Integrations and booking
Google Calendar and Sheets
Configure optional, administrator-owned OAuth connections and one-way exports.
On this page
Prerequisites
Create your own Google Cloud project and enable Calendar and/or Sheets APIs. Configure a web-application OAuth client and its consent screen. Register the exact callback shown in the CMS Integrations screen, normally /manage/integrations/google/callback on the CMS HTTPS origin. Store GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET privately. Never put real values in source control or a frontend bundle. Initial live consent, refresh and revoke flows require testing with a dedicated account.
Encryption key
php bin/console app:integrations:init-keyThe command creates a private random key without printing it. Alternatively supply INTEGRATION_ENCRYPTION_KEY as a base64-encoded random 32-byte key through private environment configuration. Losing or replacing the key makes stored credentials unreadable; preserve it securely in recovery procedures.
Calendar export
The connector requests calendar.events.owned and exports demo appointment timestamps with a generic label to a calendar you own. It sends no attendee names, email addresses, health details or invitations. Export is one-way: it does not read Google availability or import edits, and cannot prevent conflicts created in Google. Deterministic IDs make retries update the same event. Cancellation removes the exported event; changing destinations does not clean up earlier calendars.
Sheets export
The connector requests the broader spreadsheets scope. Choose a spreadsheet you can edit, create a CareCMS tab with at least 1,000 rows and reserve the entire CareCMS!A1:D1000 range for this export. Each export replaces that range with published title, path, language and update-date metadata, clearing stale rows. RAW input prevents spreadsheet formula evaluation. More than 999 published records is refused; private drafts, users and bookings are not exported.
Processing and disconnect
Run the integration worker on a scheduler, or process a single job through the administrator dashboard. Website visits do not run the worker. Local disconnection removes local credentials but does not claim to revoke the Google project grant; revoke it in the Google account when needed. Provider requests use TLS validation, fixed destinations and bounded timeouts. Do not turn off certificate checks to work around a connection error.
Something unclear? Contact me about this guide.