.env; until then the lane is live-but-unauthenticated and waits for you to connect it (set PENDPOST_MODE=mock to exercise it through the mock driver).
Beta lane, and access-gated. Google gates the Business Profile APIs behind a per-project access request. Until that request is approved, every call returns 403 and the lane stays beta. The OAuth flow can still complete before approval; only publishing is blocked.
Setup ceremony
-
Request Business Profile API access. Submit the access request for your Cloud project (the form at
https://developers.google.com/my-business/content/prereqs). Until it is approved, publishing returns 403. -
Create the OAuth client. In the Google Cloud console create OAuth credentials, enable the Business Profile APIs (My Business Account Management, My Business Business Information, and Google My Business API v4), and register the loopback redirect
http://127.0.0.1:8088/oauth/gbp/callback. Copy the client id and secret. -
Authorize. Run the CLI below. It opens the consent screen for the
business.managescope, exchanges the code, stores the tokens, and (once access is approved) prints your account and location ids as candidates. -
Set the target location. Set
GBP_ACCOUNT_IDandGBP_LOCATION_IDto the numeric ids of the verified location posts should appear on.
Environment variables
A lane publishes only once its credential is present. If the GBP variables are blank, the GBP lane is live-but-unauthenticated and waits for you to connect it. Set
PENDPOST_MODE=mock to exercise it through the mock driver.Validate the lane
A present credential is not the same as a working one. After setup, validate the GBP lane in the Setup tab, or run a live probe with thehealth_recheck tool, to confirm the credential is live and not just configured. The lane is ready when it reports live.
Over MCP. Setup and rotation are an interactive human ceremony; secrets are never written through MCP. An agent can still check status (
account_status), run a live liveness probe (health_recheck), and read non-secret config (config_get) over MCP without touching credentials.