Search all skrzynka documentation

Invocation#

text

skrzynka --organization <ID> account delegate --provider gmail --email <EMAIL> [--display-name <DISPLAY_NAME>]

Purpose#

Prove Workspace domain-wide delegated access for one address, persist its dedicated mailbox bundle in Skarbiec, and create or return the matching local mailbox.

Inputs and options#

Input or option	Required	Meaning
`--email <EMAIL>`	Yes	Active user address in a Workspace domain that granted Skrzynka's service-account client ID.
`--display-name <DISPLAY_NAME>`	No	Mailbox display name; defaults to the delegated address when a new mailbox is created.

Global options accepted on this path are --organization <ID> (required on every command except serve, version and onboarding; none is assumed), --skarbiec-bin <PATH> (default skarbiec) and --text (print results as path: value lines for people instead of JSON).

Output and state effect#

Mints a short-lived delegated token to prove access, writes or updates a deterministic oauth2_service_account bundle through skarbiec set-json, then returns the existing mailbox for that bundle or creates and prints a new Gmail mailbox. No provider token or service-account key is stored in SQLite.

Refusals#

Missing --email is refused by Clap with exit 2. GMAIL_PROFILE_INVALID: email is not a valid address.
GOOGLE_DELEGATION_NOT_GRANTED: The Workspace admin has not granted domain-wide delegation to this service account. Open <ADMIN_URL>, add client ID <CLIENT_ID> with scope https://mail.google.com/, then retry. Skrzynka never performs that grant: it exists only in the Workspace admin console and is an action an administrator takes there.
GOOGLE_DELEGATION_REJECTED: Google refused delegated access for <EMAIL>; verify the address is an active user in a Workspace domain that granted client ID <CLIENT_ID>.
GOOGLE_TOKEN_UNAVAILABLE names the delegated-token request and its transport cause. GMAIL_TOKEN_RESPONSE_INVALID names JSON decoding, observed HTTP status and underlying cause, or the rejected grant status. Refresh-token failures identify that distinct operation. These diagnostics do not print token response bodies, assertions or private keys.
Skarbiec validation/write failures are refused as SKARBIEC_ITEM_INVALID, SKARBIEC_UNAVAILABLE, SKARBIEC_TIMEOUT, or SKARBIEC_WRITE_FAILED; no local mailbox is created before the bundle is persisted.