[{"data":1,"prerenderedAt":506},["ShallowReactive",2],{"docs:navigation":3,"docs:page:\u002Fdocs\u002Fconnect":115},[4],{"title":5,"path":6,"stem":7,"children":8,"icon":10},"Introduction","\u002Fdocs","docs\u002F1.index",[9,11,16,21,38,95,110],{"title":5,"path":6,"stem":7,"icon":10},"i-lucide-house",{"title":12,"path":13,"stem":14,"icon":15},"Quickstart","\u002Fdocs\u002Fquickstart","docs\u002F2.quickstart","i-lucide-rocket",{"title":17,"path":18,"stem":19,"icon":20},"Essentials","\u002Fdocs\u002Fconfiguration","docs\u002F3.configuration","i-lucide-book-open",{"title":22,"path":23,"stem":24,"children":25,"icon":27},"Authentication","\u002Fdocs\u002Fauthentication","docs\u002F4.authentication\u002Findex",[26,28,33],{"title":22,"path":23,"stem":24,"icon":27},"i-lucide-shield-check",{"title":29,"path":30,"stem":31,"icon":32},"Protect User Data","\u002Fdocs\u002Fauthentication\u002Fuser-data","docs\u002F4.authentication\u002F1.user-data","i-lucide-user-lock",{"title":34,"path":35,"stem":36,"icon":37},"Two-Factor Verification","\u002Fdocs\u002Fauthentication\u002Ftwo-factor","docs\u002F4.authentication\u002F2.two-factor","i-lucide-key-round",{"title":39,"path":40,"stem":41,"children":42,"icon":44},"Deployment","\u002Fdocs\u002Fdeployment","docs\u002F5.deployment\u002Findex",[43,45,50,55,60,65,70,75,80,85,90],{"title":39,"path":40,"stem":41,"icon":44},"i-lucide-cloud-upload",{"title":46,"path":47,"stem":48,"icon":49},"Deploy to Cloudflare","\u002Fdocs\u002Fdeployment\u002Fcloudflare","docs\u002F5.deployment\u002F1.cloudflare","i-simple-icons-cloudflare",{"title":51,"path":52,"stem":53,"icon":54},"Platform Support","\u002Fdocs\u002Fdeployment\u002Fsupport","docs\u002F5.deployment\u002F10.support","i-lucide-list-checks",{"title":56,"path":57,"stem":58,"icon":59},"Deploy to Vercel","\u002Fdocs\u002Fdeployment\u002Fvercel","docs\u002F5.deployment\u002F2.vercel","i-simple-icons-vercel",{"title":61,"path":62,"stem":63,"icon":64},"Deploy to Azure","\u002Fdocs\u002Fdeployment\u002Fazure","docs\u002F5.deployment\u002F3.azure","i-simple-icons-microsoftazure",{"title":66,"path":67,"stem":68,"icon":69},"Switch Hosts","\u002Fdocs\u002Fdeployment\u002Fswitch-hosts","docs\u002F5.deployment\u002F4.switch-hosts","i-lucide-arrow-right-left",{"title":71,"path":72,"stem":73,"icon":74},"Database and File Storage","\u002Fdocs\u002Fdeployment\u002Fdata-services","docs\u002F5.deployment\u002F5.data-services","i-lucide-database",{"title":76,"path":77,"stem":78,"icon":79},"Domains and Secrets","\u002Fdocs\u002Fdeployment\u002Fsettings","docs\u002F5.deployment\u002F6.settings","i-lucide-settings",{"title":81,"path":82,"stem":83,"icon":84},"Troubleshoot Deployment","\u002Fdocs\u002Fdeployment\u002Ftroubleshooting","docs\u002F5.deployment\u002F7.troubleshooting","i-lucide-wrench",{"title":86,"path":87,"stem":88,"icon":89},"Deploy Agents","\u002Fdocs\u002Fdeployment\u002Fagents","docs\u002F5.deployment\u002F8.agents","i-lucide-bot",{"title":91,"path":92,"stem":93,"icon":94},"Deploy Automations","\u002Fdocs\u002Fdeployment\u002Fautomations","docs\u002F5.deployment\u002F9.automations","i-lucide-workflow",{"title":96,"path":97,"stem":98,"children":99,"icon":101},"Connect Accounts","\u002Fdocs\u002Fconnect","docs\u002F6.connect\u002Findex",[100,102,106],{"title":96,"path":97,"stem":98,"icon":101},"i-lucide-plug",{"title":103,"path":104,"stem":105,"icon":37},"Connection