Query Google's Gemini models over a simple HTTP API. Three routes: the full generateContent payload, just the answer text, or an instruction-prefixed answer. The API key and model are managed variables, so you can swap models without redeploying; the prompt is JSON-escaped before it hits the Gemini API.
The OAuth2 authorization-code flow with refresh, per user - the flow behind every 'connect your Google account' button. Single-use CSRF state, tokens sealed with AES-256-GCM (encrypt_value) and never stored in the clear, transparent refresh driven by an absolute expires_at, and correct handling of providers that send refresh_token only on the FIRST consent.