Connect Google

Kernl can read your Google Contacts, Calendar, Tasks and Gmail, and send mail from Gmail. To do that it signs in to Google with an OAuth client that you create in your own Google Cloud project. Your data goes from Google straight to your computer. Nothing passes through Kernl's servers.

It takes about ten minutes, once:

1. Create a Google Cloud project and turn on the APIs.
2. Set up the consent screen.
3. Create the OAuth client with Kernl's redirect URI.
4. Paste the ID and secret in Kernl and connect.

#Create a Google Cloud project

1. Go to console.cloud.google.com and sign in with the Google account you want to connect.
2. In the project picker at the top, click New project. Give it a name, for example Kernl, and click Create.
3. Make sure the new project is selected in the picker before you continue.

#Turn on the APIs

Google only answers the APIs you turn on in the project. In APIs & Services → Library, search for each one and click Enable:

Turn on only what you need. If Kernl later reports "… API has not been used in project … or it is disabled", that API is off: turn it on here and try again.

#Set up the consent screen

The consent screen is what Google shows when Kernl asks for access.

1. Go to APIs & Services → OAuth consent screen (in newer consoles, Google Auth Platform).
2. For User type, choose External. Fill in the app name (for example Kernl), your email as support email and as developer contact, and save.
3. In Audience (or Test users), add your own Google address.
4. Publish the app (Publish app → In production). While it stays in Testing, Google expires the connection every 7 days and you have to reconnect. Publishing does not make it public: only people with the client ID can use it. You don't need Google's verification for your own use.

#Create the OAuth client

1. Go to APIs & Services → Credentials and click Create credentials → OAuth client ID.
2. For Application type, choose Web application.
3. Under Authorized redirect URIs, click Add URI and paste the one for your install:

If you changed DASHBOARD_PORT, use that port instead. Kernl also shows the exact URI in Settings → Integrations, on the Google account card, with a Copy button.

4. Click Create. Google shows the Client ID (ending in .apps.googleusercontent.com) and the Client secret (starting with GOCSPX-). Keep that window open.

#Paste the ID and secret in Kernl

1. Open the dashboard. In the bar on the left, click System, then Settings in the tabs at the top, and Integrations in the settings list. You can also go straight to http://localhost:3086/settings?section=integrations.
2. In Integration keys, paste the client ID into Google OAuth Client ID and the secret into Google OAuth Client Secret.
3. Click Save. You don't need to restart Kernl.

#Connect your account

1. At the top of Settings → Integrations, the Google account card says Not connected. Click Connect Google.
2. Pick the Google account you added as a user on the consent screen.
3. If Google warns "Google hasn't verified this app", click Advanced and then Go to Kernl (unsafe). It is your own app: the warning only means Google didn't review it.
4. Allow the permissions Kernl asks for and click Continue.
5. Google sends you back to the same page. The card says Connected and shows your address.

Kernl starts syncing in the background. To use another Google account later, click Switch account on the card.

The Google account card arrives in the next Kernl release. Until then, connect from Mail: go to http://localhost:3086/mail/accounts, click + Add account, choose Gmail as the provider and click Connect Google →.

#Google Places key (optional)

Agents that look up businesses on Google Maps use a separate API key, not your account.

1. In the same Google Cloud project, turn on Places API (New) in the Library.
2. In Credentials, click Create credentials → API key. Then edit the key and, under API restrictions, allow only Places API (New).
3. In Kernl, paste it in Settings → Integrations → Integration keys → Google Places API key and click Save.

Google bills Places by use, with a monthly free allowance. Set a budget alert in Google Cloud if you want to cap it.

#If something fails

"Error 400: redirect_uri_mismatch": the redirect URI in Google Cloud doesn't match Kernl's character for character. Copy it from the Google account card and paste it in your OAuth client. Watch for https instead of http, a missing port or an extra / at the end.

"Access blocked: … has not completed the Google verification process": the account you picked is not on the consent screen's user list. Add it in Audience, or publish the app.

The card says Expired, or Kernl reports "Token has been expired or revoked": Google cut the connection. That happens every 7 days while the app is in Testing, and also when you change your password or remove Kernl's access in your Google account. Click Reconnect Google. To stop the weekly expiry, publish the app.

Docker: after allowing access you land on a page that doesn't load at localhost:3087: your Kernl is older than the release that answers on that port. Change 3087 to 3086 in the browser's address bar and press Enter. The connection still completes.

"… API has not been used in project … or it is disabled": turn that API on in APIs & Services → Library, wait a minute and try again.

"Google OAuth credentials are missing": the client ID or secret is empty. Go back to paste the ID and secret.