googleworkspace/cli

gws One CLI for all of Google Workspace — built for humans and AI agents. Drive, Gmail, Calendar, and every Workspace API. Zero boilerplate. Structured JSON output. 40+ agent skills included. Note This is not an officially supported Google product. ⬇️ Download the latest release for your OS gws doesn't ship a static list of commands. It reads Google's own Discovery Service at runtime and builds its entire command surface dynamically. When Google Workspace adds an API endpoint or method, gws picks it up automatically. Important This project is under active development. Expect breaking changes as we march toward v1.0. Contents Prerequisites Installation Quick Start Why gws? Authentication AI Agent Skills Advanced Usage Environment Variables Exit Codes Architecture Troubleshooting Development Prerequisites Node.js 18+ — for npm install (or download a pre-built binary from GitHub Releases ) A Google Cloud project — required for OAuth credentials. You can create one via the Google Cloud Console or with the gcloud CLI or with the gws auth setup command. A Google account with access to Google Workspace Installation The recommended way to install gws is to download the pre-built binary for your OS and architecture from the GitHub Releases page. Extract the archive and place the gws binary in your $PATH . For convenience, you can also use npm to automate downloading the appropriate binary from GitHub Releases: npm install -g @googleworkspace/cli Or build from source: cargo install --git https://github.com/googleworkspace/cli --locked A Nix flake is also available at github:googleworkspace/cli nix run github:googleworkspace/cli On macOS and Linux, you can also install via Homebrew : brew install googleworkspace-cli Quick Start gws auth setup # walks you through Google Cloud project config gws auth login # subsequent OAuth login gws drive files list --params ' {"pageSize": 5} ' Why gws? For humans — stop writing curl calls against REST docs. gws gives you --help on every resource, --dry-run to preview requests, and auto‑pagination. For AI agents — every response is structured JSON. Pair it with the included agent skills and your LLM can manage Workspace without custom tooling. # List the 10 most recent files gws drive files list --params ' {"pageSize": 10} ' # Create a spreadsheet gws sheets spreadsheets create --json ' {"properties": {"title": "Q1 Budget"}} ' # Send a Chat message gws chat spaces messages create \ --params ' {"parent": "spaces/xyz"} ' \ --json ' {"text": "Deploy complete."} ' \ --dry-run # Introspect any method's request/response schema gws schema drive.files.list # Stream paginated results as NDJSON gws drive files list --params ' {"pageSize": 100} ' --page-all | jq -r ' .files[].name ' Authentication The CLI supports multiple auth workflows so it works on your laptop, in CI, and on a server. Which setup should I use? I have… Use gcloud installed and authenticated gws auth setup (fastest) A GCP project but no gcloud Manual OAuth setup An existing OAuth access token GOOGLE_WORKSPACE_CLI_TOKEN Existing Credentials GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE Interactive (local desktop) Credentials are encrypted at rest (AES-256-GCM) with the key stored in your OS keyring (or ~/.config/gws/.encryption_key when GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file ). gws auth setup # one-time: creates a Cloud project, enables APIs, logs you in gws auth login # subsequent scope selection and login gws auth setup requires the gcloud CLI . If you don't have gcloud , use the manual setup below instead. Warning Scope limits in testing mode: If your OAuth app is unverified (testing mode), Google limits consent to ~25 scopes. The recommended scope preset includes 85+ scopes and will fail for unverified apps (especially for @gmail.com accounts). Choose individual services instead to filter the scope picker: gws auth login -s drive,gmail,sheets Manual OAuth setup (Google Cloud Console) Use this when gws auth setup cannot automate project/client creation, or when you want explicit control. Open Google Cloud Console in the target project: OAuth consent screen: https://console.cloud.google.com/apis/credentials/consent?project=<PROJECT_ID> Credentials: https://console.cloud.google.com/apis/credentials?project=<PROJECT_ID> Configure OAuth branding/audience if prompted: App type: External (testing mode is fine) Add your account under Test users Create an OAuth client: Type: Desktop app Download the client JSON and save it to: ~/.config/gws/client_secret.json Important You must add yourself as a test user. In the OAuth consent screen, click Test users → Add users and enter your Google account email. Without this, login will fail with a generic "Access blocked" error. Then run: gws auth login Browser-assisted auth (human or agent) You can complete OAuth either manually or with browser automation. Human flow : run gws auth login , open the printed URL, approve scopes. Agent-assisted flow : the agent opens the URL, selects account, handles consent prompts, and returns control once the localhost callback succeeds. If consent shows "Google hasn't verified this app" (testing mode), click Continue . If scope checkboxes appear, select required scopes (or Select all ) before continuing. Headless / CI (export flow) Complete interactive auth on a machine with a browser. Export credentials: gws auth export --unmasked > credentials.json On the headless machine: export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/credentials.json gws drive files list # just works Service Account (server-to-server) Point to your key file; no login needed. export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/service-account.json gws drive files list Pre-obtained Access Token Useful when another tool (e.g. gcloud ) already mints tokens for your environment. export GOOGLE_WORKSPACE_CLI_TOKEN= $( gcloud auth print-access-token ) Precedence Priority Source Set via 1 Access token GOOGLE_WORKSPACE_CLI_TOKEN 2 Credentials file GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE 3 Encrypted credentials gws auth login 4 Plaintext credentials ~/.config/gws/credentials.json Environment variables can also live in a .env file. AI Agent Skills The repo ships 100+ Agent Skills ( SKILL.md files) — one for every supported API, plus higher-level helpers for common workflows and 50 curated recipes for Gmail, Drive, Docs, Calendar, and Sheets. See the full Skills Index for the complete list. # Install all skills at once npx skills add https://github.com/googleworkspace/cli # Or pick only what you need npx skills add https://github.com/googleworkspace/cli/tree/main/skills/gws-drive npx skills add https://github.com/googleworkspace/cli/tree/main/skills/gws-gmail OpenClaw setup # Symlink all skills (stays in sync with repo) ln -s $( pwd ) /skills/gws- * ~ /.openclaw/skills/ # Or copy specific skills cp -r skills/gws-drive skills/gws-gmail ~ /.openclaw/skills/ The gws-shared skill includes an install block so OpenClaw auto-installs the CLI via npm if gws isn't on PATH. Gemini CLI Extension Authenticate the CLI first: gws auth setup Install the extension into the Gemini CLI: gemini extensions install https://github.com/googleworkspace/cli Installing this extension gives your Gemini CLI agent direct access to all gws commands and Google Workspace agent skills. Because gws handles its own authentication securely, you simply need to authenticate your terminal once prior to using the agent, and the extension will automatically inherit your credentials. Advanced Usage Multipart Uploads gws drive files create --json ' {"name": "report.pdf"} ' --upload ./report.pdf Pagination Flag Description Default --page-all Auto-paginate, one JSON line per page (NDJSON) off --page-limit <N> Max pages to fetch 10 --page-delay <MS> Delay between pages 100 ms Google Sheets — Shell Escaping Sheets ranges use ! which bash interprets as history expansion.