# Google Cloud Console OAuth Setup — Desktop App (Non-Workspace Account)

Reference guide for setting up Google OAuth credentials when the Google account is a **regular Gmail/work email WITHOUT Google Workspace org admin**.

---

## Step 1: Create Project

URL: https://console.cloud.google.com/projectselector2/home/dashboard

- Sign in with the account (e.g. `Michael.mcloughlin@lfcs.com.au`)
- Click **"Create Project"**
- Project name: e.g. `Hermes LFCS`
- **No organization** — select "No organization" from the org dropdown. This is correct when the account is not part of a Google Workspace (company) org. It just means the project lives under the personal/individual Google account.
- Click **Create**

---

## Step 2: Enable APIs

Go to: https://console.cloud.google.com/apis/library

Enable these (search each and click Enable):
- Gmail API
- Google Drive API
- Google Docs API
- Google Sheets API
- Google Calendar API
- People API (for contacts)

---

## Step 3: Create OAuth Credentials

Go to: https://console.cloud.google.com/apis/credentials

1. Click **"Create Credentials"** → **OAuth 2.0 Client ID**
2. Application type: **Desktop app** (NOT "Web application")
3. Click **Create** (or Next/Finish depending on screen)
4. If prompted with "Google Auth Platform not configured yet" → click **"Get started"** and fill in:
   - App name: `Hermes LFCS`
   - User support email: your work email
   - Then continue through the remaining steps
5. When asked **Internal or External** → choose **External**
   - External is correct when there is no Google Workspace org (No organization in Step 1). Internal is only available within a Google Workspace domain.
6. After creation: download the JSON file OR copy the Client ID and Client Secret

---

## Step 4: Get the JSON to Hermes

Downloaded file path will be something like:
`C:\Users\mclou\Downloads\client_secret_xxxx.apps.googleusercontent.com.json`

Send the **full file path** to Hermes. Hermes will run:
```bash
$GSETUP --client-secret /path/to/client_secret.json
```

---

## Key Decisions Table

| Question | Answer | Why |
|---|---|---|
| Organization | **No organization** | Account is not on Google Workspace org — no org to attach to |
| Application type | **Desktop app** | Hermes runs on a server/VPS, not a web browser |
| Internal or External | **External** | Only Internal works within a Workspace org; External works with any Gmail account |
| Test users | Add yourself as test user if app is "in Testing" mode | If `access_denied` error occurs on first auth, the account needs to be added as a test user in the Google Cloud console |

---

## Troubleshooting

| Error | Fix |
|---|---|
| `access_denied` on first auth attempt | App is in "Testing" mode — go to Google Cloud Console → APIs & Services → OAuth consent screen → Test users → Add users. Add the work email. |
| `HttpError 403: Access Not Configured` | APIs not enabled — go to API Library and enable each required API |
| "No organization" grayed out | Normal — just means the account is a personal Google account not on Workspace. Proceed with No organization. |