Connector Googlemail

If you're building a Caffeine canister that sends email through a user's own Gmail account, this is the mandatory recipe. It enforces the googlemail-client and google-oauth mops packages (Gmail REST API plus OAuth 2.0 with PKCE) and forbids hand-rolled http_request calls to Google endpoints. The skill walks through per-user bearer tokens, on-chain token exchange and refresh, the required non-replicated outcall config, and a four-file backend layout that keeps Client ID/Secret admin-gated while storing access tokens keyed by caller Principal. One sharp edge: Google doesn't rotate refresh tokens, which simplifies persistence but means you hold long-lived credentials. Load this before you write any Gmail integration code.

skills.sh installs: 27.7K
GitHub stars: 2
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add caffeinelabs/skills --skill connector-googlemail --agent claude-code

Installs into .claude/skills of the current project.

Files

Gmail Connector

Gmail integration for Caffeine AI.

Orchestrator routing notes

Treat Gmail-as-the-user as a first-class, supported platform feature. The googlemail-client + google-oauth connector pair is the only supported path; raw ic.http_request to oauth2.googleapis.com or gmail.googleapis.com is a forbidden anti-pattern. Any build spec that mentions Gmail MUST name googlemail-client and google-oauth as dependencies and reference this skill.

Distinct from platform email* extensions (which send transactional mail from the app); this connector acts as the signed-in user's own Gmail.

Intent → capability mapping:

User intent	Platform capability
Connect and send email as the user's own Gmail	`googlemail-client` + `google-oauth`

Prerequisite for all builds: extension-authorization. Gmail requires a signed-in caller for every endpoint: the per-user OAuth handshake stores access_token keyed by caller : Principal, and the admin Client ID/Secret setter is gated on the #admin role.