skrzynka account/authorize
Run loopback OAuth authorization for one Google identity: start a PKCE flow, serve the callback in the foreground, and exit after authorization is stored and its mailbox exists. The configured Desktop-app client must accept the requested loopback callback; see [Gmail connection](/docs/concept-gmail-connection).
Invocation#
skrzynka --organization <ID> account authorize --provider gmail --bind <SOCKET> --skarbiec-item <SKARBIEC_ITEM>Purpose#
Run loopback OAuth authorization for one Google identity: start a PKCE flow, serve the callback in the foreground, and exit after authorization is stored and its mailbox exists. The configured Desktop-app client must accept the requested loopback callback; see Gmail connection.
Inputs and options#
| Input or option | Required | Meaning |
|---|---|---|
--skarbiec-item <SKARBIEC_ITEM> | Yes | Skarbiec item holding the Google login identity to authorize. |
--bind <SOCKET> | Yes | Loopback socket serving the callback. The callback base URL is http://<SOCKET>, so this value must match a redirect URI the OAuth client accepts. No address is assumed; missing it exits 2. |
Global options accepted on this path are --organization <ID> (required on every command except serve, version and onboarding; none is assumed), --skarbiec-bin <PATH> (default skarbiec) and --text (print results as path: value lines for people instead of JSON).
Output and state effect#
Binds the loopback listener, prints the flow's flow_id and Google authorization_url, then waits until Google's callback settles the flow; the flow has no lifetime of Skrzynka's own, so stopping the command (Ctrl-C) is what abandons it. On completed it prints the flow status including the created or reused mailbox and exits 0; the durable authorization is written to a dedicated skrzynka-gmail-* Skarbiec bundle, never to SQLite.
Refusals#
NON_LOOPBACK_BIND_REFUSED:Skrzynka listens only on loopback addresses; <SOCKET> is not one.INTERNAL_ERROR:loopback OAuth callback address could not be boundwhen the requested socket is occupied.GMAIL_OAUTH_REDIRECT_NOT_REGISTERED:the OAuth client <CLIENT_ID> has no loopback redirect URI registered, so Google refused this authorization with redirect_uri_mismatch before showing any consent screen; it was presented <REDIRECT_URI>. Register a loopback redirect URI for that client in the Google Cloud Console, or issue a Desktop app client which accepts any loopback port, and retry. Google refuses inside the browser, so nothing would ever reach the listener; the command asks Google before it starts waiting and reports this cause instead.GMAIL_OAUTH_FAILED:<CODE>: <MESSAGE>, repeating the failed flow's own normalized code and sentence for every other failure.- A client with no loopback redirect URI registered cannot complete this command; create a Desktop-app client with a registered loopback redirect URI first. See Gmail connection.