Material Backend

Next.js API routes: Claude proxy + Google OAuth. Nothing else.

1. Claude Proxy

Calls /api/claude, which forwards to api.anthropic.com using ANTHROPIC_API_KEY from the server environment — the key never reaches this page.

2. Google OAuth

Starts the real Authorization Code flow against a Web-application OAuth client (separate from exposure_scan.py's Desktop client). Redirects to Google, comes back to /api/oauth/google/callback, stores the token via lib/tokenStore.ts.

Connect Google Account

3. Gmail Test Call

Calls /api/gmail/test, which reads the stored token, refreshes it if needed, and hits the Gmail API's users.getProfile endpoint — the same userId="me" pattern exposure_scan.py uses.