The most direct way to connect Google to OpenClaw is the @tensorfold/openclaw-google-workspace plugin. It uses one Google OAuth flow and lets you turn Gmail, Calendar, Drive, Contacts, Tasks and Sheets on or off individually. You create your own Google Cloud project and desktop OAuth client, store the client file locally, configure credentialsPath and tokenPath in openclaw.json, restart the OpenClaw gateway, then run the plugin’s begin-auth and complete-auth tools.
Antihost offers VPS plans with one-click OpenClaw, NVMe storage and a 14-day free trial.
OpenClaw never needs your Google password. OAuth grants only the scopes you approve, so begin with read-only access and add write permissions only when an automation genuinely needs to send mail, change events or edit files.
![Google Workspace Guide: Unlock Every Google App – Elevate Efficiency with Exclusive Tips, Time-Savers & Step-by-Step Screenshots for Quick Mastery [II EDITION]](https://m.media-amazon.com/images/I/41CX0AjJhAL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Which Google connection method should you use?
There are three practical paths, and they do not provide the same services.
| Path | Services documented | Authentication model | Important limitation |
|---|---|---|---|
| Google Workspace plugin | Gmail, Calendar, Drive, Contacts, Tasks and Sheets | One shared OAuth flow with per-service toggles | Drive and Sheets are read-only by default; Docs and Slides are not listed as separate services in this plugin |
| Direct-OAuth integration | Gmail, Calendar, Drive, Docs, Sheets and Slides | OAuth app and token handling supplied by that project | An OAuth app left in Google’s Testing status can cause refresh tokens to expire after seven days |
| Google Meet meeting plugin | Meet creation or joining, calendar lookup and selected Meet artifacts | Meet API or a signed-in Chrome profile | Meet is a separate plugin with additional scopes and browser or preview requirements for some features |
For most OpenClaw users who want Gmail, Calendar and Drive in one installation, start with the Workspace plugin. Choose the direct-OAuth route when Docs or Slides are essential and the project’s supported service list matches your needs. Install the Meet plugin separately when meeting creation, joining or Meet artifacts are the goal; installing the Workspace plugin alone does not add Meet.
What you need before starting
- An OpenClaw installation with permission to install plugins and restart its gateway.
- A Google account with access to the Workspace data you want OpenClaw to use.
- A Google Cloud project that you control. The documented setup requires APIs to be enabled in that project.
- A desktop OAuth client created in Google Cloud, with its downloaded JSON file available locally.
- A protected local directory for OAuth secrets, such as
~/.openclaw/secrets/. - A decision about which services need read-only access and which, if any, need write operations.
The Google Cloud project is not optional for the documented plugin setup. It is where you enable the APIs and create the OAuth client that represents your local OpenClaw installation.
Install the shared Google Workspace plugin
- Open OpenClaw’s plugin installer. Install the package named
@tensorfold/openclaw-google-workspace. Use the installer rather than copying plugin files manually so OpenClaw registers the package in its normal plugin configuration. - Check the installed plugin’s service settings. The plugin treats Gmail, Calendar, Drive, Contacts, Tasks and Sheets as toggleable services. Decide which toggles should be enabled before authorizing.
- Create the Google Cloud project and APIs. In Google Cloud, create a project dedicated to this integration or select an existing project you control. Enable only the APIs required by the services you selected. Enabling fewer APIs reduces the number of permissions and unused surfaces you must maintain.
- Create a desktop OAuth client. In the project’s credentials area, create an OAuth client for a desktop application and download the supplied JSON credentials file. Do not paste the client secret into chat, a public repository or a shared configuration file.
- Place the JSON file in a protected secrets directory. For example, rename it to
google-oauth.jsonand store it at~/.openclaw/secrets/google-oauth.json. Configure a different path for the token file, such as~/.openclaw/secrets/google-token.json, so the downloaded client credentials and the user’s refresh token are separate files. - Configure OpenClaw and restart the gateway. Add the credential path, token path and service enablement to
openclaw.json. Restart the gateway after saving the file; a running gateway will not necessarily reload plugin configuration automatically. - Run the OAuth flow. Invoke the plugin’s begin-auth tool to generate an authorization URL. Open that URL, sign in to Google, review the requested scopes and approve them. Copy the returned authorization code into the plugin’s complete-auth tool. The plugin then stores a refreshable token at the configured token path.
Configure Google Cloud correctly
Enable only the APIs you will use
Google separates many services into separate APIs. Enable the APIs corresponding to the OpenClaw toggles you actually plan to use, rather than turning on every Google API in the project. Gmail automations require the Gmail API; calendar operations require the Calendar API; Drive and Sheets operations require their respective APIs. Contacts and Tasks have their own service requirements.
If an API is not enabled, OAuth may still open successfully but the first operation can fail with an API-not-enabled or service-disabled error. Return to the same Google Cloud project, enable the missing API, wait for the change to propagate, and retry the operation.
