My own product: clients, cases, calendar, finances and WhatsApp for a law firm in a single system.
caso-04 · gestao-juridica
01 · problem
Requesting Google Calendar access in the same project as login would have made every new sign-up depend on Google's verification.
02 · decision
I moved the calendar into its own Google Cloud project: login ships without review, and the sensitive scope only shows up for whoever connects a calendar. The refresh token is encrypted with AES-256-GCM; rotating the key forces the lawyer to reconnect.
