OAuth Setup

One-time setup for any Google extension in IronClaw

All Google extensions share the same OAuth 2.0 setup. Complete these steps once — you can reuse the same Google Cloud project and credentials for every Google extension you install.

---

1. Create a Google Cloud Project

   Go to Google Cloud Console and create a new project (or select an existing one).

   1. Click Select a project → New Project
   2. Give it a name (e.g. ironclaw) and click Create
2. Create OAuth 2.0 Credentials

   Go to Google Auth Platform → Clients and create a new client:

   1. Click Create client

   2. Set Application type to Web application

   3. Give it a name (e.g. ironclaw)

   4. Under Authorized redirect URIs, click + Add URI and enter your instance’s callback, replacing your-host:

      https://your-host/api/reborn/product-auth/oauth/google/callback
      

   5. Click Create and copy the Client ID and Client Secret shown

   Google matches redirect URIs exactly — scheme, host, port, and path. A mismatch fails with redirect_uri_mismatch before the consent screen appears.

   IronClaw’s product-auth flow receives the callback on a gateway HTTP route, so this must be your instance’s URL and the instance must be reachable there when you complete the flow. Google itself also supports loopback redirect URIs, but IronClaw has no listener for one — use the hosted callback above.

3. Add Test Users

   Since the app is in Testing mode, only explicitly added users can authorize it. Go to Google Auth Platform → Audience, scroll down to Test users, and click + Add users.

   Add the Google account(s) that will use the extension. The app supports up to 100 test users before requiring verification.

   Only test users can complete the OAuth flow while the app is in Testing mode. If you get an “access blocked” error, make sure your account is listed here.

4. Give IronClaw the Credentials

   Store the client id, redirect URI, and client secret with ironclaw config. Run these on the machine IronClaw runs on — over SSH if it’s a remote or hosted instance.

   ironclaw config set google.client_id <your-client-id>
   ironclaw config set google.redirect_uri https://<your-instance-host>/api/reborn/product-auth/oauth/google/callback
   ironclaw config set google.client_secret
   

   google.client_secret takes no value on the command line. It always prompts, with input hidden, so the secret never lands in your shell history or the process list. The client id and redirect URI are not secrets and are passed normally.

   Confirm what was stored:

   ironclaw config get google.client_id
   ironclaw config get google.redirect_uri
   

   The same values can be supplied as environment variables when a service unit or container injects them from a secret manager:

   IRONCLAW_REBORN_GOOGLE_CLIENT_ID
   IRONCLAW_REBORN_GOOGLE_CLIENT_SECRET
   IRONCLAW_REBORN_GOOGLE_OAUTH_REDIRECT_URI
   

   Do not export the client secret by hand in an interactive shell. It persists in shell history and is visible to every child process. Use ironclaw config set google.client_secret, which prompts with input hidden, or inject the variable from your platform’s secret manager.

5. Restart So the Change Takes Effect

   ironclaw config set never restarts anything — it writes the value and prints:

     to apply: ironclaw service restart
   

   A running instance keeps serving the old configuration until you restart it. Google OAuth will keep failing until you do.

   NEAR AI hosted instance

   ironclaw service commands do not work on a NEAR AI hosted instance — there is no user service manager for them to talk to, so service restart fails rather than restarting anything.

   SSH in only to run the ironclaw config commands, then restart the agent from the Agent Dashboard. That is the only way to restart a hosted instance.

   Self-hosted

   ironclaw service restart
   

   If you’re running ironclaw serve in the foreground instead, stop it and start it again.

You’re ready to install any Google extension. Return to the extension page to complete the remaining steps.