Credentials
Configure authentication for Google APIs.
Option A: GWS CLI (recommended for local development)
The GWS CLI stores credentials in your OS keyring. The MCP server reads them automatically.
cargo install google-workspace-cli
gws auth login
You can also export credentials to a file:
gws auth export --unmasked > credentials.json
{
"server": {
"credentials_file": "credentials.json",
"project_id": "my-project-123456"
}
}
Option B: Application Default Credentials
gcloud auth application-default login \
--scopes=https://www.googleapis.com/auth/drive,\
https://www.googleapis.com/auth/gmail.modify,\
https://www.googleapis.com/auth/calendar
Option C: Service account (recommended for production)
- Create a service account in Google Cloud Console > IAM & Admin > Service Accounts
- Download the JSON key file
- Enable the APIs you need under APIs & Services > Enabled APIs
- Share Drive folders or calendars with the service account email
- Reference in policy:
{
"server": {
"credentials_file": "/path/to/service-account-key.json"
}
}
Credential priority
| Priority | Source |
|---|---|
| 1 | GOOGLE_WORKSPACE_CLI_TOKEN env var |
| 2 | credentials_file in policy JSON |
| 3 | GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE env var |
| 4 | ~/.config/gws/credentials.json |
| 5 | gws auth export --unmasked (OS keyring) |
| 6 | GOOGLE_APPLICATION_CREDENTIALS env var |
| 7 | ~/.config/gcloud/application_default_credentials.json |
Quota project
When using OAuth2 user credentials, set the project ID for quota attribution:
{
"server": {
"project_id": "my-project-123456"
}
}