OpenAB Google Chat Bundle

One-click OpenAB deployment for Google Chat — bot agent + gateway bundled together. Paste your Service Account JSON, configure one URL in Google Cloud Console, and you're done.

Google Chat ──POST──▶ ┌──────────────────┐ ◀──WebSocket── ┌────────────┐
                      │  openab-gateway  │                │   openab   │
                      │ (googlechat only)│                │  (Kiro CLI) │
                      └──────────────────┘                └────────────┘
                        public HTTPS                       internal only

Prerequisites: A Google Workspace account (Business / Enterprise tier). Consumer @gmail.com accounts cannot create Google Chat apps. You also need access to a Google Cloud Console project where you can enable the Chat API and create a service account.

What's deployed

Service	Purpose	Public
openab	OAB agent running Kiro CLI	No
openab-gateway	Google Chat events → WebSocket bridge	Yes (auto HTTPS)

No PVC sharing, no manual config.toml edits. The agent's config.toml is generated on first boot with the gateway URL pre-wired to ws://openab-gateway:8080/ws and platform = "googlechat".

GOOGLE_CHAT_ENABLED=true and GOOGLE_CHAT_AUDIENCE (the JWT verification audience) are set automatically — no manual input needed.

Setup

1. Enable Google Chat API + Create Service Account

1. Open Google Cloud Console → select or create a project.
2. APIs & Services → Library → search Google Chat API → Enable.
3. APIs & Services → Credentials → + CREATE CREDENTIALS → Service account → fill name → CREATE AND CONTINUE (no roles needed) → DONE.
4. Click the newly created service account → Keys tab → ADD KEY → Create new key → JSON → Create. A JSON file downloads.
5. Open the JSON file, copy the entire content, and paste it (as one single-line string — Zeabur's UI handles this) into Service Account JSON.

2. (Optional) Get a Kiro API Key

If you have a paid Kiro subscription, go to kiro.dev → Settings → API Keys → create a key and paste it into KIRO_API_KEY. Free tier users skip this and authenticate post-deploy in step 4.

3. Deploy

Click deploy. A public HTTPS domain is auto-assigned to the gateway service.

4. Authenticate Kiro via Device Flow (free tier only)

Skip if you set KIRO_API_KEY in step 2.

After the openab service is running, open its terminal in Zeabur Dashboard and run:

runuser -u agent -- kiro-cli login --use-device-flow

Follow the URL and code to authorize in your browser.

5. Configure the Chat App in Google Cloud Console

Google Chat App URL must be set manually in GCP — no programmatic API.

1. Open the openab-gateway service page in Zeabur Dashboard → look at the auto-assigned domain (e.g. https://your-gateway.zeabur.app).
2. The full App URL is: https://<YOUR_GATEWAY_DOMAIN>/webhook/googlechat
3. Back in Google Cloud Console → APIs & Services → Google Chat API → Configuration:
   • App name / Avatar URL / Description: your choice.
   • Functionality: tick Receive 1:1 messages and Join spaces and group conversations as needed.
   • Connection settings: choose App URL → paste the URL → set Authentication Audience to HTTP Endpoint URL (the default).
   • Visibility: limit to your Workspace domain or specific users.
4. SAVE.

The openab-gateway service Instructions section shows the exact App URL pre-filled.

6. Test

In Google Chat (mail.google.com/chat or the standalone app), find your app by its name → start a DM → send a message. The gateway verifies the JWT, forwards the message to OAB, and OAB replies via the Chat REST API using your service account.

For spaces / group chats: invite the app from the space's Apps & integrations menu.

Customization

• /home/agent/.config/openab/config.toml — OAB config (sessions, reactions, etc.). Created on first boot from a built-in template with the [gateway] block pre-wired. To regenerate, delete and restart.
• Image tags — bot tracks the floating stable channel (ghcr.io/openabdev/openab:stable) and auto-updates with each OpenAB stable release. Gateway is pinned at ghcr.io/openabdev/openab-gateway:0.5.1 (no :stable tag yet). To pin or bump, change the tag in Zeabur Dashboard → Service → Settings. Available tags: OpenAB / Gateway.

How JWT verification works

Google Chat signs every incoming POST with a JWT. The gateway:

1. Validates the JWT signature against Google's public JWKS.
2. Validates the iss claim is [email protected].
3. Validates the aud claim matches GOOGLE_CHAT_AUDIENCE (auto-set by this bundle to ${gateway-url}/webhook/googlechat).

Any tampered or replayed request fails one of these checks and is rejected with 401.

Want a different agent backend?

This bundle uses Kiro as the default agent. For Claude / Codex / Cursor / Gemini / OpenCode / Hermes / Grok, deploy the corresponding bot template separately together with the standalone OpenAB Gateway.

Want a different platform?

See OpenAB Telegram Bundle / Feishu Bundle / LINE Bundle / WeCom Bundle / MS Teams Bundle or the standalone OpenAB Gateway.

Links

• OpenAB GitHub
• Google Chat Setup Guide
• Google Chat API Docs
• Standalone OpenAB Gateway Template