gws auth login: 'Required parameter is missing: response_type' with Desktop OAuth client on v0.4.1

[jaseemts]

Summary

gws auth login fails with Error 400: invalid_request — "Required parameter is missing: response_type" when using a manually configured Desktop OAuth client on v0.4.1. The OAuth URL generated by the CLI appears to be missing the response_type=code parameter.

Environment

• gws version: 0.4.1 (npm)
• OS: macOS 26.4, Apple Silicon (arm64)
• Node: v20.19.0
• Account type: Google Workspace (custom domain)
• OAuth client type: Desktop app (created in Google Cloud Console)

Steps to Reproduce

1. Create a Desktop OAuth client in Google Cloud Console
2. Download client_secret_*.json, rename to client_secret.json
3. Place at ~/Library/Application Support/gws/client_secret.json
4. Run gws auth login --account user@example.com
5. Browser opens → Google shows "Access blocked: Authorization Error"

Error

Access blocked: Authorization Error
Required parameter is missing: response_type
Error 400: invalid_request

What I verified

• The client_secret.json has the correct "installed" wrapper structure with client_id, client_secret, auth_uri, token_uri, and redirect_uris
• OAuth client type is "Desktop" (confirmed in Cloud Console)
• OAuth consent screen is configured with appropriate scopes (Drive, Gmail, Calendar, Sheets, Docs, Slides)
• Test users are added

Likely cause

The CLI is constructing an OAuth authorization URL without including response_type=code as a query parameter. This is required by Google's OAuth 2.0 endpoint.

Related issues

• gws auth login unusable with personal @gmail.com accounts — invalid_scope + ignores custom client_secret.json #119 — CLI ignores custom client_secret.json and uses hardcoded client ID (v0.3.4). May be the same root cause — if the CLI is still using its built-in client rather than the user-provided file, the built-in client config may be malformed.
• credentials saved successfully but 401 on all commands + auth export outputs truncated values - macOS Apple Silicon #137 — Credentials saved successfully but 401 on all commands (macOS Apple Silicon)
• gws auth login fails for personal Gmail accounts: -s flag does not limit OAuth scopes #138 — -s flag does not limit OAuth scopes

[jaseemts]

Solution / Workaround

The OAuth URL generated by gws is actually valid (it does include response_type=code). The misleading error comes from Google rejecting the request before parsing the full URL, because the wrong Google account session was active in the browser.

In my case:

• The OAuth app was configured as Internal (Google Workspace org only)
• My browser's default session was a personal @gmail.com account (outside the org)
• Google blocked the flow with the generic "Required parameter is missing: response_type" error instead of saying "this account is not part of this organization"

Fix: Open the OAuth URL in an incognito/private browser window and sign in with the correct Workspace account. The login_hint parameter in the URL suggests the right account, but it doesn't override the browser's active session.

Suggestion for gws

It might be worth adding a note in the gws auth login output like:

Tip: If you see "Access blocked" in the browser, try opening this URL 
in an incognito window and signing in with the correct account.

This would save users from debugging a red herring.

[maxmealing]

This issue still reproduces on v0.4.4 (npm, macOS arm64, Node v22.20.0). The OAuth URL generated by gws auth login is still missing response_type=code. Using a manually created Desktop OAuth client with client_secret.json placed at ~/.config/gws/client_secret.json. Google returns Error 400: invalid_request - Required parameter is missing: response_type.

[jaseemts]

@maxmealing The URL is almost certainly not missing response_type=code — Google's error message is misleading. I verified this by capturing the actual URL gws generates:

https://accounts.google.com/o/oauth2/auth?scope=...&access_type=offline&redirect_uri=http://localhost:63926&response_type=code&client_id=...&prompt=select_account+consent&login_hint=...

response_type=code is there. Google shows "Required parameter is missing: response_type" as a generic rejection when the real issue is something else.

Common causes:

1. OAuth app is Internal (Workspace org only) and your browser session is a personal @gmail.com account — Google blocks it before parsing the URL
2. OAuth app is External + Testing mode with no test users added
3. Browser auto-selects the wrong Google account — login_hint suggests an account but doesn't force it

To verify: Copy the full URL from the gws auth login terminal output and check — you'll see response_type=code is present. Then open it in an incognito window and sign in with the correct account.

If your app is Internal, either switch to External or make sure you're signing in with an account within the org. If External + Testing, add your account as a test user or publish the app.

[jpoehnelt]

Closing — user-resolved (wrong Google account session, not a gws bug).

[eugenschmalz]

test