Google Workspace CLI OAuth setup

Note: mikan stores the Google authorized_user JSON in the vault as gws.json, and the runtime target is inferred from that file name. The image and gondolin sandboxes automatically project the file to that target inside the runtime. container, firecracker, and cloudflare cannot mount files at all and fail the run rather than proceed without the credential, so do not use this flow on those modes.

1. Create a Google OAuth Client

In Google Cloud Console, go to:

APIs & Services → Credentials → Create Credentials → OAuth client ID

Configure:

• Application type: Web application
• Authorized redirect URI: <LINK_URL>/oauth/callback

Example:

LINK_URL=https://mikan.example.com
Redirect URI=https://mikan.example.com/oauth/callback

If the OAuth app is still in testing mode, add users at:

OAuth consent screen → Test users

2. Set environment variables

export LINK_URL="https://mikan.example.com"
export GOOGLE_WORKSPACE_CLI_CLIENT_ID="<client-id>"
export GOOGLE_WORKSPACE_CLI_CLIENT_SECRET="<client-secret>"

If LINK_PORT is not set, mikan listens on 8181 by default when LINK_URL exists.

Optional: override default scopes:

export GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES="https://www.googleapis.com/auth/drive https://mail.google.com/ https://www.googleapis.com/auth/calendar"

3. Use /login

If you want later runtime executions to automatically project this credential file to /root/.config/gws/credentials.json, start mikan with the image sandbox (or gondolin:default):

mikan --sandbox=image:mikan-sandbox:tools /path/to/workspace

In a DM with the bot, type:

/login

Open the link returned by mikan and choose Google Workspace CLI OAuth.

After success, mikan stores the authorized user credential as a vault file, for example:

{
  "client_id": "...",
  "client_secret": "...",
  "refresh_token": "...",
  "type": "authorized_user"
}

The target path inferred from the gws.json name is:

/root/.config/gws/credentials.json

Notes

• mikan uses a web OAuth callback, so the Google OAuth client must be Web application, not a desktop app.
• If Google does not return a refresh_token, revoke the existing consent and run /login again. mikan requests access_type=offline and prompt=consent, but Google may still omit the refresh token because of existing authorization.
• To make gws.json appear automatically at /root/.config/gws/credentials.json, use the image or gondolin sandbox. On container, firecracker, and cloudflare a file credential in the vault makes the run fail with does not support vault file mounts — remove it and use env-only credentials there.