credential-manager

name	Credential Manager
description	Manage workspace credentials (Google OAuth accounts, service API keys) that skills use to call third-party services on the user's behalf. Primary flow for remote users over Slack: start-google-oauth returns a link the user clicks on their device; they sign in and paste the resulting JSON back, then complete-google-oauth saves the credential. Supports multi-account.
version	1.1.0
category	management
skillType	claude-skill
assignableRoles	["orchestrator"]
triggers	["add gmail account","add google account","add api key","list credentials","show credentials","what credentials","delete credential","revoke credential","connect google","connect gmail","read gmail","check unread emails","unread messages","my inbox"]
tags	["credentials","oauth","gmail","google","api-key"]
execution	{"type":"script","script":{"file":"execute.sh","interpreter":"bash","timeoutMs":30000}}

Credential Manager

Manages the workspace's credential store used by skills. Supports Google OAuth (multi-account) and API keys.

Credential values are never returned — only metadata (id, name, email, scopes). The actual tokens stay encrypted on disk and are only exposed to skills at execution time via per-slot env vars.

Primary flow: Remote user via Slack

The user is on Slack and cannot run terminal commands. Use this flow:

1. Start — return a sign-in link

bash execute.sh '{"action":"start-google-oauth"}'

Returns:

{
  "success": true,
  "authUrl": "https://accounts.google.com/o/oauth2/v2/auth?client_id=...&scope=...",
  "instructions": "Send authUrl to the user. They click it..."
}

Send the authUrl to the user. Tell them:

Please click this link, sign in with the Google account you want to add, then copy the entire JSON block shown on the success page and paste it back here.

The URL opens on their device (phone, laptop, whatever). Google shows the consent screen ("Google Workspace Extension for Gemini CLI wants to access..."). After they approve, they land on a page titled "Success! Credentials Ready" with a JSON block like:

{
  "refresh_token": "1//...",
  "scope": "...",
  "token_type": "Bearer",
  "access_token":