google-tasks

Drive Google Tasks via curl + jq. The user's OAuth bearer token is in $GOOGLE_TASKS_TOKEN; every call needs it as Authorization: Bearer $GOOGLE_TASKS_TOKEN. At minimum the token carries tasks.readonly plus the identity scopes (openid email profile); if the user opted in to write at install time it also carries the broader tasks scope (read + write).

The Tasks API returns standard JSON; failures surface as {"error": {"code": 401|403|..., "message": "..."}} — show that error verbatim. 401 means the token expired (re-install). 403 insufficientPermissions on a write means the user only granted tasks.readonly — ask them to re-install with the read+write box checked.

Always start with users/@me/lists to discover which task lists the account has — the user's default plus any extras they created on calendar.google.com or in the Tasks app.