: the connected email address, calendar events it has read, and records of emails sent from Hook (including open, click and reply status).
Disconnecting: users can disconnect any time from their connection settings in Hook. Disconnecting revokes the Nylas grant, so Hook can no longer send email or read the calendar. Admins can also revoke access from the Google Admin console or Microsoft Entra.
For step-by-step instructions on connecting your account, see Connect Your Email to Hook.