> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/membership/integrations/providers/google-sign-in.md).

# Google Sign In

Connect Google Sign In to Membership — let your users sign in with Google.

Lets your users sign in with their Google account, through an OAuth 2.0 client of your Google Cloud project.

## Get your credentials

1. Open the [Clients page](https://console.developers.google.com/auth/clients) of the Google Cloud console (Google Auth Platform) and sign in. Pick or create the project.
2. Press **Create Client** and choose the application type **Web application**.
3. Give it a name and add your app's address under **Authorized redirect URIs**. The address must match exactly.
4. Press **Create**. Copy the **Client ID** (it ends in `.apps.googleusercontent.com`) and the **Client secret** (it starts with `GOCSPX-`), or download them as `client_secret.json`. Keep the secret out of your source code.

Source: Google, [Using OAuth 2.0 for Web Server Applications](https://developers.google.com/identity/protocols/oauth2/web-server).

## Connect it in Cloud

**Where:** Membership → Integrations → **Add New Integration** → Google Sign In → **Connect** · `/projects/<project>/membership/integrations/new/google`

Fill the form and press **Save**. The form stays open as **Editing Google integration** with the **ENABLED** badge and the new id (`int_LzdgB21WazdHlEY4cUfkq`).

| Field            | Required  | What it does                                                         | Example                                         |
| ---------------- | --------- | -------------------------------------------------------------------- | ----------------------------------------------- |
| Client Id        | yes (new) | The OAuth 2.0 client id of your Google Cloud project.                | `1234567890-example.apps.googleusercontent.com` |
| Client Secret    | yes       | The matching client secret. Encrypted on save and never shown again. | `GOCSPX-example-not-a-secret` (made up)         |
| Integration Name | yes       | The name in your integrations list.                                  | `Google sign-in`                                |

**OAuth Modes** — press **Add OAuth mode** for each surface of your app (web, mobile, admin) that signs in with this provider:

| Field                                      | Required | What it does                                       | Example                                        |
| ------------------------------------------ | -------- | -------------------------------------------------- | ---------------------------------------------- |
| Mode name                                  | yes      | A name for the surface.                            | `web`                                          |
| Callback URL                               | yes      | Where the user lands in your app after signing in. | `https://app.example.com/auth/google/callback` |
| Logout URL (optional)                      | no       | Where the user lands after signing out.            | —                                              |
| Failure redirect URL (optional)            | no       | Where the user lands when the sign-in fails.       | `https://app.example.com/sign-in?failed=1`     |
| Role to assign on first sign-in (optional) | no       | The role a new user gets on the first sign-in.     | —                                              |

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-938d40a7b9ee9898768ba26a7945c8f57e2fd31d%2Fgoogle-sign-in-form-1.png?alt=media" alt="New Google Integration form: Client Id 1234567890-example.apps.googleusercontent.com, a hidden Client Secret, Integration Name Google sign-in"><figcaption><p>The filled form.</p></figcaption></figure>

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-962eca2696ebff104609c5881c575649c792c131%2Fgoogle-sign-in-form-2.png?alt=media" alt="OAuth Modes with one mode: Mode name web, Callback URL https://app.example.com/auth/google/callback, Failure redirect URL https://app.example.com/sign-in?failed=1, and Add OAuth mode"><figcaption><p>One OAuth mode for the web app.</p></figcaption></figure>

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-f2ad1700c5958e2a91b42682b4d7dcaf80062546%2Fgoogle-sign-in-saved-3.png?alt=media" alt="Editing Google integration after save: the ENABLED badge, the id int_LzdgB21WazdHlEY4cUfkq, the provider fields empty and the Integration Name Google sign-in"><figcaption><p>After save.</p></figcaption></figure>

{% hint style="warning" %}
Two things to know today. **(1)** When you open a saved integration, its fields come back empty — only the name and the state load, and the saved OAuth modes are not shown — so type every value again before you press **Save** on it. **(2)** No Norbix sign-in endpoint uses membership integrations yet: saving stores the settings, but your users cannot sign in with Google through the API until it ships.
{% endhint %}

## Test and set as default

Membership integrations have no **Test** and no **Set as default** in Cloud — see [Test an integration](/codemash/cloud/membership/integrations/test.md) and [Set an integration as default](/codemash/cloud/membership/integrations/set-default.md). Check the values against the provider's console; **Actions → Disable** turns the integration off — see [Disable or delete an integration](/codemash/cloud/membership/integrations/disable.md).

## Common errors

| Message                                          | Cause                                                              | Fix                                                                    |
| ------------------------------------------------ | ------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| *Required* under a field                         | A required field is empty.                                         | Fill it; on a saved integration, type the secret again.                |
| Secret is not provided (`CM-ERRORS-SECRETS-001`) | Saved from code without the secret.                                | Send the secret on every save.                                         |
| *redirect\_uri\_mismatch* (at Google)            | The address your app sends is not in **Authorized redirect URIs**. | Add the exact address to the OAuth client in the Google Cloud console. |

Messages marked *(at …)* are the provider's own, shown to the user while signing in; see the [provider documentation](https://developers.google.com/identity/protocols/oauth2/web-server).

## Do it from code

```sh
norbix hub membership integration save --integration '{"provider":"Google","integrationName":"Google sign-in (staging)","isEnabled":true,"clientId":"1234567890-staging.apps.googleusercontent.com","clientSecret":"your-google-client-secret","oAuthModes":[{"name":"web","callbackUrl":"https://staging.example.com/auth/google/callback"}]}'
```

With the SDK, send the same object as `integration` to `saveMembershipIntegration` — see the run example on [Providers](/codemash/cloud/membership/integrations/providers.md#do-it-from-code) and in [Save Membership Integration](/codemash/sdks/membership/integrations/save-membership-integration.md). Send `isEnabled: true`; to update, add the id as `integrationId` and the secret again. API: [Save Membership Integration](/codemash/api-reference/membership/integrations/save-membership-integration.md)