← Back to Expanso + OpenClaw
📧 Integration Guide

OpenClaw Gmail Integration

Connect OpenClaw to Gmail using Expanso pipelines. Triage your inbox, draft replies, build morning digests - all while keeping your email credentials safely on your own machine.

⚠️

Prerequisites

You need OpenClaw installed (install guide), a free Expanso Cloud account (sign up), and a Gmail account with either an App Password or Google Cloud OAuth credentials.

How it works
👤You
🤖OpenClaw
Expanso
📧Gmail
OpenClaw sends the workflow request to Expanso. Expanso resolves your Gmail credentials locally and fetches or sends email. The AI never sees your password or OAuth tokens.

Two ways to connect Gmail

Choose the method that fits your setup:

IMAP/SMTP

Simplest setup. Uses a Gmail App Password to read (IMAP) and send (SMTP) email. Good for personal accounts and quick testing.

Method 1: IMAP/SMTP (simplest)

Generate a Gmail App Password

App Passwords let you connect to Gmail without exposing your main password.

1.1 Enable 2-Step Verification

Go to Google Account Security and enable 2-Step Verification if you haven't already. App Passwords require this.

1.2 Create an App Password

Go to App Passwords. Select "Mail" and your device, then click Generate. Copy the 16-character password.

1.3 Store credentials securely

# Add to your .env or shell profile
export GMAIL_ADDRESS="[email protected]"
export GMAIL_APP_PASSWORD="abcd efgh ijkl mnop"

Deploy the Gmail Pipeline

Create an Expanso pipeline that reads email via IMAP and returns structured data.

2.1 Set up Expanso (if you haven't already)

Follow the Expanso setup guide to create your account and install the CLI.

2.2 Create the email reader pipeline

Open cloud.expanso.io, click New Pipeline, and paste:

# gmail-reader.yaml
# Reads unread emails and returns structured summaries
input:
  http_server:
    path: /gmail-read
    allowed_verbs: [ "POST" ]
pipeline:
  processors:
    - http:
        url: "imaps://imap.gmail.com:993/INBOX?unseen=true"
        verb: GET
        basic_auth:
          username: "${GMAIL_ADDRESS}"
          password: "${GMAIL_APP_PASSWORD}"
    - mapping: |
        root.emails = this.messages.map_each(msg -> {
          "from": msg.from,
          "subject": msg.subject,
          "date": msg.date,
          "snippet": msg.body.slice(0, 500)
        })
        root.count = this.messages.length()
output:
  sync_response: {}

2.3 Create the email sender pipeline

For drafting and sending replies:

# gmail-send.yaml
# Sends email via SMTP
input:
  http_server:
    path: /gmail-send
    allowed_verbs: [ "POST" ]
pipeline:
  processors:
    - mapping: |
        root.to = this.to
        root.subject = this.subject
        root.body = this.body
output:
  smtp:
    host: "smtp.gmail.com"
    port: 587
    auth:
      username: "${GMAIL_ADDRESS}"
      password: "${GMAIL_APP_PASSWORD}"
    from: "${GMAIL_ADDRESS}"
    to: "${!this.to}"
    subject: "${!this.subject}"

2.4 Deploy both pipelines

Click Deploy for each pipeline. They run on your edge node with credentials resolved locally.

Method 2: Google Pub/Sub (real-time)

Real-time email notifications

For production use, Google Pub/Sub delivers instant push notifications when new emails arrive instead of polling IMAP on a schedule.

How it works:

  1. Gmail detects new messages and publishes to a Google Cloud Pub/Sub topic
  2. Expanso subscribes to the Pub/Sub topic and receives the notification
  3. Expanso fetches the email details and passes them to OpenClaw
  4. OpenClaw processes the email (categorize, summarize, draft reply) and can route it to Slack or other services

Setup requires:

  • A Google Cloud project with Pub/Sub API enabled
  • A Pub/Sub topic and subscription
  • Gmail API watch configured to publish to your topic
  • Service account credentials stored locally

See OpenClaw Gmail Pub/Sub docs for detailed Pub/Sub setup, then use Expanso as the pipeline executor for credential isolation and data transformation.

Connect to OpenClaw

Register the Expanso MCP server so OpenClaw can use your Gmail pipelines.

3.1 Register the MCP server

# Register Expanso pipelines with OpenClaw
expanso-cli mcp add npx @expanso/mcp-pipelines

3.2 Test the integration

Open OpenClaw and try these commands:

# Triage your inbox
"Show me my unread emails and categorize by urgency"
# Draft a reply
"Draft a reply to the email from Sarah about the Q4 report"
# Morning digest
"Summarize today's emails and highlight anything with a deadline"
# Cross-platform workflow
"Check my inbox and post urgent items to #alerts on Slack"

Common Gmail workflows

📬 Inbox triage

Fetch all unread emails, categorize by sender and urgency, and present a structured summary. OpenClaw reads through Expanso's Gmail pipeline and applies AI categorization. No email content is sent to the cloud - everything runs locally.

☀️ Morning digest

Automated daily email summary grouped by project. Highlights deadlines, flags follow-ups, and surfaces emails from key contacts. Schedule it to post to Slack or your preferred chat channel every morning.

✏️ Smart draft replies

Ask OpenClaw to draft a reply based on the email thread context and your past responses. The draft is sent to a private Slack channel for review before dispatching - you always have final approval.

🏷️ Auto-labeling

Automatically apply Gmail labels based on content analysis. Route newsletters to "Read Later", invoices to "Finance", and customer requests to "Support". Expanso handles the Gmail API calls.

🔔 Priority alerts

Real-time monitoring for emails from VIP contacts or containing specific keywords. When a match is found, OpenClaw sends an instant alert to your phone via Slack, Teams, or Telegram.

Frequently asked questions

Does OpenClaw store my emails?
No. OpenClaw reads emails on-demand through Expanso pipelines. Email content is processed in memory on your local machine and is not persisted anywhere. The AI sees email content only during the active request.
Is my Gmail App Password safe?
Your App Password is stored in an environment variable on your machine. Expanso reads it at pipeline runtime - it's never sent to OpenClaw or any AI model. You can revoke the App Password at any time from your Google Account settings.
Can OpenClaw send emails without my approval?
That depends on how you configure it. By default, OpenClaw will draft replies and present them for your approval before sending. You can configure automated sending for specific workflows, but the safety boundaries are always under your control.
What about PII in email content?
Expanso supports PII detection and masking processors in the pipeline. You can configure the pipeline to strip sensitive information (SSNs, credit card numbers, addresses) before the content reaches OpenClaw. Email content is automatically wrapped in safety boundaries to prevent injection attacks.
Can I connect multiple Gmail accounts?
Yes. Create separate environment variables for each account (e.g., GMAIL_ADDRESS_WORK, GMAIL_ADDRESS_PERSONAL) and deploy separate pipelines for each. OpenClaw can target specific accounts by pipeline name.

Start connecting Gmail

Get your OpenClaw wired up to Gmail in under 10 minutes.

Related guides