# Google Workspace Authentication Context Nick already has Google Workspace authentication set up for Claude Code and Codex on his local machines. Before creating new OAuth clients or new Google auth flows, check the existing local setup first. Known local clues from the laptop on 2026-04-27: - Google Workspace CLI binary: `~/.npm-global/bin/gws` - Google Workspace CLI config directory: `~/.config/gws` - Existing OAuth client file used by `gws`: `~/.config/gws/client_secret.json` - Additional Google config directory: `~/.config/google` - Existing credentials file observed: `~/.config/google/credentials.json` Do not copy raw access tokens, refresh tokens, API keys, or bot tokens into the vault. For [[OpenClaw]] Gmail work on the VPS, the existing `gws` OAuth client JSON can be reused as the Google Cloud Desktop app client for `gog`, while the actual account authorization still needs to happen through `gog auth add`. VPS state as of 2026-04-27: - The local `gws` OAuth client JSON was copied to the VPS for `gog`. - `gog auth add [email protected] --services gmail,calendar --readonly --gmail-no-send` was completed. - The resulting Gmail and Calendar scopes are read-only. - The OpenClaw Gmail digest uses this account for metadata-only Telegram summaries. - The OpenClaw Calendar digest uses this account for metadata-only Telegram summaries. - See [[OpenClaw VPS Setup#Gmail triage digest]] and [[OpenClaw VPS Setup#Google Calendar digest]] for the operational commands. Related: - [[OpenClaw VPS Setup]] - [[OpenClaw Emergency Stop]]