Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Set up Gmail API access via gog CLI with manual OAuth flow. Use when setting up Gmail integration, renewing expired OAuth tokens, or troubleshooting Gmail authentication on headless servers.
Set up Gmail API access via gog CLI with manual OAuth flow. Use when setting up Gmail integration, renewing expired OAuth tokens, or troubleshooting Gmail authentication on headless servers.
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
Headless-friendly OAuth flow for Gmail API access using gog CLI.
gog CLI installed (brew install steipete/tap/gogcli) Google Cloud project with OAuth credentials (Desktop app type) Gmail API enabled in the project
Go to https://console.cloud.google.com Create a new project (or select existing) Enable Gmail API: APIs & Services โ Library โ search "Gmail API" โ Enable Configure OAuth consent screen: APIs & Services โ OAuth consent screen Choose "External" user type Fill in app name, user support email Add scopes: gmail.modify (or others as needed) Important: Click "PUBLISH APP" for permanent tokens (see Troubleshooting) Create credentials: APIs & Services โ Credentials โ Create Credentials โ OAuth client ID Application type: Desktop app Download the JSON file
gog auth credentials /path/to/client_secret.json gog auth keyring file # Use file-based keyring for headless export GOG_KEYRING_PASSWORD="your-password" # Add to .bashrc
Run scripts/gmail-auth.sh interactively, or: # Generate URL scripts/gmail-auth.sh --url # User opens URL, approves, copies code from localhost redirect # Exchange code (do this quickly - codes expire in minutes!) scripts/gmail-auth.sh --exchange CODE EMAIL
gog gmail search 'is:unread' --max 5 --account you@gmail.com
Cause: App is in "Testing" mode and the Gmail account isn't a test user. Solutions (choose one): Publish the app (recommended): Google Cloud Console โ APIs & Services โ OAuth consent screen Click "PUBLISH APP" โ Confirm No Google review needed for personal use Tokens become permanent Add test user: OAuth consent screen โ Test users โ + ADD USERS Add the Gmail address you're authorizing Tokens still expire in 7 days
This is normal for personal apps. Click: Advanced (bottom left) Go to [app name] (unsafe) Safe to proceed since you own the app.
Cause: App is in "Testing" mode. Fix: Publish the app (see above). Published apps get permanent refresh tokens.
Causes: Authorization code expired (they only last a few minutes) Code was already used Redirect URI mismatch Fix: Generate a fresh auth URL and complete the flow quickly. Paste the code immediately after getting it.
Cause: The redirect URI in the token exchange doesn't match what was used in the auth URL. Fix: This script uses http://localhost. Make sure both the auth URL and exchange use the same redirect URI.
Cause: Browser trying to connect to localhost which doesn't exist on phone. Fix: Use a desktop browser instead Or tap the address bar while it's "hanging" - the URL contains the code The URL will look like: http://localhost/?code=4/0ABC...
Cause: Too many OAuth scopes requested. Fix: Use minimal scopes. gmail.modify alone is usually sufficient and shows just one permission.
Cause: Signed into wrong Google account. Fix: Check which account owns the project: Click profile icon (top right) Switch accounts Check project dropdown for each account
Cause: Google deprecated urn:ietf:wg:oauth:2.0:oob for OAuth clients created after 2022. Fix: Use http://localhost redirect instead (this script's default). After approval, browser redirects to localhost with code in URL.
ScopeAccessgmail.modifyRead, send, delete, manage labels (recommended)gmail.readonlyRead onlygmail.sendSend onlygmail.composeCreate drafts, send
scripts/gmail-auth.sh โ Interactive auth helper
Publish your app โ Avoids test user limits and 7-day token expiry Exchange codes quickly โ They expire in minutes Use desktop browser โ Mobile browsers can be finicky with localhost redirects One scope is enough โ gmail.modify covers most use cases
Workflow acceleration for inboxes, docs, calendars, planning, and execution loops.
Largest current source with strong distribution and engagement signals.