Setup takes a Google Cloud project, an OAuth consent screen, and one OAuth client. Each Authdog environment has its own connection, so register that environment's redirect URI.
Copy the redirect URI
In the Authdog console, select the project and environment, open Authentication > Providers, find Google, and click Enable. Copy the redirect URI shown in the form:
https://identity.authdog.com/api/v1/callback/<connectionId>Configure the consent screen
- Open the Google Cloud console and select or create a project.
- Go to APIs & Services > OAuth consent screen.
- Choose External for a public product, or Internal to restrict sign-in to your Google Workspace organization.
- Fill in the app name, support email, and developer contact.
- Add the scopes
.../auth/userinfo.emailand.../auth/userinfo.profile. - Save.
While the consent screen is in Testing, only the test users you list can sign in, and refresh tokens expire after seven days. Publish it before you launch.
Create the OAuth client
- Go to APIs & Services > Credentials.
- Select Create credentials, then OAuth client ID.
- Choose Web application.
- Under Authorized redirect URIs, paste the redirect URI from Authdog.
- Optionally add your site origin under Authorized JavaScript origins.
- Create, then copy the Client ID and Client secret.
Configure Authdog
Back in the connection form:
| Field | Value |
|---|---|
| Client ID | Ends in .apps.googleusercontent.com |
| Client Secret | The secret shown when the client was created |
Save, then toggle the connection active. The button appears on the hosted sign-in page for that environment. No app redeploy.
Test it
- Open the environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select Continue with Google and complete the flow.
- Confirm the user appears under Users with a Google identity and a verified email.
Troubleshooting
| Symptom | Cause |
|---|---|
Error 400: redirect_uri_mismatch |
The authorized redirect URI does not match Authdog's byte for byte |
Access blocked: app not verified |
The consent screen is in Testing and the account is not a listed test user |
invalid_client |
Client ID or secret pasted from a different Cloud project or client |
| Sign-in works in one environment only | Each environment has its own connectionId, so each needs its redirect URI registered |
Google Workspace domains can use this connector. For employer-controlled sign-in with domain routing, configure Google Workspace as an Enterprise SSO connection instead.
Related
| Read | To learn how to |
|---|---|
| Google connector | The same setup in the connector catalog |
| Marketplace | The listing for this integration |
| Users | How Authdog links identities by verified email |