openclaw · steipete · May 17, 2026 · May 16, 2026 · May 17, 2026 · May 17, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 ## 0.17.1 - Unreleased
 
+### Added
+
+- Calendar: add --with-zoom / --regenerate-zoom / --remove-zoom that create, regenerate, and remove Zoom meetings and attach the join URL + meeting ID + passcode to the Calendar event description. Google's Calendar API rejects conferenceData writes asserting `conferenceSolution.key.type="addOn"` from non-Workspace-Marketplace OAuth clients, so the description-mode integration is the path that round-trips through Google's storage; trade-off is no native "Join with Zoom" conference card. (#589, #590) — thanks @alexisperumal and @mvanhorn.
+- Auth: add gog zoom auth setup / doctor for Zoom S2S OAuth credential storage. (#590) — thanks @mvanhorn.
+
 ### Fixed
 
 - CLI: harden backup writes, config/credentials atomic saves, keyring write verification, line input buffering, disabled-API hints, JSON transform number handling, and untrusted-content wrapping after ClawPatch review.

diff --git a/README.md b/README.md
@@ -149,7 +149,8 @@ gog --gmail-no-send gmail drafts create --to you@example.com --subject test
 Docs: [`gog calendar`](docs/commands/gog-calendar.md),
 [`calendar create`](docs/commands/gog-calendar-create.md),
 [`calendar update`](docs/commands/gog-calendar-update.md),
-[`calendar move`](docs/commands/gog-calendar-move.md).
+[`calendar move`](docs/commands/gog-calendar-move.md),
+[Zoom setup](docs/zoom-auth-setup.md).
 
 ```bash
 gog calendar events --today
@@ -161,6 +162,11 @@ gog calendar create primary --summary "Coffee" \
   --to "2026-05-06T10:30:00+02:00" \
   --location-search "Elysian Coffee Vancouver"
 gog calendar update primary <eventId> --with-meet
+gog zoom auth setup
+gog calendar create primary --summary "Client sync" \
+  --from "2026-05-06T11:00:00+02:00" \
+  --to "2026-05-06T11:30:00+02:00" \
+  --with-zoom
 gog calendar move primary <eventId> team-calendar@example.com
 gog calendar appointments
 ```
@@ -469,7 +475,7 @@ Docs: [Command index](docs/commands/README.md),
 
 Common user services:
 
-- Gmail, Calendar, Drive, Docs, Sheets, Slides, Forms, Meet, Apps Script
+- Gmail, Calendar, Drive, Docs, Sheets, Slides, Forms, Meet, Zoom, Apps Script
 - Analytics and Search Console
 - Contacts, People, Tasks, Classroom
 - Chat for Workspace accounts

diff --git a/docs/commands.generated.md b/docs/commands.generated.md
@@ -562,3 +562,7 @@ Generated from `gog schema --json`.
       - [`gog youtube (yt) playlists (playlist) list (ls) [flags]`](commands/gog-youtube-playlists-list.md) - List playlists by channel or authenticated user
     - [`gog youtube (yt) videos (video) <command>`](commands/gog-youtube-videos.md) - List or get videos
       - [`gog youtube (yt) videos (video) list (ls) [flags]`](commands/gog-youtube-videos-list.md) - List videos by ID or chart
+  - [`gog zoom <command> [flags]`](commands/gog-zoom.md) - Zoom
+    - [`gog zoom auth <command>`](commands/gog-zoom-auth.md) - Manage Zoom Server-to-Server OAuth credentials
+      - [`gog zoom auth doctor [flags]`](commands/gog-zoom-auth-doctor.md) - Validate Zoom credentials
+      - [`gog zoom auth setup [flags]`](commands/gog-zoom-auth-setup.md) - Store Zoom Server-to-Server OAuth credentials
diff --git a/docs/commands/README.md b/docs/commands/README.md
@@ -2,7 +2,7 @@
 
 Every `gog` command has a generated docs page. The source of truth is the live CLI schema; run `make docs-commands` after changing command names, flags, help text, aliases, or arguments.
 
