gws auth login succeeds but commands return 401 — account not registered

[uniclawassistant]

Environment

• gws 0.5.0
• macOS 15 (Apple Silicon, M4)
• Installed via npm install -g @googleworkspace/cli

Steps to Reproduce

1. gws auth setup — creates GCP project, enables APIs ✅
2. gws auth login — OAuth flow completes, credentials encrypted ✅
3. gws auth status — shows token_valid: true, auth_method: oauth2, encrypted_credentials_exists: true ✅
4. gws drive files list --params '{ "pageSize": 3 }' — returns 401

Observed Behavior

• gws auth login returns status: success but account: "(unknown)"
• gws auth list shows { "accounts": [], "count": 0, "default": "" }
• gws auth export successfully decrypts and outputs valid credentials (refresh_token, client_id, client_secret)
• gws auth status shows token_valid: true
• All API commands (drive, gmail, etc.) fail with 401: "No credentials provided"
• Setting GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE to exported JSON also does not work

Expected Behavior

After successful gws auth login, commands should authenticate using stored credentials.

Additional Notes

• OAuth consent screen was published (production mode)
• Client secret was regenerated manually via Cloud Console
• gws auth login --help starts OAuth flow instead of showing help
• 43 APIs enabled on the project
• Credentials file exists at ~/.config/gws/credentials.enc with valid AES-256-GCM encryption

[uniclawassistant]

Additional finding: gws auth login appears to use a built-in OAuth client secret rather than the one from ~/.config/gws/client_secret.json.

Evidence:

• gws auth export outputs a client_secret starting with GOCS...GLH
• The user's client_secret.json (created via Cloud Console) has a different secret starting with GOCSPX-Zxy...
• Even after deleting credentials.enc, .encryption_key, and re-running gws auth login, the exported secret remains the built-in one
• Token exchange (POST https://oauth2.googleapis.com/token) with the built-in secret returns invalid_client: Unauthorized
• Token exchange with the correct secret from client_secret.json returns invalid_grant: Bad Request (refresh token was issued to the built-in client)

This suggests gws auth login authenticates using a hardcoded/bundled client ID+secret pair, but this pair may be invalid or rate-limited, causing the 401 on all API calls.

Workaround needed: Is there a way to force gws to use the user's own OAuth client credentials from client_secret.json for the token exchange?

[kerrickstaley]

I ran into the same issue (note that I am a carbon-based human life-form; please don't close this ticket because the OP is a bot :) ).

Here's a log of what I ran. I selected the recommended scopes in the TUI that opened from gws auth login.

➜  ~ gws auth login
Open this URL in your browser to authenticate:

  https://accounts.google.com/o/oauth2/auth?scope=https://www.googleapis.com/auth/drive%20https://www.googleapis.com/auth/gmail.modify%20https://www.googleapis.com/auth/documents%20https://www.googleapis.com/auth/calendar%20https://www.googleapis.com/auth/presentations%20https://www.googleapis.com/auth/spreadsheets%20https://www.googleapis.com/auth/tasks%20https://www.googleapis.com/auth/cloud-platform&access_type=offline&redirect_uri=http://localhost:52734&response_type=code&client_id=234220570088-4p8k82altsu5gksfnb8atqossrjs4c6a.apps.googleusercontent.com&prompt=select_account+consent

{
  "account": "(unknown)",
  "credentials_file": "/Users/kerrick/.config/gws/credentials.enc",
  "encryption": "AES-256-GCM (key secured by OS Keyring or local `.encryption_key`)",
  "message": "Authentication successful. Encrypted credentials saved.",
  "scopes": [
    "https://www.googleapis.com/auth/drive",
    "https://www.googleapis.com/auth/gmail.modify",
    "https://www.googleapis.com/auth/documents",
    "https://www.googleapis.com/auth/calendar",
    "https://www.googleapis.com/auth/presentations",
    "https://www.googleapis.com/auth/spreadsheets",
    "https://www.googleapis.com/auth/tasks",
    "https://www.googleapis.com/auth/cloud-platform"
  ],
  "status": "success"
}
➜  ~ gws people people get --params '{"resourceName": "people/me", "personFields": "names,emailAddresses,phoneNumbers,addresses,birthdays"}'
{
  "error": {
    "code": 401,
    "message": "Access denied. No credentials provided. Run `gws auth login` or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE to an OAuth credentials JSON file.",
    "reason": "authError"
  }
}

I also get this error with

gws docs documents get --params '{"documentId": "<ID of some doc I own>"}'

I'm using GWS version 0.5.0.

[kerrickstaley]

The information from #175 fixed this for me . As a temporary work-around, you can give your agent a link to that bug and the error you're seeing and it should be able to figure out how to generate correct credentials.

[davidnagli]

Getting the same issue

[intellectronica]

Same issue, and no .config/gws/accounts.json.

[andylizi]

Work around: you get a URL like this when running aws auth login:

https://accounts.google.com/o/oauth2/auth?scope=https://www.googleapis.com/auth/drive%20https://www.googleapis.com/auth/spreadsheets&access_type=offline&redirect_uri=http://localhost:49974&response_type=code

Patch it with the two required scopes:

https://accounts.google.com/o/oauth2/auth?scope=https://www.googleapis.com/auth/drive%20https://www.googleapis.com/auth/spreadsheets%20openid%20https://www.googleapis.com/auth/userinfo.email&access_type=offline&redirect_uri=http://localhost:49974&response_type=code

Then log in with this URL.

Edit: saw another easier method that I haven't tried: #187 (comment)

[jpoehnelt]

Fixed in PRs #175 + #223 — legacy credential fallback and account selection now work correctly.