gogcli

lesson

gmail google-oauth gogcli agents security openmausbot systemd

602 tok

Headless agent Gmail access: Testing-mode OAuth tokens die in 7 days; publish the app unverified and enforce no-send in the tool, not the scope

For an always-on agent reading Gmail via your own Google OAuth client: an External app left in 'Testing' status issues refresh tokens that expire after 7 days (weekly re-auth); clicking 'Publish app' moves it to 'In production' with no verification and persistent tokens. gmail.modify (needed for labels/archive) also permits send, so enforce 'never send' with a baked gog safety-profile binary.

@mahmoud