-Generated pages: 560.
+Generated pages: 564.
 
 ## Top-level Commands
 
@@ -49,6 +49,7 @@ Generated pages: 560.
 - [gog version](gog-version.md) - Print version
 - [gog whoami](gog-whoami.md) - Show your profile (alias for 'people me')
 - [gog youtube](gog-youtube.md) - YouTube Data API (activities, videos, playlists, comments, channels)
+- [gog zoom](gog-zoom.md) - Zoom
 
 ## All Commands
 
@@ -612,3 +613,7 @@ Generated pages: 560.
       - [gog youtube playlists list](gog-youtube-playlists-list.md) - List playlists by channel or authenticated user
     - [gog youtube videos](gog-youtube-videos.md) - List or get videos
       - [gog youtube videos list](gog-youtube-videos-list.md) - List videos by ID or chart
+  - [gog zoom](gog-zoom.md) - Zoom
+    - [gog zoom auth](gog-zoom-auth.md) - Manage Zoom Server-to-Server OAuth credentials
+      - [gog zoom auth doctor](gog-zoom-auth-doctor.md) - Validate Zoom credentials
+      - [gog zoom auth setup](gog-zoom-auth-setup.md) - Store Zoom Server-to-Server OAuth credentials
diff --git a/docs/commands/gog-calendar-create.md b/docs/commands/gog-calendar-create.md
@@ -42,6 +42,7 @@ gog calendar (cal) create (add,new) <calendarId> [flags]
 | `--guests-can-modify` | `*bool` |  | Allow guests to modify event |
 | `--guests-can-see-others` | `*bool` |  | Allow guests to see other guests |
 | `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--include-passwords` | `bool` |  | Do not redact Zoom meeting passwords in output |
 | `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
 | `--location` | `string` |  | Location |
 | `--location-search` | `string` |  | Resolve a Google Places text search and use the best match as event location |
@@ -69,6 +70,7 @@ gog calendar (cal) create (add,new) <calendarId> [flags]
 | `--version` | `kong.VersionFlag` |  | Print version and exit |
 | `--visibility` | `string` |  | Event visibility: default, public, private, confidential |
 | `--with-meet` | `bool` |  | Create a Google Meet video conference for this event |
+| `--with-zoom` | `bool` |  | Create a Zoom video conference for this event |
 | `--working-building-id` | `string` |  | Working location building ID |
 | `--working-custom-label` | `string` |  | Working location custom label |
 | `--working-desk-id` | `string` |  | Working location desk ID |

diff --git a/docs/commands/gog-calendar-update.md b/docs/commands/gog-calendar-update.md
@@ -42,6 +42,7 @@ gog calendar (cal) update (edit,set) <calendarId> <eventId> [flags]
 | `--guests-can-modify` | `*bool` |  | Allow guests to modify event |
 | `--guests-can-see-others` | `*bool` |  | Allow guests to see other guests |
 | `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `--include-passwords` | `bool` |  | Do not redact Zoom meeting passwords in output |
 | `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
 | `--location` | `string` |  | New location (set empty to clear) |
 | `--location-search` | `string` |  | Resolve a Google Places text search and use the best match as event location |
@@ -55,7 +56,9 @@ gog calendar (cal) update (edit,set) <calendarId> <eventId> [flags]
 | `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
 | `--private-prop` | `[]string` |  | Private extended property (key=value, can be repeated) |
 | `--regenerate-meet` | `bool` |  | Replace the event's Google Meet video conference |
+| `--regenerate-zoom` | `bool` |  | Replace the event's Zoom video conference |
 | `--reminder` | `[]string` |  | Custom reminders as method:duration (e.g., popup:30m, email:1d). Can be repeated (max 5). Set empty to clear. |
+| `--remove-zoom` | `bool` |  | Remove the event's Zoom video conference |
 | `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
 | `--rrule` | `[]string` |  | Recurrence rules (e.g., 'RRULE:FREQ=MONTHLY;BYMONTHDAY=11'). Can be repeated. Set empty to clear. |
 | `--scope` | `string` | all | For recurring events: single, future, all |
@@ -70,6 +73,7 @@ gog calendar (cal) update (edit,set) <calendarId> <eventId> [flags]
 | `--version` | `kong.VersionFlag` |  | Print version and exit |
 | `--visibility` | `string` |  | Event visibility: default, public, private, confidential |
 | `--with-meet` | `bool` |  | Create a Google Meet video conference for this event |
+| `--with-zoom` | `bool` |  | Create a Zoom video conference for this event |
 | `--working-building-id` | `string` |  | Working location building ID |
 | `--working-custom-label` | `string` |  | Working location custom label |
 | `--working-desk-id` | `string` |  | Working location desk ID |

