Google Workspace

Google Workspace is the first managed CLI integration. It supports Gmail, Calendar, Meet, Tasks, Drive, Docs, Sheets, Slides, and Forms as independently selectable services.

Before You Connect

The local stack must include a Google OAuth client ID and client secret. The configured redirect URI uses the local backend callback path generated from the backend port unless googleOAuth.redirectUri supplies a public HTTPS callback.

For access through a reverse proxy, register the exact https://api.example.com/oauth/google/callback value in the Google OAuth client and set the same value as googleOAuth.redirectUri. Set publicFrontendUrl to the public app origin so the backend returns the browser to the tunneled frontend. These two fields are independent of Meta’s callback.

Decide:

• which Google account represents the organization;
• which services Oblive needs;
• whether the integration should be Read-only, Ask before writes, or Autonomous.

Connect Google

1. Open Integrations, select Connect on Google Workspace, and review Connection.
2. Choose the services to enable.
3. Choose Read-only, Ask before writes, or Autonomous from the permission-mode dropdown.
4. Select Continue to Google Workspace.
5. Complete Google consent with the intended organization account.
6. Return to the management sheet, open Access, and confirm the redacted connected identity and active services.

Oblive requests scopes incrementally from the selected service set. Reauthorization must use the same Google account. Disconnect first when switching identities.

Reads and Changes

Read operations execute through the scoped gateway. Sends, invitations, sharing, deletion, and other consequential operations require a task, an idempotency key, a plain-language summary, and the normal action policy.

Chat may use permitted reads but cannot perform consequential Google commands.

Files

Uploads and downloads must stay inside the active run workspace. Each invocation is bounded to 50 MB. Temporary credential material and files are created with restricted permissions and removed after execution.

Troubleshooting

• Google is not available: configure googleOAuth with oblive config edit, run oblive config check, and restart the backend.
• Redirect mismatch: confirm Google and googleOAuth.redirectUri contain the identical HTTPS URL ending in /oauth/google/callback, then run oblive config check and oblive restart --no-open.
• A service is denied: reconnect with that service selected so the necessary incremental scope can be granted.
• Wrong Google account: disconnect, then connect the intended account.
• A write is blocked: confirm a write-capable permission mode, task execution, service grant, and approval state. Ask before writes also requires approval of the staged action.
• Approval or reconciliation exit: resolve the corresponding Human Inbox item instead of retrying with a new command.