gws-authlisted

# gws auth > **Note:** See the **gws-shared** skill for global flags and security rules. Manage authentication and credentials for the `gws` CLI. ## Auth Subcommands ```bash gws auth login # Interactive OAuth2 login (opens browser) gws auth logout # Remove stored credentials gws auth setup # Guided first-run setup wizard gws auth status # Show current auth state and active scopes gws auth export # Export credentials for use in other tools ``` ## Login Options ### Minimal scopes (default — safest for unverified apps) ```bash gws auth login ``` Default scopes: Drive, Sheets, Gmail, Calendar, Docs, Slides, Tasks. ### Full scopes (includes Pub/Sub and Cloud Platform) ```bash gws auth login --full ``` Adds `pubsub` and `cloud-platform` scopes. Requires a verified OAuth app or Workspace domain admin approval. ### Custom scopes ```bash gws auth login --scopes drive,gmail,sheets,pubsub ``` Unrecognized service names are resolved dynamically from Discovery docs. ### Read-only access ```bash gws auth login --readonly ``` Grants only `.readonly` scopes for all services. ## Credential Sources (Priority Order) 1. **`GOOGLE_WORKSPACE_CLI_TOKEN`** — Pre-obtained OAuth2 access token (highest priority) 2. **`GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE`** — Path to OAuth credentials JSON 3. **Encrypted credentials** — AES-256-GCM encrypted at `~/.config/gws/` 4. **`GOOGLE_APPLICATION_CREDENTIALS`** — Standard Google ADC (fallback) ## Service Account Sup