Add “Sign in with Google”
Let users sign in with their Google account. This is built into your app’s auth (GoTrue) and works on every plan — no server code, no upgrade.
1. Before you start
You need a Google account. Social sign-in is free on all plans: your app’s auth reads a few environment variables and handles the rest.
2. Create the OAuth credentials
- In Google Cloud Console, open APIs & Services → Credentials.
- Create an OAuth client ID of type “Web application”.
- Add your project’s redirect URI: as soon as your agent declares the sign-in keys, it appears in Manage › Integrations, in the Google window (“Return address to paste in the Google console”), with a “Copy” button. It ends in /auth/v1/callback and never changes.
- Copy the Client ID and the Client secret.
The redirect URI must match exactly, including https — a mismatch is the #1 cause of failure.
3. Paste the values (exact names)
Declare these four keys in the panel — the names are read verbatim by your auth, so use them exactly (no VITE_ prefix):
- GOTRUE_EXTERNAL_GOOGLE_ENABLED = true
- GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID = your client ID
- GOTRUE_EXTERNAL_GOOGLE_SECRET = your client secret (this is _SECRET, not _CLIENT_SECRET)
- GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI = the same redirect URI, copied from Manage › Integrations
All four are required. Without _ENABLED = true the provider is silently ignored.
4. Common problems
redirect_uri_mismatch: the URI in Google does not match your project’s callback exactly — copy it again from Manage › Integrations.
The Google button does nothing: _ENABLED is missing or not set to true.
You pasted the secret in a field called _CLIENT_SECRET: rename it to _SECRET.