Google Calendar connector setup

This page is the setup half — creating the OAuth app Google Calendar needs in Google's own console and getting its client id and secret into this deployment. Authorising a connection afterwards is the Authenticate control on the plugin sheet, which is what actually sends you to Google.

1. Create the OAuth app in the Google Cloud console

1. Open the Google Cloud console and create a project (or pick an existing one) — this is your own project, not Botseon's.

2. Under Authorized redirect URIs, add the redirect URL from docs/connectors/README.md — with the quickstart's default BOTSEON_PUBLIC_URL, that is:

   http://127.0.0.1:3000/api/oauth/google-calendar/callback
   

3. Create it. Google shows you a client ID and a client secret once — copy both now.

2. Scopes

Request the narrowest pair that covers the tools this connector exposes (F-PLUG-1: minimum scopes per capability, read and write requested separately):

• https://www.googleapis.com/auth/calendar.readonly — read calendars and events; no writes.
• https://www.googleapis.com/auth/calendar.events — create, update and delete events on calendars the account can already write to.

3. Enter the app

One command, with the client secret on standard input — there is no flag that takes it and no environment variable that holds it (see docs/connectors/README.md):

printf %s "$CLIENT_SECRET" | botseon oauth-app set \
  --org <organisation id> --slug google-calendar \
  --client-id <the client ID from step 1> \
  --auth-url https://accounts.google.com/o/oauth2/v2/auth \
  --token-url https://oauth2.googleapis.com/token \
  --configured-by <your user id>

It stores the secret encrypted and prints the redirect URL from step 1 back, so you can check the two match. botseon oauth-app show --org <organisation id> --slug google-calendar says whether an app is configured and under which client id; nothing prints the secret back.

Never put either value in a bot's description, a memory, or anywhere else a model reads as ordinary text.