Connect Gmail to wdid

Private beta uses a user-provided Google Desktop OAuth client. You create the client in Google Cloud Console, paste the Client ID and Client Secret into wdid, then authorize in the browser. This is temporary until a first-party verified Google client ships.

1. Create a Google Cloud project

Open Google Cloud Console and create or select a project in your organization (or a personal project for dogfood).
Enable the Gmail APIfor that project (APIs & Services → Library → Gmail API → Enable).

2. Configure the OAuth consent screen

Open APIs & Services → OAuth consent screen.
For private beta, Internal (Google Workspace org) is simplest. External apps need test users listed and may show an unverified-app warning.
App name can be "wdid" or your team name. Privacy policy URL (when required): applib.dev/wdid/privacy.
Add the scope https://www.googleapis.com/auth/gmail.readonly (Gmail read-only). wdid does not request send or modify scopes.

3. Create a Desktop OAuth client

Open APIs & Services → Credentials → Create credentials → OAuth client ID.
Application type: Desktop app.
Copy the Client ID (ends with .apps.googleusercontent.com) and the Client Secret.
wdid still uses Proof Key for Code Exchange (PKCE) on an ephemeral 127.0.0.1 loopback callback, but Google Cloud Desktop clients usually also require the client secret for token exchange and refresh. Paste both values into wdid.

4. Connect from wdid

Open wdid → Sources (or Gmail settings on the collection).
Paste the Google Desktop Client ID and Client Secret, then save. The secret stays in desktop settings on this Mac (never written into your workspace folder).
Enable the Gmail source on the collection, then click Connect Gmail.
Authorize in the browser. wdid stores the refresh token encrypted on this Mac (never inside your workspace folder).

What wdid reads

With gmail.readonly, sync fetches your own mail activity for the date ranges you request. Evidence stays in the workspace folder you chose. See Privacy for what leaves your machine.

2. Configure the OAuth consent screen

Open APIs & Services → OAuth consent screen.

For private beta, Internal (Google Workspace org) is simplest. External apps need test users listed and may show an unverified-app warning.

App name can be "wdid" or your team name. Privacy policy URL (when required): applib.dev/wdid/privacy.

Add the scope https://www.googleapis.com/auth/gmail.readonly (Gmail read-only). wdid does not request send or modify scopes.

3. Create a Desktop OAuth client

Open APIs & Services → Credentials → Create credentials → OAuth client ID.

Application type: Desktop app.

Copy the Client ID (ends with .apps.googleusercontent.com) and the Client Secret.

wdid still uses Proof Key for Code Exchange (PKCE) on an ephemeral 127.0.0.1 loopback callback, but Google Cloud Desktop clients usually also require the client secret for token exchange and refresh. Paste both values into wdid.

4. Connect from wdid

Open wdid → Sources (or Gmail settings on the collection).

Paste the Google Desktop Client ID and Client Secret, then save. The secret stays in desktop settings on this Mac (never written into your workspace folder).

Enable the Gmail source on the collection, then click Connect Gmail.

Authorize in the browser. wdid stores the refresh token encrypted on this Mac (never inside your workspace folder).