Google Workspace — how to connect

The plugin ships one node type, Google/Account: a node whose content is your Google OAuth connection and whose page shows your upcoming calendar, latest unread mail and recent Drive files — read-only. Getting the plugin puts a My Google node in your own space; that copy is yours to configure and nobody else can read it.

1. Create your OAuth client (console.cloud.google.com, ~5 minutes)

Create or pick a project.
APIs & Services ▸ Library — enable Google Calendar API, Gmail API and Google Drive API (each is one click; a section 403s later if its API is missing).
APIs & Services ▸ OAuth consent screen — External, fill the two required fields, and add yourself as a test user. (In test mode the consent — and with it the refresh token — expires after 7 days; publish the app to make grants long-lived.)
Credentials ▸ Create credentials ▸ OAuth client ID ▸ Web application. Under Authorized redirect URIs add the authorize page's URL — open /api/content/Google/content/authorize.html on your mesh and copy the URL it displays at the top.

2. Configure your node

Open your My Google node. Until it is connected, its page IS the connect form:

Setting	Value	How it is entered
`clientId`	the client id (`….apps.googleusercontent.com`)	typed into the form; saved as you leave the field
`clientSecret`	the client secret	🔑 Enter secret or code opens a masked dialog; paste it and press Save

The client id is bound straight to the node — there is no Save button for it, and nothing you did not touch is ever rewritten. The secrets are not: they are write-only, so they go through their own dialog, which has a field each for the client secret, the authorization code and the refresh token. Fill only what you have; a blank field keeps the stored value rather than wiping it.

On the node's Edit view: redirectUri (the authorize page's exact URL — the same value you registered in step 1.4), and optionally days (calendar window, default 7, clamped 1–31) and limit (rows per section, default 10, clamped 1–25).

The node's page now shows Sign in with Google — the link opens the shipped authorize page, which sends you to Google's consent screen (the three read-only scopes) and comes back with a one-time code. Paste it into the form's secrets dialog (🔑 Enter secret or code → Authorization code); the next render exchanges it and shows your refresh token. The form is gone at that point — the page has moved on to the token hand-over — so store the token the way the hand-over card says: in the node's refreshToken setting on its Edit view, clearing authCode there too (codes are single-use and expire in minutes). From then on every Refresh signs in silently. (The dialog's Refresh token field is for the other route: pasting a token you already hold, to skip the consent, while the form is still showing.)

What renders

📅 Calendar — your primary calendar's next days days: all-day events on their date (a calendar fact, never shifted), timed events in your time zone; cancelled events struck through.
✉️ Unread mail — the latest unread subjects and senders. Headers only: the plugin fetches message metadata, never bodies, and shows at most five header rows per refresh.
📁 Drive — your most recently modified files, each linked into Drive.

Each section fails alone: a disabled API names itself (and where to enable it), a revoked grant says to re-authorize, and the other sections keep rendering.

Security, by design

Read-only scopes. calendar.readonly, gmail.readonly, drive.metadata.readonly — Google's consent screen shows exactly this, and the plugin cannot send, delete or modify.
Your own OAuth client. The grant answers to a client you control; no shared credential exists anywhere.
Secrets render only as masks — ···· plus the last four characters. The one surface that contains the real values is the node's own Edit view (that is how you set them), protected by your space's access control: keep the node in your own space.
Revocation is instant: myaccount.google.com/permissions kills the refresh token; deleting the OAuth client in the console kills everything.

What the mesh calls