# Local Auth Setup (CE Workspace)

## How to call gws

**Always use `gws-auth` instead of `gws` directly.** The wrapper auto-refreshes the OAuth token.

```bash
# ✅ Correct
gws-auth drive files list --params '{"pageSize": 10}'

# ❌ Wrong — will get 401
gws drive files list --params '{"pageSize": 10}'
```

## Account
- **Authenticated as:** kitt@curiousendeavor.com
- **OAuth project:** clawdbot-permissions
- **Credentials:** `/root/.openclaw/workspace/google-auth/credentials.json`
- **Token:** `/root/.openclaw/workspace/google-auth/token.json`

## Available Scopes
- ✅ Calendar (read/write)
- ✅ Gmail (read + send)
- ✅ Drive (read/write)
- ✅ Presentations (read/write)
- ❌ Tasks (needs scope expansion)
- ❌ Sheets (API not enabled in GCP project — needs `sheets.googleapis.com` enabled)
- ❌ Docs (API likely not enabled — needs `docs.googleapis.com` enabled)

## Sub-Agent Usage
When spawning sub-agents that need Google access, include in the brief:
```
Use `gws-auth` (not `gws`) for all Google Workspace commands.
```