Use gog (Google CLI) without manual OAuth setup — Civic handles token management automatically
This skill describes the @civic/openclaw-google plugin, which lets agents use gog (the Google Workspace CLI) without the user having to create a Google Cloud project, configure OAuth credentials, or manage tokens. Civic acts as an OAuth proxy — it provides the OAuth client, stores tokens encrypted server-side, refreshes them automatically, and the plugin requests only the scope each command actually needs.
gog command prefix (e.g. gog gmail send) over HTTPS to app.civic.com for scope resolution. The proxy reads only the command prefix to determine which OAuth scope is needed — command arguments (email addresses, search queries, file names) are not logged, stored, or used by the proxy.@civic/openclaw-google.Install the plugin:
openclaw plugins install @civic/openclaw-google
Install gog (the Google CLI):
brew install gog
Set your Civic API token in the gateway environment:
CIVIC_TOKEN=<your-token-from-app.civic.com>
Get your token from app.civic.com -> Settings -> API Keys.
Restart the gateway.
gog gmail search newer_than:1dexec tool call via a before_tool_call hookgog gmail -> gmail.readonly scopeGOG_ACCESS_TOKEN env var, gog runsThe plugin maps each gog subcommand to the narrowest OAuth scope required. Write operations get specific scopes; unrecognized subcommands fall back to read-only.
gog gmail send — gmail.sendgog gmail draft, gog gmail drafts — gmail.composegog gmail trash, archive, read, unread, batch — gmail.modifygog gmail (catch-all) — gmail.readonlygog calendar create, update, delete, respond, subscribe — calendar.eventsgog calendar (catch-all) — calendar.readonlygog drive upload, create, update, delete, move, rename, share, copy, import — drive.filegog drive transfer — drive (full access, required for ownership transfer)gog drive (catch-all) — drive.readonlygog docs create, edit, append — documentsgog docs copy, delete, import — documents + drive.filegog docs export — documents.readonly + drive.filegog docs (catch-all) — documents.readonly + drive.readonlygog sheets write, append, delete, insert, format, merge, freeze, resize — spreadsheetsgog sheets create — spreadsheets + drive.filegog sheets (catch-all) — spreadsheets.readonly + drive.readonlygog slides create, copy — presentations + drive.filegog slides edit, update, duplicate, delete — presentationsgog slides (catch-all) — presentations.readonly + drive.readonlygog tasks add, done, delete, move, update — tasksgog tasks (catch-all) — tasks.readonlygog contacts create, update, delete, merge, batch — contactsgog contacts (catch-all) — contacts.readonlygog chat send — chat.messages.creategog chat create — chat.spacesgog chat delete — chat.messagesgog chat (catch-all) — chat.spaces.readonly + chat.messages.readonlygog forms create, update, delete — forms.bodygog forms (catch-all) — forms.body.readonly + forms.responses.readonlygog appscript run — script.projectsgog appscript deploy — script.deploymentsgog appscript (catch-all) — script.projects.readonly + drive.readonlyCIVIC_TOKEN in your gateway environment. Get it from app.civic.com -> Settings -> API Keys.gog command.For local development, set OPENCLAW_PROXY_URL in the gateway environment:
OPENCLAW_PROXY_URL=http://localhost:3013/openclaw