Connecting Gemini Enterprise¶

Gemini Enterprise can use your AI Actions server, but it is set up differently from Claude and ChatGPT. It can't register itself with your site, so you create a Client ID and Secret on the AI Actions screen and paste them into Google Cloud by hand. Plan on 20 to 30 minutes the first time, most of it spent in Google Cloud.

Before you start

One-click Connect (OAuth) must be turned on under Dealer.ms > AI Actions.
Your site needs pretty permalinks (anything but "Plain") and must be reachable over https:// from the internet.
You need a Google account that can create a Google Cloud project and turn on billing. Gemini Enterprise is a paid product.
The WordPress user who approves the connection needs a Dealer.ms license with API access, and the permissions for whatever you want the AI to do.

Part 1: Set up Gemini Enterprise in Google Cloud¶

You only do this once per Google Cloud project. If your company already has a Gemini Enterprise app, skip to Part 2.

Go to console.cloud.google.com and sign in.
In the search bar at the top, search for Gemini Enterprise and open it.
Create a new project, or pick an existing one. Make sure billing is attached to it.
Activate Gemini Enterprise for the project. Google asks you to choose an edition. Pick one that includes custom MCP servers.
Create your first app. The name is only for you, for example "Dealership AI".
Open the app's Connected data stores page. This is where the MCP server is added later.
Open Configure access control and decide who in your organization can use the app. Anyone who should be able to chat with the connector must be allowed here.

Part 2: Allow custom MCP servers (organization policy)¶

Google blocks custom MCP servers by default, so the option to add one won't work until an administrator turns off a policy.

In Google Cloud, go to IAM & Admin > Organization Policies.

Search for this constraint and open it:

constraints/discoveryengine.managed.disableCustomMcpServerConnector

Click Manage policy and set it so the constraint is not enforced (disabled). Save.

You may need a role first

Changing an organization policy requires the Organization Policy Administrator role (roles/orgpolicy.policyAdmin) on your organization. If the policy page is read-only or the save fails with a permission error, ask an organization admin to grant you that role, or have them make the change. This is a Google Cloud permission, not a Dealer.ms one.

Part 3: Create credentials on your site¶

In WordPress go to Dealer.ms > AI Actions and find the One-click Connect (OAuth) card. Make sure OAuth is On.
Under Apps that ask for a Client ID and Secret, you will see your Authorization URL, Token URL and Scope. You will paste these into Google next.
In the form, enter an app name such as "Gemini Enterprise", and put this in Redirect URI:
```
https://vertexaisearch.cloud.google.com/oauth-redirect
```
This is the callback address Gemini Enterprise normally uses. It must match exactly, with no extra spaces or trailing slash. Before you click Create, open the OAuth dialog from Part 4 in another tab and check whether Gemini shows its own callback or redirect URL. If it does and it differs, use that one here instead. Changing it later means creating a new set of credentials. 4. Click Create credentials. 5. Copy the Client ID and Client Secret now. The secret is shown once and can't be shown again. If you lose it, create a new set.

Part 4: Add the MCP server in Gemini Enterprise¶

Back in your Gemini Enterprise app, go to Connected data stores and add a new data store for a custom MCP server.

When it asks for authentication, choose OAuth 2.0 and fill in the dialog like this:

Field	What to enter
MCP Server URL	The MCP Server URL from the top of the AI Actions screen, for example `https://yoursite.com/wp-json/mcp/dms-mcp-server`
Authorization URL	`https://yoursite.com/dms-oauth/authorize`
Authorization URL Parameters	Leave empty
Token URL	`https://yoursite.com/dms-oauth/token`
Client ID	The Client ID from Part 3 (it starts with `dms_`)
Client Secret	The Client Secret from Part 3
Scopes	`mcp`
Enable PKCE Support	Leave unticked
Use HTTP Basic Authentication	Leave ticked

Copy the URLs from the AI Actions screen rather than typing them. Replace yoursite.com with your own domain.

The Client ID box

Gemini may pre-fill Client ID with your MCP Server URL. Delete that and paste the real Client ID. Using the wrong value is the most common reason the connection fails.

Click Verify Auth. A WordPress window opens. Log in if asked, check the app name and the address you will be sent back to, then click Allow. The window closes and Gemini marks the authorization as verified.
Save the data store.

If Verify Auth does nothing

Allow pop-ups for the Google Cloud console. A blocked pop-up looks like a button that does nothing.
If the WordPress window never opens, or Gemini reports a failure right after you click Allow, a firewall may be blocking Google. Cloudflare, a host firewall or a security plugin can block requests to /dms-oauth/token and the MCP Server URL. Allow those two paths and try again.

About PKCE

PKCE is an optional extra check. AI Actions accepts it when Gemini sends it, but it does not require it for credentials you create by hand, because those already have a secret. The setup above works with PKCE off.

Part 5: Load the actions and turn them on¶

Open the data store and click Reload custom actions. After a few seconds you should see the AI Actions tools listed, such as searching inventory and updating listings.
Enable the actions you want the AI to use. Start with the read-only ones (searching inventory, getting a listing, listing leads, decoding a VIN). Add the actions that create, update or delete listings and leads once you've seen it work and trust it.
Open a chat in your Gemini Enterprise app, click the Connectors icon, and turn on the connector for your MCP server.

Then try something simple:

"Search my inventory for trucks under $30,000."

If you get real listings from your site back, you're done.

Who the AI acts as¶

Gemini acts as the WordPress user who clicked Allow in Part 4, with that user's permissions. Everything it does is recorded in the AI Activity Log. The connection shows up under Connected apps on the AI Actions screen, where you can Disconnect it. Changing or resetting that user's password also disconnects it, as does 90 days without use. In either case you'd need to run Verify Auth again.

If something goes wrong¶

See Troubleshooting for the common Gemini errors and what they mean.