Google OAuth

Google Sign-In uses one Web OAuth client (id + secret) for the API Socialite redirect and as the ID token audience for Android native sign-in. Optional separate Android and iOS OAuth clients register package/bundle IDs with Google.

Google Cloud Console

1. Create or select a project.
2. Configure the OAuth consent screen (External for production; Testing works for developer accounts).
3. Create credentials:

Client type	Used for
Web application	API GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET; redirect URI {APP_URL}/auth/google/callback; authorized JavaScript origin {FRONTEND_URL}
Android	Package name com.garrisonbible.app + SHA-1 of your signing/debug keystore
iOS	Bundle ID from mobile/iosApp/Configuration/Config.xcconfig (com.garrisonbible.app)

Important: Android and iOS native SDKs must request ID tokens with the Web client ID as serverClientId / audience—not the Android/iOS client id alone.

Local HTTPS dev redirect example:

• Redirect URI: https://api.garrison.test/auth/google/callback
• JS origin: https://app.garrison.test

API environment

Set in api/.env, docker/stack.env, or Helm secrets:

GOOGLE_CLIENT_ID=your-web-client-id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=...
# Optional; defaults to ${APP_URL}/auth/google/callback
GOOGLE_REDIRECT_URI=https://api.example.com/auth/google/callback

Also ensure FRONTEND_URL, SANCTUM_STATEFUL_DOMAINS, SESSION_DOMAIN, and CORS_ALLOWED_ORIGINS match your app origin.

Google OAuth requires HTTPS in normal setups (bin/start with mkcert/Traefik). bin/start --http may break Secure session cookies and OAuth redirects.

Web app

When authMethods.google is true, login shows Continue with Google (intent=login). Register shows Register with Google (intent=register). New users complete 18+ and terms on /register/complete after Google returns. Login never creates an account for an unknown Google identity (except verified-email auto-link to an existing account). The same email auto-link applies to Apple and Facebook.

Profile → Connected accounts links or unlinks Google. OAuth-only accounts can Set a password before unlinking Google.

Mobile (Android)

Set the Web client id in Gradle (repo root or mobile/gradle.properties):

GOOGLE_WEB_CLIENT_ID=your-web-client-id.apps.googleusercontent.com

Build with:

./gradlew :androidApp:assembleDebug -PGOOGLE_WEB_CLIENT_ID=your-web-client-id.apps.googleusercontent.com

Register the debug keystore SHA-1 on the Android OAuth client in Google Cloud.

Mobile (iOS)

Add the GoogleSignIn-iOS package in Xcode (already referenced from mobile/iosApp). Set these in mobile/iosApp/Configuration/Config.xcconfig:

GOOGLE_IOS_CLIENT_ID=your-ios-client-id.apps.googleusercontent.com
GOOGLE_WEB_CLIENT_ID=your-web-client-id.apps.googleusercontent.com
GOOGLE_IOS_URL_SCHEME=com.googleusercontent.apps.your-ios-client-id

GOOGLE_IOS_URL_SCHEME is the iOS client ID with the com.googleusercontent.apps. prefix reversed (Google Cloud Console shows the URL scheme). Native sign-in still requests an ID token whose audience is the Web client ID (GIDServerClientID).

The login screen shows Continue with Google when authMethods.google is true and those values are set. Unknown Google identities do not create accounts — users must register on the web app first.

Smoke test

1. Open https://app.<host>/login with API env configured.
2. Continue with Google → Google account picker → existing user lands in app; new user on register flow sees /register/complete then onboarding.
3. Profile → link/unlink Google (set password before unlink if OAuth-only).