credentials saved successfully but 401 on all commands + auth export outputs truncated values - macOS Apple Silicon

[iamrajiv]

Environment

• gws version: 0.3.4
• OS: macOS Apple Silicon
• Account: personal @gmail.com
• Installed via: npm install -g @googleworkspace/cli

Bug 1: 401 on all commands despite successful auth

After completing gws auth login successfully, every command returns 401.

Steps to reproduce:

1. gws auth setup → success
2. gws auth login → browser opens, I approve, shows "Authentication successful. Encrypted credentials saved."
3. gws auth status → shows token_valid: true, encrypted_credentials_exists: true, encryption_valid: true
4. gws drive files list → 401 "Access denied. No credentials provided"

Tried all workarounds:

• GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=...credentials.enc gws drive files list → still 401
• GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=...credentials.json gws drive files list → still 401
• gws auth login && gws drive files list → still 401
• Re-authenticating multiple times → same result every time

Bug 2: auth export outputs truncated/masked credentials

gws auth export outputs masked values instead of real credentials:

{
  "client_id": "236618686201-xxx.apps.googleusercontent.com",
  "client_secret": "GOCS...jDDh",
  "refresh_token": "1//0...V2a0",
  "type": "authorized_user"
}

When saved via gws auth export > credentials.json, the file contains these truncated values making it completely unusable as a credentials file.

Auth status output

{
  "encrypted_credentials_exists": true,
  "encryption_valid": true,
  "has_refresh_token": true,
  "plain_credentials_exists": true,
  "token_valid": true,
  "storage": "encrypted"
}

Workaround

Had to bypass the CLI entirely and do a manual OAuth flow via curl to get a working access token. The underlying Google APIs work fine — the CLI credential reading is broken.

Related

• May be related to gws auth login unusable with personal @gmail.com accounts — invalid_scope + ignores custom client_secret.json #119 (different root cause)
• May be related to fix: use ~/.config/gws on all platforms for consistent config path #134 (config path inconsistency)

[ayakutt]

gws auth login --account my@email.com worked for me

[srgfrancisco]

Ran into the same issue on macOS (v0.4.4). gws auth status showed everything valid (token_valid: true, encryption_valid: true) but all API calls returned 401.

Fix: Re-running login with the --account flag:

gws auth login --account my@email.com

After that, gws drive files list worked immediately. It seems the CLI doesn't set a default account during initial gws auth login, so it can't resolve which credentials to use for API calls.