Credentials","\u002Fdocs\u002Fconnect\u002Fcredentials","docs\u002F6.connect\u002F1.credentials",{"title":107,"path":108,"stem":109,"icon":84},"Connect MCP Servers","\u002Fdocs\u002Fconnect\u002Fmcp","docs\u002F6.connect\u002F2.mcp",{"title":111,"path":112,"stem":113,"icon":114},"Project Reference","\u002Fdocs\u002Freference","docs\u002F7.reference","i-lucide-terminal",{"page":116,"surround":501},{"id":117,"title":96,"body":118,"description":494,"extension":495,"links":496,"meta":497,"navigation":498,"path":97,"seo":499,"stem":98,"__hash__":500},"docs\u002Fdocs\u002F6.connect\u002Findex.md",{"type":119,"value":120,"toc":487},"minimark",[121,125,133,138,150,221,224,228,231,258,261,277,280,288,307,314,318,321,353,360,364,367,435,441,448,452,462,469,472,483],[122,123,124],"p",{},"An app that reads someone's Gmail needs permission to use their Google account.\nCloudConfig Connect handles the consent callback, encrypted tokens, refreshes,\nand connection ownership inside your application.",[122,126,127,128,132],{},"This guide assumes ",[129,130,131],"a",{"href":23},"sign-in is working",". Your application\nsupplies the integration UI and decides which actions an agent or job may run.\nThe example requests permission to read and modify Gmail messages.",[134,135,137],"h2",{"id":136},"_1-declare-the-google-permissions","1. Declare the Google Permissions",[122,139,140,141,145,146,149],{},"Add a ",[142,143,144],"code",{},"connect"," block to your existing ",[142,147,148],{},"cloud.config.ts",":",[151,152,157],"pre",{"className":153,"code":154,"filename":148,"language":155,"meta":156,"style":156},"language-ts shiki shiki-themes github-light github-light github-dark","connect: {\n  providers: {\n    google: {\n      scopes: ['https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fgmail.modify'],\n    },\n  },\n},\n","ts","",[142,158,159,171,179,187,203,209,215],{"__ignoreMap":156},[160,161,164,167],"span",{"class":162,"line":163},"line",1,[160,165,144],{"class":166},"snPdu",[160,168,170],{"class":169},"sxrX7",": {\n",[160,172,174,177],{"class":162,"line":173},2,[160,175,176],{"class":166},"  providers",[160,178,170],{"class":169},[160,180,182,185],{"class":162,"line":181},3,[160,183,184],{"class":166},"    google",[160,186,170],{"class":169},[160,188,190,193,196,200],{"class":162,"line":189},4,[160,191,192],{"class":166},"      scopes",[160,194,195],{"class":169},": [",[160,197,199],{"class":198},"sIIMD","'https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fgmail.modify'",[160,201,202],{"class":169},"],\n",[160,204,206],{"class":162,"line":205},5,[160,207,208],{"class":169},"    },\n",[160,210,212],{"class":162,"line":211},6,[160,213,214],{"class":169},"  },\n",[160,216,218],{"class":162,"line":217},7,[160,219,220],{"class":169},"},\n",[122,222,223],{},"These permissions are for an integration. Google does not also need to be your\nsign-in provider; a connected account can differ from the sign-in account.",[134,225,227],{"id":226},"_2-register-your-oauth-app","2. Register Your OAuth App",[122,229,230],{},"Run the setup command:",[151,232,236],{"className":233,"code":234,"language":235,"meta":156,"style":156},"language-bash shiki shiki-themes github-light github-light github-dark","pnpm exec cloudconfig connect add