Skip to main content

Accounts And Authorisation

Accounts let selected tools act through services such as GitHub, Google, or X. A model provider account supplies models; an integration account supplies service access. They are configured separately.

Each account is an app in Settings › Apps: GitHub, Google and X. On the app's page the account is a Built in way to connect, and it is set up in its own settings, which show only that account.

Connect Safely​

  1. Open Settings › Apps and choose the app, or type "connect google", "connect github" or "connect x" in the command palette.
  2. On the app's page, choose Set up (or Open once it is set up). The account's own settings open with a numbered setup guide; each step links to the page it needs, and finished steps are ticked.
  3. Prefer the supported OAuth or local CLI flow rather than pasting broad tokens.
  4. Verify the service, account, and scopes in the external authorisation page.
  5. Back in Row-Bot, Check confirms the account works.
  6. Test a read-only action before approving writes, posts, email, calendar, or repository changes.

Each account shows its state (Connected, Not checked yet, Needs reconnecting or Not connected) with Check, Reconnect when a sign-in expired, and Disconnect. Disconnecting asks first and removes the sign-in from this computer; it doesn't revoke access at the service, which you can do in the service's own settings.

GitHub​

  1. Sign in with the GitHub CLI on this computer (Sign in with the GitHub CLI, offered when the CLI is installed), or Create a token: a fine-grained token for the repositories Row-Bot should use.
  2. If you made a token, paste it under GitHub token. It stays in your keychain.
  3. Check GitHub confirms Row-Bot can reach GitHub. Public repositories work without an account; Use public access only says so.

GitHub's page also lists GitHub's hosted server and its server on this computer as other ways to connect. Each keeps its own token: the GitHub account's token is never used for a GitHub server connection, or the other way round.

Google​

Row-Bot has no Google sign-in of its own. You create an OAuth client in your own Google Cloud project, give Row-Bot its file, and sign in with it. The account connects Gmail and Google Calendar. The guide, How to set up Google, links straight to each Google page:

  1. Create a project: sign in to Google Cloud and create a project for Row-Bot. Any name works.
  2. Turn on both APIs: one link turns on the Gmail and Google Calendar APIs for that project.
  3. Open Branding: give your sign-in a name, such as "My Row-Bot", and your email address.
  4. Open Audience: choose External, then add your own Google address as a test user.
  5. Create the client: in the Row-Bot desktop app, create a client of type Desktop app. To sign in from another device, create a Web application client instead and add the redirect URI the guide shows under Authorised redirect URIs (see Sign In From Another Device). Download its file straight away, because Google shows its secret only then. In Row-Bot, choose that file with Choose file… under Google sign-in file; any file name works.
  6. Sign in with Google, then finish signing in in your browser.

Gmail access and Calendar access choose what Row-Bot may do: it can search, read and draft email, but sending always asks first; it can see and add events, but moving or deleting asks first.

Google's own hosted Workspace servers are a developer preview open only to testers, so the Google account with your own client is the recommended way to connect Google.

Google Sign-Ins In Testing Last 7 Days​

Google limits apps whose publishing status is Testing, as a new app made with the steps above is:

  • A sign-in lasts 7 days from when you agree to it; after that Google stops Row-Bot renewing it.
  • At most 100 test users can sign in.

When the sign-in expires, Row-Bot shows it: Apps › Google says Sign in needed with Sign in again, the account's settings say Needs reconnecting with Reconnect, and Overview's Needs you lists Sign in to Google. Signing in again gives you another 7 days.

To stop it, publish your app: in Google Cloud, open Audience and choose Publish app, so its status is In production, then sign in again. Because Gmail and Calendar access are sensitive or restricted Google scopes and your app isn't verified by Google, Google then shows its unverified-app warning when you sign in; continuing is fine for an app you made for yourself. An unverified app can be used by at most 100 people, and you don't need Google's verification for your own use.

X​

  1. In the X developer portal (Open the developer portal), create a project and an app, with OAuth 2.0 read and write turned on.
  2. Copy the callback address the guide shows into the app's sign-in settings. Another device may show a different one; X accepts several, so add each one you sign in from.
  3. Paste the app's client ID and secret.
  4. Connect X, then finish signing in in your browser.

X access chooses what Row-Bot may do. Posting and deleting ask first.

Sign In From Another Device​

In the Row-Bot desktop app, signing in to Google or X opens the browser on the computer Row-Bot runs on. From any other signed-in device, such as your phone, another computer's browser or a Row-Bot server, signing in works when Row-Bot has exactly one public HTTPS address, set up in Settings › Devices & remote access: Row-Bot opens the service's sign-in page in that device's browser, and the service sends you back to Row-Bot at that address. If the page doesn't open, choose Open Google's sign-in page (or X's). Finish within five minutes, on the device that started it.

  • Google returns only to addresses the client lists. A Desktop app client lists only the computer Row-Bot runs on, so another device needs a Web application client whose Authorised redirect URIs include the address the guide shows there: Row-Bot's public address followed by /api/v1/accounts/google/auth/callback. Row-Bot checks the file lists it before saving it.
  • X returns to the callback address the guide shows on that device, which must be listed in your app's sign-in settings.

Without a public HTTPS address, or with a Google client that doesn't list it, the account's settings say what's missing. Check and Disconnect work from every device.

Tokens And Scopes​

Secrets use the configured operating-system secret store when available. Settings show status, not the secret value. A service may still retain its own authorisation grant until you revoke it there. Use the narrowest scopes that support the feature and disconnect access you no longer use.

When A Sign-In Expires​

Overview's Needs you shows the app, such as Sign in to Google, with a button that opens the account's own settings at its fix. Monitor offers Reconnect Google or Reconnect X, which starts the sign-in again: in the Row-Bot desktop app through a browser on the computer Row-Bot runs on, and on another device through Row-Bot's public address (see Sign In From Another Device). Where a device can't sign in, the fix opens the account's settings instead, where Check and Disconnect work.

Troubleshooting​

  • Confirm the system browser returned to the same Row-Bot instance that started the flow.
  • For GitHub CLI, refresh CLI authorisation after signing in or changing accounts.
  • If Row-Bot says the Google file isn't a valid Google OAuth client file, create a client of type Desktop app (or Web application, to sign in from another device) and download its file again.
  • If Google shows redirect_uri_mismatch, or Row-Bot says the client doesn't list its sign-in address, add the redirect URI the guide shows to the Web application client in Google Cloud, download its file again and choose it. Google accepts only an https address on a domain name, not an IP address.
  • If a sign-in from another device says it has expired or isn't valid, start it again from that device: each one works once, for five minutes.
  • If Google asks you to sign in again every week, your Google app is still in Testing; publish it in Audience (see Google Sign-Ins In Testing Last 7 Days).
  • If a callback fails, repeat the supported flow instead of copying browser storage.
  • If an action is denied after connection, review both the service scopes and the Row-Bot approval policy.