Google

Setup

1. Go to the Google Cloud Console and create an OAuth 2.0 client ID.
2. Add an authorized redirect URI: {BaseURL}/auth/oauth/google/callback.

Configuration

import "github.com/nazimdjebloun/go-auth/provider/google"

goauth.WithAuthentication(goauth.AuthenticationConfig{EmailPassword: true, OAuth: true}),
goauth.WithProvider(google.New(google.Config{
    ClientID:     os.Getenv("GOOGLE_CLIENT_ID"),     // required
    ClientSecret: os.Getenv("GOOGLE_CLIENT_SECRET"), // required
    RedirectURL:  "https://myapp.com/auth/oauth/google/callback", // required
    Scopes:       nil, // optional, default the two scopes below
}))

The authorization request always includes access_type=online (no refresh token is requested from Google — go-auth's own refresh token is separate and unrelated) and prompt=select_account, so returning users always see the account chooser instead of silently re-authorizing whichever account is already signed in.

Email handling

The adapter rejects non-2xx userinfo responses and missing or blank id values. Invalid profiles fail with provider_error; they cannot create, link, or authenticate an identity.

Google's userinfo endpoint returns verified_email directly, and the provider passes it through as-is — no fallback logic like GitHub's, since Google always reports verification status on the primary profile.

Frontend client setup

The Client example below calls the same apiRequest(baseUrl, method, path, body) helper used throughout these guides — see Client → Setup.

Signing in

Start the flow — GET /auth/oauth/google

Public. Returns Google's authorization URL — PKCE (S256) is always included. Redirect the browser there; Google handles the rest until it redirects back to your callback URL.

Response (200 OK): { "url": "https://accounts.google.com/o/oauth2/v2/auth?..." }

Errors

curl

curl https://api.myapp.com/auth/oauth/google

No Origin header needed — this is a GET with no state-changing effect, so OriginCheck doesn't apply to it.

OAuth paths are unmounted when AuthenticationConfig.OAuth is false. Enabling it without a provider fails startup. Registration OAuth controls account creation independently.

Programmatic (Go)

flow, err := auth.Services().OAuth.Initiate(ctx, "google")
if err != nil {
    // wraps a *domain.AuthError — provider_not_found if the name is wrong
}
// Bind flow.State to the initiating browser as the HTTP handler does,
// then redirect the browser to flow.URL.

Client

const { url } = await apiRequest(API_BASE, "GET", "/auth/oauth/google");
window.location.href = url;

The callback — GET/POST /auth/oauth/google/callback

Admin accounts stop for email 2FA by default. Handle step=two_factor, challengeId, and expiresAt on the landing URL and finish through POST /auth/2fa/verify before treating the user as logged in. See Callback outcomes.

Google redirects here itself — your frontend never calls this URL directly. On completed login it sets session cookies and redirects the browser to {BaseURL}/auth/callback; on failure, to {BaseURL}/auth/callback?error={code}&provider=google. Your frontend route at {BaseURL}/auth/callback reads that query string to know whether to show the app or an error.

See Routes for the full parameter reference, Error Handling for every error this can redirect back with, and Guides → OAuth linking for connecting Google to an account that's already logged in (a different flow from the sign-in one above).

Next

• GitHub — the other built-in provider
• OAuth linking — link/unlink/list connected providers on an existing account
• Authentication — the response shape once a session exists, regardless of how it was created