Create the right OAuth client type
The documented setup calls for a desktop OAuth client. Do not substitute a web-server client unless the integration’s current documentation explicitly asks for one. Download the JSON file generated for that desktop client and keep the file intact; OpenClaw reads the client information from it.
Understand consent and testing status
Google’s OAuth consent configuration controls how long grants remain usable and who can authorize. The direct-OAuth project documents a specific warning: while its Google OAuth app remains in Testing status, refresh tokens expire after seven days. That behavior can interrupt a long-running OpenClaw deployment even when the user has not revoked access. Plan for Google’s consent and publishing requirements before relying on that route for unattended automation.
Set paths and service toggles in openclaw.json
The two paths must point to different local files: one for the downloaded OAuth client and one for the token OpenClaw receives after consent. A minimal configuration shape is:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems{
"credentialsPath": "~/.openclaw/secrets/google-oauth.json",
"tokenPath": "~/.openclaw/secrets/google-token.json",
"services": {
"gmail": { "enabled": true },
"calendar": { "enabled": true },
"drive": { "enabled": true },
"contacts": { "enabled": false },
"tasks": { "enabled": false },
"sheets": { "enabled": false }
}
}The service names and nesting must match the version of the plugin installed in your OpenClaw configuration. The important documented fields are credentialsPath, tokenPath and the per-service enablement settings. Keep both files outside a public web directory and apply restrictive local file permissions.
Rank #2
![The Google Workspace Bible: [14 in 1] The Ultimate All-in-One Guide from Beginner to Advanced | Including Gmail, Drive, Docs, Sheets, and Every Other App from the Suite](https://m.media-amazon.com/images/I/41AWmhmGFuL._SL160_.jpg)
- The Google Workspace Bible: [14 in 1] The Ultimate All in One Guide from Beginner to Advanced Including Gmail, Drive, Docs, Sheets, and Every Other App from the Suite
- ABIS BOOK
Choose read-only or write access deliberately
Drive and Sheets are documented as read-only by default. Gmail and Calendar defaults permit broader operations unless you change them. That default is not a reason to grant broad access everywhere: configure read-only scopes for inbox inspection, calendar lookup and file discovery, then request write scopes only for a specific task such as sending an email, modifying an event or editing a spreadsheet.
Changing a toggle or scope does not replace the OAuth grant already stored on disk. After expanding access, run authorization again so Google can show the new consent request. Existing grants are preserved through incremental authorization rather than being discarded and recreated from scratch.
Complete the authorization flow
1. Restart before authorizing
Restart the OpenClaw gateway after installing the plugin and saving openclaw.json. This loads the package, paths and service toggles in one consistent process.
2. Generate the authorization URL
Run the plugin’s begin-auth tool. It generates a Google authorization URL tied to the configured desktop client and enabled services. If the tool reports that it cannot find the client file, check the exact path, filename and permissions before trying again.
3. Review the consent screen
Sign in with the Google account whose mail, calendar or files OpenClaw should access. Read each requested scope. If a screen asks for write access that your intended workflow does not need, stop and adjust the service or scope configuration before approving.
4. Complete the returned code flow
After approval, Google returns an authorization code through the flow described by the plugin. Supply that code to the complete-auth tool. A successful completion writes the refreshable token to tokenPath; the gateway can then refresh access without asking for your password again.
5. Test one operation per enabled service
Start with low-risk reads: list a small set of messages, inspect one calendar range, or list a known Drive folder. Test Sheets, Contacts or Tasks separately if enabled. This isolates an API or scope problem instead of making a large automation fail with an ambiguous error.
Recommended Free Tools
What each service can access
| Service toggle | Use it for | Default or documented permission note |
|---|---|---|
| Gmail | Reading mail and, when authorized, sending or modifying messages | Broader operations are permitted by default unless you restrict scopes |
| Calendar | Reading schedules and, when authorized, changing events | Broader operations are permitted by default unless you restrict scopes |
| Drive | Finding and inspecting files | Read-only by default in the documented table |
| Contacts | Accessing Google contacts | Optional toggle; enable only if needed |
| Tasks | Reading or managing Google Tasks | Optional toggle; enable only if needed |
| Sheets | Reading spreadsheet data | Read-only by default in the documented table |
A Drive connection is not automatically a Docs or Slides editing connection. Files created with those Google editors may be discoverable through Drive, but the shared Workspace plugin’s documented service list does not add separate Docs or Slides controls.
Add another Google service later
- Enable the new service in
openclaw.jsonwithout disabling services that already work. - Confirm that the corresponding Google API is enabled in the same Cloud project.
- Restart the OpenClaw gateway so it loads the changed configuration.
- Run begin-auth again and approve only the incremental scopes displayed for the new service.
- Run complete-auth with the returned code and test a read operation before granting any write scope.
Incremental authorization is useful when an installation starts with Gmail and Calendar and later needs Drive, Contacts, Tasks or Sheets. Existing grants remain available while Google adds the newly approved scopes.
