Skill

gws-auth

From gws

Authenticate and manage credentials for the gws CLI — login, logout, status, scopes, service accounts, and credential storage.

Install

npx claudepluginhub fakoli/fakoli-plugins --plugin gws

Tool Access

This skill uses the workspace's default tool permissions.

Preview

> **Note:** See the **gws-shared** skill for global flags and security rules.

SKILL.md

Similar Skills

agent-harness-construction

Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.

everything-claude-code

157.7k

accessibility

Designs, implements, and audits WCAG 2.2 AA accessible UIs for Web (ARIA/HTML5), iOS (SwiftUI traits), and Android (Compose semantics). Audits code for compliance gaps.

everything-claude-code

157.7k

agent-eval

Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.

everything-claude-code

157.7k

Stats

Parent Repo Stars2

Parent Repo Forks0

Last CommitMar 22, 2026

Used By2 plugins

Actions

View Source View Plugin View on GitHub View README

gws auth

Note: See the gws-shared skill for global flags and security rules.

Manage authentication and credentials for the gws CLI.

Auth Subcommands

gws auth login       # Interactive OAuth2 login (opens browser)
gws auth logout      # Remove stored credentials
gws auth setup       # Guided first-run setup wizard
gws auth status      # Show current auth state and active scopes
gws auth export      # Export credentials for use in other tools

Login Options

Minimal scopes (default — safest for unverified apps)

gws auth login

Default scopes: Drive, Sheets, Gmail, Calendar, Docs, Slides, Tasks.

Full scopes (includes Pub/Sub and Cloud Platform)

gws auth login --full

Adds pubsub and cloud-platform scopes. Requires a verified OAuth app or Workspace domain admin approval.

Custom scopes

gws auth login --scopes drive,gmail,sheets,pubsub

Unrecognized service names are resolved dynamically from Discovery docs.

Read-only access

gws auth login --readonly

Grants only .readonly scopes for all services.

Credential Sources (Priority Order)

GOOGLE_WORKSPACE_CLI_TOKEN — Pre-obtained OAuth2 access token (highest priority)
GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE — Path to OAuth credentials JSON
Encrypted credentials — AES-256-GCM encrypted at ~/.config/gws/
GOOGLE_APPLICATION_CREDENTIALS — Standard Google ADC (fallback)

Service Account Support

export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/service-account.json
gws drive files list

Credential Storage

Credentials are stored at ~/.config/gws/ (override with GOOGLE_WORKSPACE_CLI_CONFIG_DIR)
Encrypted with AES-256-GCM
Encryption key stored in OS keyring by default
For headless/Docker/CI: export GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file

Environment Variables

Variable	Description
`GOOGLE_WORKSPACE_CLI_TOKEN`	Pre-obtained OAuth2 access token
`GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE`	Path to OAuth credentials JSON
`GOOGLE_WORKSPACE_CLI_CLIENT_ID`	OAuth client ID
`GOOGLE_WORKSPACE_CLI_CLIENT_SECRET`	OAuth client secret
`GOOGLE_WORKSPACE_CLI_CONFIG_DIR`	Override config directory
`GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND`	`keyring` (default) or `file`
`GOOGLE_APPLICATION_CREDENTIALS`	Standard Google ADC path

Common Workflows

First-time setup

gws auth setup          # Guided wizard
gws auth status         # Verify it worked
gws gmail +triage       # Test with a read operation

Check current status

gws auth status

Re-authenticate with broader scopes

gws auth login --scopes drive,gmail,sheets,calendar,pubsub,cloud-platform

Tips

Start with gws auth login (minimal scopes) — add more later with --scopes
Use gws auth status to verify permissions before running commands
For CI/CD, set GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file and provide credentials via env vars
Never share or log the output of gws auth export