AgentWeaveby SecondLoop
Menu

CONNECT / CONFIGURE / REVOKE

Google OAuth help

What AgentWeave Developer Tools requests from Google, how Firebase setup works, and how to revoke or remove local authorization.

Effective · July 22, 2026

This is a developer setup flow. Google authorization is used to configure Firebase for an Agent App. It is separate from the email-and-password login that the resulting App may later offer to its end users.

1. Before you connect

  • Use a Google account that is allowed to create or administer the intended Cloud project.
  • Start with a dedicated test project that contains no production users or regulated data.
  • Review the account name, application name, publisher domain, and requested permissions on Google's consent screen.
  • Do not continue if the browser is not on a Google-owned authorization domain.

2. Permissions requested

The current setup flow requests these Google OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platformRead and manage the selected Google Cloud project and enable services needed by the requested Firebase setup.
  • https://www.googleapis.com/auth/firebaseView and administer Firebase project configuration needed to add Firebase and enable email authentication.

These permissions are broad because project creation, API enablement, and Firebase configuration cross multiple Google services. AgentWeave uses them only for the developer-directed setup workflow. Do not grant them for a project you are not authorized to manage.

3. What happens during setup

  1. AgentWeave creates a short-lived authorization state and an S256 PKCE verifier in local sensitive storage.
  2. Your default browser opens Google's authorization page.
  3. After you consent, Google redirects to a temporary 127.0.0.1 callback owned by the local AgentWeave Host.
  4. AgentWeave exchanges the one-time authorization code directly with Google's token endpoint.
  5. You select an existing project or request a new project, then AgentWeave enables the required APIs and applies the Firebase Authentication configuration.
  6. The public Firebase web configuration is returned to the developer workspace. OAuth tokens remain in local sensitive storage.

4. Desktop OAuth client metadata

The Client ID is public and appears in every authorization request. Google Desktop installed applications cannot keep a shared client secret confidential, so the Desktop client secret is treated as public client metadata rather than proof of application identity. This follows the native-app OAuth model described by RFC 8252 section 8.5.

Public client metadata cannot issue a token by itself. Token issuance still requires user consent, a one-time authorization code, the matching PKCE verifier, and the exact callback. Access tokens and refresh tokens remain confidential.

5. Disconnect or revoke access

From AgentWeave

Open Developer Tools → Required information → User login, then disconnect or restart the Firebase authorization. This removes the active local binding and its locally stored authorization material.

From your Google Account

  1. Open Google Account → Third-party apps and services.
  2. Select AgentWeave.
  3. Choose the option to remove or revoke access.

Revocation prevents future refreshes. An access token already issued by Google may remain valid until its short expiry. To remove all local application state, also clear the AgentWeave app data using your operating system's application-data controls or uninstall the app.

6. Common problems

“Access blocked” or an unverified-app warning

Confirm that the application is named AgentWeave and that the publisher pages use secondloop.app. During a controlled pilot, Google may apply an unverified-user limit until the OAuth verification process is complete.

The callback page cannot connect

Keep AgentWeave open while the browser completes authorization. Local firewall, proxy, or endpoint security software must allow the temporary IPv4 loopback callback. Do not replace the callback with a public URL.

No projects appear

The Google account may lack project listing or creation permissions, an organization policy may restrict project creation, or the selected project may be in an unsupported lifecycle state. Try a dedicated account or ask the organization administrator for the required role.

API enablement or Firebase setup fails

Verify billing and organization policy, confirm that you can enable services in the project, and retry after any Google service propagation delay. AgentWeave keeps retryable authorization state for a limited period rather than silently switching projects.

7. Get help

Before contacting support, record the visible error category and the step that failed. Do not send access tokens, refresh tokens, authorization codes, passwords, or downloaded OAuth credential files.

For OAuth and privacy help, contact a@secondloop.app.