Google

Sign in to Google Cloud

Go to the Google Cloud Console and sign in with the account that should own the OAuth client. It does not have to be the account you sign in to your own site with.

Pick or create a project

An OAuth client belongs to a project, so select one from the project picker in the top bar - or create one if this is a fresh account. Name it after your site; the name is internal and never shown to visitors.

Open the Google Auth Platform

Type Google Auth Platform into the console's search bar and open the first result. This is the section that used to be called "OAuth consent screen", and it is where both the consent details and the clients live.

Fill in the consent details

Google will not issue a client until it knows what to show on the consent screen. Provide the App name - this is the name visitors read in "Sign in to continue to ..." - and a Support email.

Then, under Audience, choose External so anyone with a Google account can sign in. Internal restricts sign-in to a single Google Workspace organisation, which is almost never what a public site wants.

Create the client and set the redirect URI

Go to Clients in the left navigation and press Create client.

1. Application type: Web application.
2. Name: anything - this one is internal too.
3. Under Authorized redirect URIs, add the URI for every origin you run.

VitNode builds this URI itself, from NEXT_PUBLIC_WEB_URL, so it has to match character for character - no trailing slash, no locale prefix.

Add both. Google allows several redirect URIs per client, and one client for dev and prod is fine while you are getting started.

Copy the client ID and secret

Open the client you just created from the Clients list. The Client ID and Client secret are on the right-hand side of the detail panel. Copy both - Google will let you see the secret again, but you may as well paste it straight into .env.

Set the environment variables

These names are not magic - they are whatever you read in your config on the next step. What matters is that they are server-side variables, so no NEXT_PUBLIC_ prefix: that prefix is what marks a value for the browser bundle, and a client secret in the browser bundle is a client secret you have published.

GOOGLE_CLIENT_ID=1234567890-abc.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-xxxxxxxxxxxxxxxx

Register the adapter

Add GoogleSSOApiPlugin to authorization.ssoAdapters in your API config. Note that it is a plain factory function, not a class - there is no new.

import { GoogleSSOApiPlugin } from '@vitnode/core/api/adapters/sso/google'
import { buildApiConfig } from '@vitnode/core/vitnode.config'

export const vitNodeApiConfig = buildApiConfig({
  plugins: [],
  authorization: {
    ssoAdapters: [
      GoogleSSOApiPlugin({
        clientId: process.env.GOOGLE_CLIENT_ID,
        clientSecret: process.env.GOOGLE_CLIENT_SECRET,
      }),
    ],
  },
})

The redirect URI is computed when this file is evaluated, so restart the API rather than relying on a hot reload:

bun dev

pnpm dev

npm run dev

Verify it works

Ask the API what it thinks it supports:

curl http://localhost:3000/api/@vitnode/core/middleware
# {"isEmail":false,"sso":[{"id":"google","name":"Google"}]}

Then open /login and press Google. You should be sent to Google's consent screen, bounced back to /login/sso/google?code=...&state=..., and land on the front page signed in. Your account now has a row in core_users_sso with providerId google.

Publish the app

While the client is unpublished, Google restricts sign-in to the test users you listed and shows an "unverified app" warning. Once the round trip works, go to Google Auth Platform → Audience and press Publish app.