*.googleapis.com. Authsome’s api_url is a regex (regex:.*googleapis.*).
At a glance
Prerequisites
You need to register an OAuth app with Google once. Create OAuth client credentials in the Google Cloud Console under APIs & Services. Pick “Desktop app” or “Web app” with the authsome callback URL. The redirect URI must be:Log in
http://127.0.0.1:7998 to collect your client_id and client_secret. They are encrypted in your vault and reused on every subsequent login. A second browser window then opens to https://accounts.google.com/o/oauth2/v2/auth for the authorization step.
Verify:
Headless setup
For SSH or CI environments, use the device code flow:Custom scopes
The bundled definition requestsopenid, profile. Override at login time:
authsome get google.
Multiple accounts
Pass--connection <name> on login and on every read command to keep two or more accounts on the same provider side by side. See Multiple connections per provider for the full pattern.
Use the token
Run the agent under the proxy (recommended).GOOGLE_ACCESS_TOKEN=authsome-proxy-managed in the child’s environment and injects the real token into outbound requests to regex:.*googleapis.*. The child process never sees the actual value. Refresh tokens are never exported.
Override the bundled definition
What’s next
Run agents with the proxy
Inject the access token into outbound requests without exposing it.
Multiple connections per provider
Keep two or more accounts on the same provider side by side.
OAuth providers
All bundled OAuth providers.