Google sign-in

Google sign-in is an alternative to email and password. It is entirely optional: unset, the button is hidden and POST /auth/google returns 503.

Setup

1. Create OAuth client ids in the Google Cloud console — a Web client for the admin panel, and an Android client (package name plus signing certificate fingerprint) if you use the app.

2. Tell the server which client ids to accept:

   .env

   GOOGLE_OAUTH_CLIENT_IDS=<web-client-id>,<android-client-id>

   These are the only audiences the server will accept on an incoming ID token.

3. Tell the clients which client id to use — the panel and the app each read the web client id from their own build configuration.

4. Restart the API and confirm googleOAuth is true in GET /config/status.

Client ids are not secrets

An OAuth client id is public by design; it identifies your application. There is no client secret in this flow — the server verifies a signed token rather than exchanging a secret.

How verification works

The client obtains a Google ID token and posts it to /auth/google. The server then:

1. fetches Google’s public signing keys,
2. verifies the token’s signature,
3. checks the issuer, the expiry, and that the audience is one of your configured client ids,
4. finds or creates the matching account, and returns a normal Watcher token.

Verification is done locally against Google’s published keys; there is no OAuth SDK and no callback URL to configure on the server.

Accounts

• A first Google sign-in creates an account with the user role, and its email is treated as verified.
• Signing in with Google to an address that already has a password account links them, so either method works afterwards.
• A Google-only account has no password until it sets one through the reset flow.

Turning it off

Remove GOOGLE_OAUTH_CLIENT_IDS and restart. Existing accounts keep working through email and password, provided they have one.

Troubleshooting

Symptom	Cause
The button does not appear	The client has no client id configured, or the server has none
503 from /auth/google	GOOGLE_OAUTH_CLIENT_IDS is unset on the server
401 with a valid-looking token	The token’s audience is not in the server’s list — usually the Android client id is missing
Works on web, fails on Android	The Android OAuth client needs the app’s package name and signing fingerprint registered