civic-google

---

name: civic-google

description: Use gog (Google CLI) without manual OAuth setup — Civic handles token management automatically

metadata: {"openclaw": {"requires": {"bins": ["gog"], "env": ["CIVIC_TOKEN"]}, "emoji": "🔑"}}

---

This skill describes the `@civic/openclaw-google` plugin, which lets agents use `gog` (the Google Workspace CLI) without the user having to create a Google Cloud project, configure OAuth credentials, or manage tokens. Civic acts as an OAuth proxy — it provides the OAuth client, stores tokens encrypted server-side, refreshes them automatically, and the plugin requests only the scope each command actually needs.

Privacy and security

Setup

1. Install the plugin:

```bash

openclaw plugins install @civic/openclaw-google

```

2. Install gog (the Google CLI):

```bash

brew install gog

```

3. Set your Civic API token in the gateway environment:

```bash

CIVIC_TOKEN=<your-token-from-app.civic.com>

```

Get your token from app.civic.com -> Settings -> API Keys.

4. Restart the gateway.

How it works

1. Agent calls `gog gmail search newer_than:1d`

2. Plugin intercepts the `exec` tool call via a `before_tool_call` hook

3. Plugin sends the command prefix to the Civic proxy for scope resolution

4. Proxy matches `gog gmail` -> `gmail.readonly` scope

5. If authorized: returns a short-lived access token, plugin sets `GOG_ACCESS_TOKEN` env var, `gog` runs

6. If not yet authorized: blocks the tool call and surfaces an auth URL for the user to consent

7. After first consent per scope, all future calls work automatically

Supported services and scope mapping

The plugin maps each `gog` subcommand to the narrowest OAuth scope required. Write operations get specific scopes; unrecognized subcommands fall back to read-only.

Gmail

Calendar

Drive

Docs

Sheets

Slides

Tasks

Contacts

Chat

Forms

Apps Script

Troubleshooting

Custom proxy URL

For local development, set `OPENCLAW_PROXY_URL` in the gateway environment:

OPENCLAW_PROXY_URL=http://localhost:3013/openclaw