Give the user's agents their Google account through gog (Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, Tasks). Do every step yourself in Chrome AI with the dev-browser skill; the user only chooses their account and clicks "Allow" in Google's pages. Talk to the user in their language, short messages, no jargon (never say "OAuth", "client secret", "scope" or "token" to them; say "Google access" and "the key").

If you got this skill from a link instead of a local folder, install nothing else from the repo: download scripts/gog-oauth.sh with curl -fsSL https://raw.githubusercontent.com/Melvynx/ai-maxxing-skills/main/skills/connect-google/scripts/gog-oauth.sh -o <scratch>/gog-oauth.sh, and read another skill it names only when you reach it, from https://raw.githubusercontent.com/Melvynx/ai-maxxing-skills/main/skills/<skill-name>/SKILL.md.

Never print, log or repeat the key's secret, a sign-in code or anything gog keeps in the Keychain. Browser scripts that read the secret write it straight to a file with writeFile and log only { saved: true }. Ask the user before you tick a Google terms box or publish the app (steps 3 and 6), once for both.

Check the tools. chrome-ai start and dev-browser --help must answer (otherwise run setup-dev-browser). gog auth setup --help must answer: if gog is missing or too old to know auth setup, install it. On macOS: brew trust --formula openclaw/tap/gogcli && brew install openclaw/tap/gogcli (if an older gog from steipete/tap is there, brew uninstall gogcli first; the accounts it saved stay). On Linux: the linux_<arch> archive from https://github.com/openclaw/gogcli/releases, checked against its checksums.txt, then gog in ~/.local/bin. Then jq --version.
Pick the account: the argument, or the Google account signed in to Chrome AI (open https://myaccount.google.com in a page named connect-google and read the email). If Chrome AI is not signed in to Google, ask the user to sign in there and say "done". If gog auth list --check --json --no-input already lists that email, skip to step 9.
If gog auth credentials list --json --no-input already lists a client, skip to step 8. Otherwise find or create the Google Cloud project, in the page connect-google. Open https://console.cloud.google.com/cloud-resource-manager and look for a project named gog CLI: reuse its ID. If there is none, open https://console.cloud.google.com/projectcreate, name it gog CLI, create it, wait for the notification, and read its ID (the project= part of the address once it opens). On a first visit, Google Cloud asks for a country and its terms: ask the user before you accept. Read each page with snapshotForAI() before clicking: the console speaks the user's language and moves its buttons.
Turn on the Google services: open https://console.cloud.google.com/flows/enableapi?apiid=gmail.googleapis.com,calendar-json.googleapis.com,drive.googleapis.com,docs.googleapis.com,sheets.googleapis.com,slides.googleapis.com,people.googleapis.com,tasks.googleapis.com&project=<id> and confirm. Wait until the page says they are on.
Set up the sign-in screen: open https://console.cloud.google.com/auth/overview?project=<id>. If it offers to get started, fill: app name gog CLI, support email = the account, audience External, contact email = the account, tick the Google API Services User Data Policy box, then create. If it is already set up, keep it as it is.
Keep the access for good: open https://console.cloud.google.com/auth/audience?project=<id>. If the status is "Testing", click "Publish app" and confirm. A Testing app loses Google access every 7 days; published, it keeps it (Google does not review a personal app, it only shows a warning when signing in).

Create the key: open https://console.cloud.google.com/auth/clients/create?project=<id>, type Desktop app, name gog CLI, create. In the same browser script, read the client ID and the secret from the dialog that opens and save them without logging them:

await writeFile("gog-client.json", JSON.stringify({ installed: { client_id, client_secret, auth_uri: "https://accounts.google.com/o/oauth2/auth", token_uri: "https://oauth2.googleapis.com/token", redirect_uris: ["http://localhost"] } }));
console.log(JSON.stringify({ saved: true, client_id_end: client_id.slice(-30) }));