Set up "Sign in with Google"

This is the full version of the wizard in the dashboard. It takes about ten minutes, and costs nothing. You'll copy two things from Google (a client ID and a client secret) into JSONPad, and one URL from JSONPad into Google.

If you haven't read it yet, signing in with Google, GitHub and others explains how the whole flow works.

1. Create a Google Cloud project

1. Go to the Google Cloud console and sign in.
2. Use the project picker at the top to choose a project, or create one for your app. Anything in the project (including this OAuth app) can be deleted with it later, so a project per app is tidy.

2. Tell Google about your app

1. Open Google Auth Platform in the console menu (under APIs & Services).
2. The first time, click Get started. Fill in your app's name and a support email address; these are what people see when they sign in.
3. For Audience, choose External, which means anyone with a Google account can sign in. (Internal only exists for Google Workspace organizations, and only lets your own staff in.)
4. Add a contact email address and finish the form.

You can change your app's name, logo and links later under Branding.

3. Create an OAuth client

1. Go to Clients and click Create client.
2. Choose Web application as the application type, and give it a name (only you see this one).
3. Under Authorized redirect URIs, add the URL(s) from the next step. You don't need Authorized JavaScript origins: JSONPad's requests to Google come from JSONPad's servers, not from the browser.
4. Click Create. Google shows you the Client ID and Client secret: keep the tab open, or download the JSON.

4. Which redirect URIs to add

It depends on the callback mode you choose in the JSONPad wizard. Straight back to your app is the default for Google, because it lets Google show your own domain on the consent screen.

• Straight back to your app: add every page that sign-ins return to, exactly as your app uses it, e.g. https://myapp.com/auth/callback and http://localhost:5173/auth/callback. Google allows http://localhost with any port, so development works without a tunnel. Add each of them as a redirect URL on the identity group as well.
• Through JSONPad: add one URL, https://api.jsonpad.io/identities/oauth/callback. Your app's pages then only need to be redirect URLs on the identity group, and you never touch the Google console again when you add an environment.

5. Paste the credentials into JSONPad

1. Open your identity group in the dashboard, find Google under Sign-in providers, and click Set up.
2. Choose the callback mode, and add your app's return pages.
3. Paste the client ID and secret, then click Save and check. JSONPad asks Google whether the pair is valid and tells you straight away. The secret is encrypted, and can't be read back afterwards.
4. Run a test sign-in with your own Google account. It shows what Google sent back, and creates nothing.
5. Turn Google on for the group with Enable.

6. Going live

A new app's publishing status is Testing, which means only the test users you list under Audience can sign in (up to 100), and their sign-ins expire after a week. When you're ready, click Publish app there.

JSONPad only asks Google for the openid, email and profile scopes, which Google treats as non-sensitive, so publishing doesn't need Google to review your app. People may see an "unverified app" warning until you verify your brand under Branding, which needs a domain you own and a privacy policy.

Troubleshooting

Google changes this console often. If a menu isn't where this page says it is, the wording in the console is usually close enough to find it.