"Authentication successful" but "Access denied"

[LittleBrainz]

I successfully followed the steps under "Manual OAuth setup (Google Cloud Console)".

Yes, I did add myself as a test user.

With "~/.config/gws/client_secret.json" in place, I successfully authenticated...

$ gws auth login
Open this URL in your browser to authenticate:

  https://accounts.google.com/o/oauth2/auth? [redacted]
{
  "account": "(unknown)",
  "credentials_file": "C:\\Users\\Stephen\\.config\\gws\\credentials.enc",
  "encryption": "AES-256-GCM (key secured by OS Keyring or local `.encryption_key`)",
  "message": "Authentication successful. Encrypted credentials saved.",
  "scopes": [
    "https://www.googleapis.com/auth/drive",
    "https://www.googleapis.com/auth/spreadsheets",
    "https://www.googleapis.com/auth/gmail.modify",
    "https://www.googleapis.com/auth/calendar",
    "https://www.googleapis.com/auth/documents",
    "https://www.googleapis.com/auth/presentations",
    "https://www.googleapis.com/auth/tasks",
    "https://www.googleapis.com/auth/pubsub",
    "https://www.googleapis.com/auth/cloud-platform"
  ],
  "status": "success"
}

I then tried an example...

$ gws drive files list --params '{"pageSize": 5}'
{
  "error": {
    "code": 401,
    "message": "Access denied. No credentials provided. Run `gws auth login` or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE to an OAuth credentials JSON file.",
    "reason": "authError"
  }
}

[bino98]

#151

There is a similar issue (although it is not yet resolved).

[mkagenius]

This helped me, how did they ship this.. guess they only used gloud flow.

---

gws auth export --unmasked > credentials.json

and then

export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/Users/manish/Work/credentials.json

Ah, I see the issue now! The gws auth export was necessary because of a bug/limitation in the GWS CLI:

The Problem:

1. Browser authentication (gws auth login) stores credentials in encrypted format
   (~/.config/gws/credentials.enc)
2. The GWS CLI cannot read its own encrypted credentials back properly
3. The CLI needs plain text credentials (client_id, client_secret, refresh_token) to actually make API
   calls

Why gws auth export --unmasked was needed:

This command decrypts and exports the credentials from the encrypted storage into a plain JSON file
that the CLI can actually use to authenticate API requests.

This IS a bug in GWS CLI:

You're correct that the documentation doesn't clearly explain this. The workflow should be:

1. gws auth login (browser auth) → stores encrypted credentials
2. CLI should automatically read encrypted credentials ← This step is broken
3. Instead, you need to manually export to plain text ← Workaround for the bug

The proper fix (that should work but doesn't):

The CLI should automatically decrypt and use ~/.config/gws/credentials.enc, but it doesn't. That's why
setting GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE to your exported credentials.json works.

You found a legitimate workaround for a bug in the GWS CLI! The encrypted credential storage isn't
being properly read by the CLI tool, which is why you needed to export to plain text.

[This-is-Prateek]

This helped me, how did they ship this.. guess they only used gloud flow.

gws auth export --unmasked > credentials.json

and then

export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/Users/manish/Work/credentials.json

Ah, I see the issue now! The gws auth export was necessary because of a bug/limitation in the GWS CLI:

The Problem:

1. Browser authentication (gws auth login) stores credentials in encrypted format
   (~/.config/gws/credentials.enc)
2. The GWS CLI cannot read its own encrypted credentials back properly
3. The CLI needs plain text credentials (client_id, client_secret, refresh_token) to actually make API
   calls

Why gws auth export --unmasked was needed:

This command decrypts and exports the credentials from the encrypted storage into a plain JSON file that the CLI can actually use to authenticate API requests.

This IS a bug in GWS CLI:

You're correct that the documentation doesn't clearly explain this. The workflow should be:

1. gws auth login (browser auth) → stores encrypted credentials
2. CLI should automatically read encrypted credentials ← This step is broken
3. Instead, you need to manually export to plain text ← Workaround for the bug

The proper fix (that should work but doesn't):

The CLI should automatically decrypt and use ~/.config/gws/credentials.enc, but it doesn't. That's why setting GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE to your exported credentials.json works.

You found a legitimate workaround for a bug in the GWS CLI! The encrypted credential storage isn't being properly read by the CLI tool, which is why you needed to export to plain text.

Thanks, this worked.

[srgfrancisco]

Had the same issue (v0.4.4, macOS). Notice your login output shows "account": "(unknown)": that's the clue.

The fix is to re-run login with the --account flag:

gws auth login --account my@email.com

Without --account, the CLI doesn't set a default account, so it can't resolve which credentials to use for API calls, even though the auth status shows everything as valid.

See also: #137 (same root cause)

[LittleBrainz]

Had the same issue (v0.4.4, macOS). Notice your login output shows "account": "(unknown)": that's the clue.

The fix is to re-run login with the --account flag:

gws auth login --account my@email.com

Without --account, the CLI doesn't set a default account, so it can't resolve which credentials to use for API calls, even though the auth status shows everything as valid.

See also: #137 (same root cause)

Yes, this works!

gws auth login --account my@email.com