Connect Google Docs, Sheets and Slides through the direct-OAuth path
If separate Docs and Slides support is a requirement, the documented direct-OAuth alternative covers Gmail, Calendar, Drive, Docs, Sheets and Slides. It is a different integration, not an extra toggle in the shared Workspace plugin, so expect its own configuration and token handling.
Evaluate it on these points before switching:
- Service coverage: Docs and Slides are explicitly included, while the shared plugin focuses on Gmail, Calendar, Drive, Contacts, Tasks and Sheets.
- Token lifecycle: the project warns that Testing-status OAuth apps issue refresh tokens that expire after seven days.
- Consent administration: a long-lived or multi-user deployment must account for Google’s consent-screen and publishing rules.
- Scope minimization: request only the editor scopes required by the workflow; document editing is materially broader than reading a file list.
Do not assume that moving to the direct-OAuth project eliminates the need for a Google Cloud project or API enablement. Its OAuth app still depends on Google’s authorization model and the APIs for the services you call.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Google Meet is a separate integration
OpenClaw documents Google Meet as a separate meeting plugin. The Workspace plugin’s Gmail, Calendar and Drive toggles do not by themselves create or join Meet sessions.
Creation and joining
The Meet plugin can work through the Meet API or through a signed-in Chrome profile. The browser route is relevant when an operation depends on the same interactive Google session a human would use. Keep that Chrome profile signed in to the intended account and treat the profile directory as sensitive local data.
Calendar and Drive permissions
Calendar lookup requires the calendar.events.readonly scope. Exporting document bodies associated with Meet requires drive.meet.readonly. These are additional permissions to evaluate, not automatic consequences of enabling ordinary Calendar or Drive access.
Media, artifacts and preview features
Meet media and artifact functions can require additional Meet scopes. Some preview features also require enrollment in Google’s developer preview program. If a basic create-or-join operation works but recording, media or artifact retrieval does not, check the feature-specific scope and preview enrollment rather than reauthorizing unrelated Gmail permissions.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Security practices for OAuth tokens
- Never share the client JSON or token file. The token file represents the account grant and can allow continued access until revoked.
- Separate credentials and tokens. Keeping
google-oauth.jsonandgoogle-token.jsonat different paths makes rotation and incident response clearer. - Use the smallest scope set. Read-only inbox, calendar and file inspection usually needs less authority than sending, event editing or document modification.
- Limit local permissions. Store both files under the OpenClaw secrets directory with restrictive owner-only permissions where your operating system supports them.
- Revoke when retiring the integration. Remove the local token and revoke the grant from the Google account’s security settings if the machine is decommissioned or the automation is no longer trusted.
- Audit enabled toggles. An unused Contacts or Tasks toggle expands the integration’s surface without improving a Gmail-only workflow.
Troubleshooting common failures
OpenClaw cannot find the credentials file
Check that the path is absolute or uses the home-directory form supported by your OpenClaw installation, that the filename matches exactly, and that the gateway process can read the file. A file downloaded with a second extension such as google-oauth.json.json is a common cause.
Google reports that an API is disabled
Identify the service named in the error, enable that API in the same Google Cloud project used by the OAuth client, wait for propagation, restart the gateway and retry. Enabling an API in a different project does not fix a client issued by the first project.
Authorization succeeds but the first operation is denied
The account may lack access to the requested mailbox, calendar, folder or spreadsheet, or the grant may not include the operation’s scope. Test a simple read, inspect the enabled toggle and run incremental authorization if the operation needs a new scope.
The refresh token stops working after several days
If you are using the direct-OAuth alternative and its consent app is still in Testing status, the documented seven-day refresh-token expiry is the likely explanation. Move through Google’s consent and publishing process as appropriate for your deployment, then authorize again.
Free tools Windows power users keep installed
One-click scans. No signup required.
Meet works for joining but not for artifacts
Joining through the API or Chrome profile does not imply permission to retrieve media or artifacts. Check the additional Meet scopes, calendar.events.readonly for calendar lookup and drive.meet.readonly for document-body export. Preview-only features may also require developer-preview enrollment.
New services do not appear after editing the config
Restart the gateway, verify the service key matches the plugin version and run begin-auth again. Service additions require new consent; changing the JSON file alone does not update the existing token’s scopes.
A practical rollout plan
- Start with Gmail, Calendar or Drive read-only access, whichever provides immediate value.
- Test one harmless read from each enabled service.
- Record which automation, if any, needs a write operation and the exact scope it requires.
- Enable that write scope and reauthorize incrementally instead of granting every available permission.
- Add Contacts, Tasks or Sheets only when a concrete workflow needs them.
- Install the Meet plugin separately for meeting workflows and authorize its feature-specific scopes.
- Review token storage, local permissions and consent status before putting the gateway on a long-running machine.
This sequence keeps the first OAuth grant narrow, makes failures easier to diagnose and avoids giving an unattended OpenClaw instance more Google authority than its jobs require.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
