All Google extensions share the same OAuth 2.0 setup. Complete these steps once — you can reuse the same Google Cloud project and credentials for every Google extension you install.
1

Create a Google Cloud Project

Go to Google Cloud Console and create a new project (or select an existing one).
  1. Click Select a project → New Project
  2. Give it a name (e.g. joy) and click Create
2

Create OAuth 2.0 Credentials

Go to Google Auth Platform → Clients and create a new client:
  1. Click Create client
  2. Set Application type to Web application
  3. Give it a name (e.g. joy)
  4. Under Authorized redirect URIs, click + Add URI and enter your instance’s callback, replacing your-host:
  5. Click Create and copy the Client ID and Client Secret shown
Google matches redirect URIs exactly — scheme, host, port, and path. A mismatch fails with redirect_uri_mismatch before the consent screen appears.
Joy’s product-auth flow receives the callback on a gateway HTTP route, so this must be your instance’s URL and the instance must be reachable there when you complete the flow. Google itself also supports loopback redirect URIs, but Joy has no listener for one — use the hosted callback above.
3

Add Test Users

Since the app is in Testing mode, only explicitly added users can authorize it. Go to Google Auth Platform → Audience, scroll down to Test users, and click + Add users.Add the Google account(s) that will use the extension. The app supports up to 100 test users before requiring verification.
Only test users can complete the OAuth flow while the app is in Testing mode. If you get an “access blocked” error, make sure your account is listed here.
4

Give Joy the Credentials

Store the client id, redirect URI, and client secret with joy config. Run these on the machine Joy runs on — over SSH if it’s a remote or hosted instance.
google.client_secret takes no value on the command line. It always prompts, with input hidden, so the secret never lands in your shell history or the process list. The client id and redirect URI are not secrets and are passed normally.
Confirm what was stored:
The same values can be supplied as environment variables when a service unit or container injects them from a secret manager:
Do not export the client secret by hand in an interactive shell. It persists in shell history and is visible to every child process. Use joy config set google.client_secret, which prompts with input hidden, or inject the variable from your platform’s secret manager.
5

Restart So the Change Takes Effect

joy config set never restarts anything — it writes the value and prints:
A running instance keeps serving the old configuration until you restart it. Google OAuth will keep failing until you do.
If you’re running joy serve in the foreground instead, stop it and start it again.
You’re ready to install any Google extension. Return to the extension page to complete the remaining steps.