diff --git a/docs/commands/gog-zoom-auth-doctor.md b/docs/commands/gog-zoom-auth-doctor.md
@@ -0,0 +1,44 @@
+# `gog zoom auth doctor`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Validate Zoom credentials
+
+## Usage
+
+```bash
+gog zoom auth doctor [flags]
+```
+
+## Parent
+
+- [gog zoom auth](gog-zoom-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/drivelabels/docs/slides/contacts/tasks/people/sheets/forms/sites/appscript/analytics/searchconsole/ads/photos) |
+| `--alias` | `string` | default | Zoom credential alias |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+| `--wrap-untrusted` | `bool` | false | In JSON/raw output, wrap fetched text fields in external untrusted-content markers |
+
+## See Also
+
+- [gog zoom auth](gog-zoom-auth.md)
+- [Command index](README.md)
diff --git a/docs/commands/gog-zoom-auth-setup.md b/docs/commands/gog-zoom-auth-setup.md
@@ -0,0 +1,48 @@
+# `gog zoom auth setup`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Store Zoom Server-to-Server OAuth credentials
+
+## Usage
+
+```bash
+gog zoom auth setup [flags]
+```
+
+## Parent
+
+- [gog zoom auth](gog-zoom-auth.md)
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/drivelabels/docs/slides/contacts/tasks/people/sheets/forms/sites/appscript/analytics/searchconsole/ads/photos) |
+| `--account-id` | `string` |  | Zoom Server-to-Server OAuth account ID |
+| `--alias` | `string` | default | Zoom credential alias |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--client-id` | `string` |  | Zoom Server-to-Server OAuth client ID |
+| `--client-secret` | `string` |  | Zoom Server-to-Server OAuth client secret |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `--skip-validate` | `bool` |  | Store credentials without calling Zoom /users/me |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+| `--wrap-untrusted` | `bool` | false | In JSON/raw output, wrap fetched text fields in external untrusted-content markers |
+
+## See Also
+
+- [gog zoom auth](gog-zoom-auth.md)
+- [Command index](README.md)
diff --git a/docs/commands/gog-zoom-auth.md b/docs/commands/gog-zoom-auth.md
@@ -0,0 +1,48 @@
+# `gog zoom auth`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Manage Zoom Server-to-Server OAuth credentials
+
+## Usage
+
+```bash
+gog zoom auth <command>
+```
+
+## Parent
+
+- [gog zoom](gog-zoom.md)
+
+## Subcommands
+
+- [gog zoom auth doctor](gog-zoom-auth-doctor.md) - Validate Zoom credentials
+- [gog zoom auth setup](gog-zoom-auth-setup.md) - Store Zoom Server-to-Server OAuth credentials
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/drivelabels/docs/slides/contacts/tasks/people/sheets/forms/sites/appscript/analytics/searchconsole/ads/photos) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+| `--wrap-untrusted` | `bool` | false | In JSON/raw output, wrap fetched text fields in external untrusted-content markers |
+
+## See Also
+
+- [gog zoom](gog-zoom.md)
+- [Command index](README.md)
diff --git a/docs/commands/gog-zoom.md b/docs/commands/gog-zoom.md
@@ -0,0 +1,47 @@
+# `gog zoom`
+
