Google OAuth

One callback URL. The right return trip.

Route Google login.

Start the agent with your application’s exact, browser-reachable callback:

pepe run   --target http://127.0.0.1:3000/api/github/webhook   --callback https://workspace.example.com/auth/callback/google

In the Google OAuth client, authorize https://pepe.example.com/oauth/google/callback. Then integrate the application backend:

Generate and keep the application’s original CSRF state in its normal state cookie.
Call Pepe using the workspace’s session token:

curl "$PEPE_SERVER/sessions/$PEPE_SESSION_ID/oauth"   -H "Authorization: Bearer $PEPE_SESSION_TOKEN"   -H "Content-Type: application/json"   -d '{"provider":"google","state":"original-application-csrf-state"}'

Pepe returns:

{
  "state": "opaque-single-use-token",
  "redirect_uri": "https://pepe.example.com/oauth/google/callback"
}

Use those returned values in the Google authorization request. Keep the original app state in the cookie.
Google calls Pepe. Pepe consumes the transaction and redirects to the registered workspace callback, restoring the original app state.
The app checks its original state cookie and exchanges the code using the same stable Pepe redirect_uri.

Transactions expire after ten minutes and can be used once. Your app still owns login, cookies, provider secrets, and token exchange. A localhost callback is reachable only by a browser on that same machine. Pepe does not currently provide a public application tunnel.