Google

Setup

1. Go to the Google Cloud Console and create an OAuth 2.0 client ID.
2. Add an authorized redirect URI: {BaseURL}/auth/oauth/google/callback.

Configuration

import "github.com/nazimdjebloun/go-auth/provider/google"

goauth.WithProvider(google.New(google.Config{
    ClientID:     os.Getenv("GOOGLE_CLIENT_ID"),     // required
    ClientSecret: os.Getenv("GOOGLE_CLIENT_SECRET"), // required
    RedirectURL:  "https://myapp.com/auth/oauth/google/callback", // required
    Scopes:       nil, // optional, default the two scopes below
}))

The authorization request always includes access_type=online (no refresh token is requested from Google — go-auth's own refresh token is separate and unrelated) and prompt=select_account, so returning users always see the account chooser instead of silently re-authorizing whichever account is already signed in.

Email handling

Google's userinfo endpoint returns verified_email directly, and the provider passes it through as-is — no fallback logic like GitHub's, since Google always reports verification status on the primary profile.

Frontend client setup

The Client example below calls the same apiRequest(baseUrl, method, path, body) helper used throughout these guides — see Client → Setup.

Signing in

Start the flow — GET /auth/oauth/google

Public. Returns Google's authorization URL — PKCE (S256) is always included. Redirect the browser there; Google handles the rest until it redirects back to your callback URL.

Response (200 OK): { "url": "https://accounts.google.com/o/oauth2/v2/auth?..." }

Errors

curl

curl https://api.myapp.com/auth/oauth/google

No Origin header needed — this is a GET with no state-changing effect, so OriginCheck doesn't apply to it.

Programmatic (Go)

url, err := auth.Services.OAuth.Initiate(ctx, "google")
if err != nil {
    // *domain.AuthError — provider_not_found if the name is wrong
}
// redirect the browser to url

Client

const { url } = await apiRequest(API_BASE, "GET", "/auth/oauth/google");
window.location.href = url;

The callback — GET/POST /auth/oauth/google/callback

Google redirects here itself — your frontend never calls this URL directly. On success it sets session cookies and redirects the browser to {BaseURL}/auth/callback; on failure, to {BaseURL}/auth/callback?error={code}&provider=google. Your frontend route at {BaseURL}/auth/callback reads that query string to know whether to show the app or an error.

See Routes for the full parameter reference, Error Handling for every error this can redirect back with, and Guides → OAuth linking for connecting Google to an account that's already logged in (a different flow from the sign-in one above).

Next

• GitHub — the other built-in provider
• OAuth linking — link/unlink/list connected providers on an existing account
• Authentication — the response shape once a session exists, regardless of how it was created