+> Generated from `gog schema --json`. Do not edit this page by hand; run `make docs-commands`.
+
+Zoom
+
+## Usage
+
+```bash
+gog zoom <command> [flags]
+```
+
+## Parent
+
+- [gog](gog.md)
+
+## Subcommands
+
+- [gog zoom auth](gog-zoom-auth.md) - Manage Zoom Server-to-Server OAuth credentials
+
+## Flags
+
+| Flag | Type | Default | Help |
+| --- | --- | --- | --- |
+| `--access-token` | `string` |  | Use provided access token directly (bypasses stored refresh tokens; token expires in ~1h) |
+| `-a`<br>`--account`<br>`--acct` | `string` |  | Account email for API commands (gmail/calendar/chat/classroom/drive/drivelabels/docs/slides/contacts/tasks/people/sheets/forms/sites/appscript/analytics/searchconsole/ads/photos) |
+| `--client` | `string` |  | OAuth client name (selects stored credentials + token bucket) |
+| `--color` | `string` | auto | Color output: auto\|always\|never |
+| `--disable-commands` | `string` |  | Comma-separated list of disabled commands; dot paths allowed |
+| `-n`<br>`--dry-run`<br>`--dryrun`<br>`--noop`<br>`--preview` | `bool` |  | Do not make changes; print intended actions and exit successfully |
+| `--enable-commands` | `string` |  | Comma-separated list of enabled commands; dot paths allowed (restricts CLI) |
+| `-y`<br>`--force`<br>`--assume-yes`<br>`--yes` | `bool` |  | Skip confirmations for destructive commands |
+| `--gmail-no-send` | `bool` | false | Block Gmail send operations (agent safety) |
+| `-h`<br>`--help` | `kong.helpFlag` |  | Show context-sensitive help. |
+| `-j`<br>`--json`<br>`--machine` | `bool` | false | Output JSON to stdout (best for scripting) |
+| `--no-input`<br>`--non-interactive`<br>`--noninteractive` | `bool` |  | Never prompt; fail instead (useful for CI) |
+| `-p`<br>`--plain`<br>`--tsv` | `bool` | false | Output stable, parseable text to stdout (TSV; no colors) |
+| `--results-only` | `bool` |  | In JSON mode, emit only the primary result (drops envelope fields like nextPageToken) |
+| `--select`<br>`--pick`<br>`--project` | `string` |  | In JSON mode, select comma-separated fields (best-effort; supports dot paths). Desire path: use --fields for most commands. |
+| `-v`<br>`--verbose` | `bool` |  | Enable verbose logging |
+| `--version` | `kong.VersionFlag` |  | Print version and exit |
+| `--wrap-untrusted` | `bool` | false | In JSON/raw output, wrap fetched text fields in external untrusted-content markers |
+
+## See Also
+
+- [gog](gog.md)
+- [Command index](README.md)
diff --git a/docs/commands/gog.md b/docs/commands/gog.md
@@ -6,7 +6,7 @@ Google CLI for Gmail/Calendar/Chat/Classroom/Drive/Contacts/Tasks/Sheets/Docs/Sl
 
 Config:
   file: <config-dir>/gogcli/config.json
-  keyring backend: file (source: config)
+  keyring backend: auto (source: default)
 
 ## Usage
 
@@ -59,6 +59,7 @@ gog <command> [flags]
 - [gog version](gog-version.md) - Print version
 - [gog whoami](gog-whoami.md) - Show your profile (alias for 'people me')
 - [gog youtube](gog-youtube.md) - YouTube Data API (activities, videos, playlists, comments, channels)
+- [gog zoom](gog-zoom.md) - Zoom
 
 ## Flags