# Google Play Onboarding (setup Step 3d)

Loaded on demand by `/multi-agent:setup` Step 3d (Android only, optional). The SKILL.md carries the step intro; this file is the full flow.

Runs inside Step 3, only when the target repo is Android, the same way Step 3b
runs only for iOS. One entry, `google_play`: a Google Cloud service-account JSON,
stored exactly as Google issued it. The toolkit's `store_play_*` tools
authenticate with it through the store reference file, and it is what lets
`/multi-agent:store-ready` hand Android Gate 2 to Google instead of reporting it
`SKIPPED`.

## Ask

Picker: **Add Google Play** / **Skip**. `question` and `description` in
`outputLanguage`; `label` and `header` (`Google Play`) English. Skip writes
nothing.

## What the account needs

Say this before asking for the file; a key that authenticates but reaches nothing
is the common failure.

1. Play Console -> Setup -> API access: link a Google Cloud project, create (or
   pick) a service account and download its JSON key.
2. Play Console -> Users and permissions: invite the service account's
   `client_email` with permissions for the apps it should read.
3. In that Google Cloud project, enable the **Google Play Android Developer API**
   and the **Google Play Developer Reporting API**.

## Validate before saving

Ask for the JSON's **path**, never its contents; a file does not go through the
clipboard or the chat.

```bash
node "$HOME/.claude/scripts/probe-store-key.mjs" --play --service-account "<path to service-account.json>"
```

It exchanges a signed assertion at `oauth2.googleapis.com` for the
`androidpublisher` and `playdeveloperreporting` scopes, reads one page of
`apps:search` on the reporting API, and prints `{ok, store, status, hint}` with no
key material. Exit 0 = accepted. On exit 1 show the `hint` and save nothing:

| Status | Meaning | Fix |
|---|---|---|
| `403` with `SERVICE_DISABLED` | one of the two APIs is off in the account's Cloud project | enable both APIs (step 3 above), probe again |
| any other `403` | the account is not invited in Play Console, or holds no app permission | step 2 above |
| `400` / `401` at the token step | the key was deleted or disabled, or the clock is off | generate a new key for the account |

Exit 2 is a usage problem (wrong path, not a service-account file).

## Save

Map `keychainMapping.google_play` first: the standard name
`${USER}_GooglePlay_Access_Json`, or the existing mapping when re-onboarding
(Token Save Flow Step D). `set` resolves a logical key through the mapping, and an
unmapped one would be stored under the bare logical name. Then:

```bash
~/.claude/lib/credential-store.sh set google_play - < "<path to service-account.json>"
node "$HOME/.claude/scripts/write-store-config.mjs"
```

The writer names the item in `~/.config/multi-agent-toolkit/store.json` (0600,
directory 0700) after checking it exists without reading it. `store_status` in the
toolkit then reports Google Play as configured from the Keychain, and
`store_status({probe: true})` makes one read-only call to confirm it.

The JSON stays on disk unless the user asks otherwise: Google issues a new key on
request, so the file is not the only copy the way a `.p8` is.