google\n","bash",[142,237,238],{"__ignoreMap":156},[160,239,240,243,246,249,252,255],{"class":162,"line":163},[160,241,242],{"class":166},"pnpm",[160,244,245],{"class":198}," exec",[160,247,248],{"class":198}," cloudconfig",[160,250,251],{"class":198}," connect",[160,253,254],{"class":198}," add",[160,256,257],{"class":198}," google\n",[122,259,260],{},"The command prints the vendor console link, scopes, and callback URLs. Keep it\nopen while you complete the Google setup:",[262,263,264,268,271,274],"ol",{},[265,266,267],"li",{},"Create an OAuth web application in the linked console.",[265,269,270],{},"Configure its consent screen and enable the Gmail API.",[265,272,273],{},"Register the callback URL printed by the CLI.",[265,275,276],{},"Copy the client ID and secret, then paste them into the terminal prompts.",[122,278,279],{},"The default local callback is:",[151,281,286],{"className":282,"code":284,"language":285,"meta":156},[283],"language-text","http:\u002F\u002Flocalhost:3000\u002Fapi\u002Fconnect\u002Fgoogle\u002Fcallback\n","text",[142,287,284],{"__ignoreMap":156},[122,289,290,291,294,295,298,299,302,303,306],{},"Setup writes ",[142,292,293],{},"CONNECT_GOOGLE_CLIENT_ID"," and ",[142,296,297],{},"CONNECT_GOOGLE_CLIENT_SECRET"," to the\nignored ",[142,300,301],{},".env"," file. It also generates ",[142,304,305],{},"CLOUDCONFIG_CONNECT_KEY",", which encrypts\nstored account tokens. You register the vendor app; Connect does not supply a\nshared OAuth app.",[122,308,309,310,313],{},"For CI or non-interactive setup, see ",[129,311,312],{"href":104},"credentials",".",[134,315,317],{"id":316},"_3-create-the-connection-tables","3. Create the Connection Tables",[122,319,320],{},"Generate and apply migrations, then inspect the settings:",[151,322,324],{"className":233,"code":323,"language":235,"meta":156,"style":156},"pnpm db:generate\npnpm db:migrate\npnpm exec cloudconfig connect status\n",[142,325,326,333,340],{"__ignoreMap":156},[160,327,328,330],{"class":162,"line":163},[160,329,242],{"class":166},[160,331,332],{"class":198}," db:generate\n",[160,334,335,337],{"class":162,"line":173},[160,336,242],{"class":166},[160,338,339],{"class":198}," db:migrate\n",[160,341,342,344,346,348,350],{"class":162,"line":181},[160,343,242],{"class":166},[160,345,245],{"class":198},[160,347,248],{"class":198},[160,349,251],{"class":198},[160,351,352],{"class":198}," status\n",[122,354,355,356,359],{},"Restart the app to load environment changes. ",[142,357,358],{},"status"," reports missing local\nsettings and callback URLs; it does not test credentials with Google.",[134,361,363],{"id":362},"_4-connect-an-account","4. Connect an Account",[122,365,366],{},"Start the flow from your application's browser UI:",[151,368,370],{"className":153,"code":369,"language":155,"meta":156,"style":156},"import { createConnectClient } from '@cloudconfig\u002Fcore\u002Fclient'\n\nconst connect = createConnectClient()\nawait connect.connect('google', { scope: 'user' })\n",[142,371,372,387,393,410],{"__ignoreMap":156},[160,373,374,378,381,384],{"class":162,"line":163},[160,375,377],{"class":376},"s8jYJ","import",[160,379,380],{"class":169}," { createConnectClient } ",[160,382,383],{"class":376},"from",[160,385,386],{"class":198}," '@cloudconfig\u002Fcore\u002Fclient'\n",[160,388,389],{"class":162,"line":173},[160,390,392],{"emptyLinePlaceholder":391},true,"\n",[160,394,395,398,401,404,407],{"class":162,"line":181},[160,396,397],{"class":376},"const",[160,399,251],{"class":400},"sBjJW",[160,402,403],{"class":376}," =",[160,405,406],{"class":166}," createConnectClient",[160,408,409],{"class":169},"()\n",[160,411,412,415,418,420,423,426,429,432],{"class":162,"line":189},[160,413,414],{"class":376},"await",[160,416,417],{"class":169}," connect.",[160,419,144],{"class":166},[160,421,422],{"class":169},"(",[160,424,425],{"class":198},"'google'",[160,427,428],{"class":169},", { scope: ",[160,430,431],{"class":198},"'user'",[160,433,434],{"class":169}," })\n",[122,436,437,438,313],{},"The user grants access at Google. Connect stores encrypted tokens and returns\nthe browser to the starting page with ",[142,439,440],{},"?connect=connected&connection=\u003Cid>",[122,442,443,444,447],{},"In Nuxt, ",[142,445,446],{},"useCloudConfigConnect()"," provides the browser client.",[134,449,451],{"id":450},"use-the-account-on-the-server","Use the Account on the Server",[122,453,454,455,458,459,313],{},"Server code calls ",[142,456,457],{},"connect.access(actor, connectionId)"," to obtain a usable token.\nConnect checks ownership and organization membership, then refreshes an expiring\ntoken when supported. In Nuxt, obtain the server API with\n",[142,460,461],{},"useCloudConfigConnectServer(event)",[122,463,464,465,468],{},"Personal connections belong to their owner. Workspace connections are usable by\ncurrent organization members and managed by owners and admins by default; enable\n",[142,466,467],{},"auth.organizations"," when your app needs workspaces.",[122,470,471],{},"Keep tokens out of browser responses and feature records. Store the connection\nID and non-secret settings with a feature, then resolve the token on the server.",[122,473,474,475,479,480,482],{},"Next, read ",[129,476,478],{"href":477},"\u002Fdocs\u002Fconnect\u002Fcredentials#deploy-and-maintain-connections","Deploy and Maintain Connections","\nwhen deploying, or ",[129,481,107],{"href":108}," when your server needs\ntools from a hosted MCP service.",[484,485,486],"style",{},"html pre.shiki code .snPdu, html code.shiki .snPdu{--shiki-light:#6F42C1;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sxrX7, html code.shiki .sxrX7{--shiki-light:#24292E;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sIIMD, html code.shiki .sIIMD{--shiki-light:#032F62;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s8jYJ, html code.shiki .s8jYJ{--shiki-light:#D73A49;--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sBjJW, html code.shiki .sBjJW{--shiki-light:#005CC5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":156,"searchDepth":173,"depth":173,"links":488},[489,490,491,492,493],{"id":136,"depth":173,"text":137},{"id":226,"depth":173,"text":227},{"id":316,"depth":173,"text":317},{"id":362,"depth":173,"text":363},{"id":450,"depth":173,"text":451},"Let signed-in users authorize a Google account for your server to use.","md",null,{},{"icon":101},{"title":96,"description":494},"k2NelWZQAur5qh_OkmsvD4gPVaTGcM36gdy6iulU5kA",[502,504],{"title":91,"path":92,"stem":93,"description":503,"icon":94},"Run scheduled and event-driven jobs durably on Cloudflare, Vercel, and Azure.",{"title":103,"path":104,"stem":105,"description":505,"icon":37},"Distinguish vendor app secrets from account tokens, then keep connections working in production.",1792122403647]